Skip to main content

Illumio Administration Guide 26.x

VEN Clone Detection and Remediation

When a workload is cloned, the installed VEN is also cloned. Cloned VENs can cause significant load and consistency issues for the PCE. Clones may also generate redundant heartbeats and conflicting policy synchronization events, often triggered by frequent IP changes or duplicated host identities.

To address these issues, the PCE detects cloned workloads so that the associated cloned VEN can be assigned (either automatically or manually) a unique identity distinct from the original VEN. This is known as remediation.

Clone Detection Signals

  • Event Log: When a clone is detected, the PCE generates a Workload Clone Alert and logs the event agent.clone_detected in the Event log.

The next two bullets apply only to detected, unremediated VEN clones (pending manual remediation).

  • PCE UI: A red error icon appears on Servers & Endpoints > Workloads > VENs, and the cloned VEN’s details page displays “VEN clone detected.” You can also search for cloned VENs by filtering for “VEN clone detected.”

  • REST API: The Illumio REST API represents clone detection with the clone_detected state.

Clone Remediation Support Matrix

Use the following table to determine whether clone remediation is automatic or manual for a given operating system and PCE/VEN version combination.

Operating system and domain state

PCE and VEN versions

Supported Remediation Type

Windows (domain-joined)

All PCE and VEN versions compatible with each other.

Automatic

Note

In this use case (Windows domain-joined), an earlier version of this feature — providing the same functionality — is already enabled by default. For greater stability, Illumio recommends updating to the latest version of the feature as described in Enable VEN Clone Detection.

  • Windows (non-domain-joined)

  • Linux

  • Solaris

VEN versions 25.2.40 and later paired with the following PCE versions support automatic remediation:

PCE Versions supporting Auto Remediation

On-prem

  • 25.2.41 and later 25.2 releases

  • 26.2.20 and later 26.2 releases

SaaS

  • 26.4.x and later 26.4 releases

  • 26.40.x and later 26.40 releases

Automatic. Enablement is required as described in the note below.

  • Windows (non-domain-joined)

  • Linux

  • Solaris

Pre-25.2.40 VENs and the following PCE versions do not support automatic remediation:

PCE Versions not supporting Auto Remediation

  • 25.2.40 and earlier 25.2 releases

  • 25.4.x

  • 26.1.x

  • 26.10.x

  • 26.20.x

  • 26.3.x / 26.30.x

Manual

AIX

All versions

Manual

Note

Who enables Automatic Remediation on supported PCEs?

For supported Linux, Solaris, and non-domain-joined Windows workloads, automatic remediation is not enabled by default. Who enables the feature for these workloads depends on the PCE deployment type:

  • Supported on-premises PCEs: Customers can enable the feature.

  • Supported SaaS PCEs: Contact Illumio to enable the feature.

Understanding Remediation Types
Automatic Remediation

Important

See the support information detailed in the above table.

Automatic Remediation automatically pairs detected clones with the PCE without requiring user intervention. As part of this process, the cloned VEN is assigned its own identity and becomes a distinct agent separate from the original VEN. Pairing is synonymous with activating the VEN.

Manual Remediation

When automatic remediation isn't possible, perform the following steps to manually remediate cloned VENs:

  1. Filter for "VEN clone detected" in Servers & Workloads > Workloads > VENs tab.

  2. Deactivate and unpair the cloned VEN(s).

  3. Pair the VEN with the PCE. See Pairing Profiles and Scripts.

Enable VEN Clone Detection

Note

These steps are for customers with supported on-prem PCEs only.  Customers with supported SasS PCEs must contact Illumio to enable this feature for their tenants.

Complete the following steps to enable the latest version of VEN Clone Detection for your organization.

  1. Obtain your Organization ID.

    1. In the PCE UI, hover over the user profile icon in the upper-right corner.

    2. Copy the value shown for Organization ID.

  2. Access the PCE host using an account with permission to modify PCE configuration files.

  3. Open the agent.yml configuration file.

    vi /opt/illumio-pce/illumio/config/agent.yml

  4. Locate the following setting.

    orgs_using_clone_detection_v3: []

  5. Add your Organization ID between the brackets.

    For example, if your Organization ID is 8675309, update the setting as follows.

    orgs_using_clone_detection_v3: [8675309]

  6. Save the file and exit the editor.

  7. Stop NGINX so that the configuration change can take effect.

    /opt/illumio-pce/illumio/scripts/nginx stop

  8. Run the stop command again to confirm that NGINX has stopped.

    /opt/illumio-pce/illumio/scripts/nginx stop

  9. Confirm that the command returns the following status.

    NOT RUNNING

  10. Verify that Service Discovery has restarted NGINX.

    /opt/illumio-pce/illumio/scripts/nginx status
Status nginx           RUNNING