Before You Start the Migration

Step 1: Upgrade to Release 26.2.10

Upgrade your PCE to version 26.2.10. See Pre-Migration Tasks.

Step 2: Create and Exchange the Key Pairs

Create a key pair (public/private key pair). Open an Illumio Support case to provide your public key to Illumio and get a public key from Illumio.

Your runtime configuration contains these keys:

Your private key
Illumio's public key

Step 3: Enable VEN Migration on the On-prem PCE

Change runtime configuration to enable migration tools.

Enable and configure the runtime data in runtime_env.yml.

Important

Enable runtime configuration across all on-prem PCE nodes.

Include these additional runtime parameters:

inter_pce_ven_migration_enabled: true

inter_pce_ven_migration_jwt_key_pair: |
-----BEGIN RSA PRIVATE KEY-----
<on-prem-pce-private-key>
-----END RSA PRIVATE KEY-----

inter_pce_ven_migration_token_expiry_secs: 3600

inter_pce_ven_migration_peers:
  - fqdn: "<saas-pce-fqdn>"
    enabled: true
    public_key: |
    -----BEGIN PUBLIC KEY-----
    <saas-pce-public-key>
    -----END PUBLIC KEY-----
    allowed_source_orgs:
      - <saas-org-id>

skip_agent_info_timed_work_checks_org_ids:
  - <on-prem-org-id>

workload_update_allow_list_org_ids:
  - <on-prem-org-id>

where:

Runtime	Description
inter_pce_ven_migration_enabled: true \| false	Enable the migration.
inter_pce_ven_migration_jwt_key_pair	This is the private key corresponding to the public key you submit to Illumio.
inter_pce_ven_migration_token_expiry_secs	Time in seconds that the PCE will attempt to migrate any single VEN. The default value for how long to continue attempting the migration is 1 hour.
inter_pce_ven_migration_peers[].enabled	Specify the parameters of your SaaS PCE. Enable or disable migration to a SaaS PCE.
inter_pce_ven_migration_peers[].fqdn	The FQDN of the SaaS PCE (for example, scp30.ilum.io)
inter_pce_ven_migration_peers[].public_key	The public key received from Illumio.
allowed_source_orgs	Your org ID on the SaaS PCE.
skip_agent_info_timed_work_checks_org_ids	The on-prem org ID to disable offline timers during the migration, typically org 1.
workload_update_allow_list_org_ids	Allow on-prem org ID to update managed workloads during the migration, typically org 1.

Note

You can apply runtime patches simultaneously, but be aware that PCE resources are diverted to the migration processes.

Restart the PCE to sync runtime_env.yml.
```
illumio-pce-ctl cluster-restart
```

Install, Configure, and Upgrade Guide for 26.x