PCE Support for IPv6 VEN communication

By default, the PCE accepts VEN-to-PCE (southbound) connections only over IPv4. To enable the PCE to support IPv6-enabled VENs, configure it to accept IPv6 connections by enabling dual-stack support in the PCE runtime environment. This configuration allows IPv6-only VENs to communicate with the PCE, while existing IPv4 VENs continue to operate normally.

Important

While this configuration enables IPv6 connectivity for VEN-to-PCE (southbound) communication, internal PCE communication remains IPv4-only at this time.

Prerequisites

On-premises PCE release 24.2.x or later.
If you are implementing this support in a cluster, make sure to apply the configuration described in this document to all PCE nodes.
Make sure that the VENs in your environment can resolve and reach the PCE over IPv6 (for example, through DNS and network configuration).

Configuration Steps

This procedure enables the PCE front end to listen on both IPv4 and IPv6 interfaces, allowing it to accept IPv4 and IPv6 connections from VENs.

STEP 1: Update runtime_env.yml on all nodes

Back up the runtime_env.yml file.
In a Supercluster, store a copy of each node's runtime_env.yml file on a system that is not part of the Supercluster. The default location of the PCE Runtime Environment File is /etc/illumio-pce/runtime_env.yml.
Add the following to the runtime_env.yml file:
```
front_end_https_network: dual
```
Run the following command to validate the configuration.
```
sudo -u ilo-pce illumio-pce-env check
```
Repeat these steps on all nodes in the PCE cluster.

STEP 2: Ensure VENs can reach the PCE over IPv6

Note

Details about creating DNS records, configuring IPv6 routing, and adjusting firewall or security rules are not covered in this document.

To ensure that your VENs can resolve and reach the PCE using IPv6, configure the cluster_fqdn and cluster_event_service_fqdn settings on all nodes in the PCE cluster to allow VEN firewall rules to communicate with the PCE.
Note
Define cluster_fqdn and cluster_event_service_fqdn as YAML lists of IPv4 and IPv6 addresses. Specify each address as an indented list item.
Example configuration:
```
cluster_public_ips:              
 cluster_fqdn:
   - <IPv4-address-node-1>
   - <IPv4-address-node-2>
   - <IPv6-address-node-1>
   - <IPv6-address-node-2>

 cluster_event_service_fqdn:
   - <IPv4-address-node-1>
   - <IPv4-address-node-2>
   - <IPv6-address-node-1>
   - <IPv6-address-node-2>
```
Repeat these steps on all nodes in the PCE cluster.

STEP 3: Restart the PCE to apply the changes

sudo -u ilo-pce illumio-pce-ctl restart

Illumio Administration Guide 26.x (SaaS)