Illumio Security Policy Guide 25.4

Utilize a virtual service in the following situations:

Policy Generator and Explorer support virtual services. To create rules based on labels, assign labels to a virtual service. A virtual service lacks enforcement and relies on the enforcement of its bound workloads.

Virtual services are provisionable objects, necessitating the creation and provisioning of applications on workloads beforehand. Workload bindings, however, can be altered without the need for provisioning. The most recent changes have moved port overrides from the virtual service to the workload binding.

Imagine a single workload running an Apache Tomcat and an Apache HTTP server, catering to HRM and ERP applications. To manage these services efficiently, virtual services can be established for each, labeling one for the HRM app and another for ERP. With label-based rules, you can distinctly control the Apache Tomcat serving the HRM app, segregating it from the ERP application.

In this scenario, two distinct virtual services are generated: one for an HRM database and one for an ERP database. Using these configurations, communication between the web and database for each application (HRM or ERP) can be controlled, considering the specific environment (Prod or QA) and location (US or EU).

Virtual Service - HRM

Virtual Service - ERP

When you create rules for virtual services using the Policy Generator or from Illumination, add the “Uses Virtual Services only” option or “Uses Virtual Services and Workloads” option in the Source or Destination field of the generated rules. You can configure virtual services using a port or a port range.

When you write a rule in a ruleset, specify these values:

For example:

When you write rules using virtual services, you do not need to select a service in the rule, because the virtual service is both the service and the source of the service.

For example:

When you want to treat the source as a virtual service, select Uses Virtual Services or Uses Virtual Services and Workloads from the Source drop-down list as the service.

To write a rule that applies to all virtual services labeled Database, write it the same way and select Uses Virtual Services or Uses Virtual Services and Workloads as the providing service.

When you select a specific service, the rule applies only to workloads with the selected label.

For example, for the following virtual service rule:

The rule is only applied to workloads that use the DB label.

However, when the virtual service rule is the following type of rule:

The inbound side of the rule is applied to all workloads bound to the virtual service using the DB label.

Consider these advanced configuration options when configuring a virtual service.

Combining stateless and forwarding rules on the same host and port isn't supported. For instance, if a service on a port has stateless rules, a forwarding rule allowing traffic to a container on the same host and port doesn't function if the destination is identical.

You can filter the Virtual Services list by using the properties filter at the top of the list. For example, you can filter and search by label. In the case of DNS-based rules, you can also filter and search by the following objects: