Recovering from Migration Failures
Review these recommendations on how you can recover from migration failures.
pcemigrate Failures
pcemigrate failures generally affect the migration workflow or the transfer of PCE objects. They are often caused by platform limits, permissions, or input-file issues.
Review the pcemigrate logs to identify the cause.
pcemigrate migrate and pcemigrate sync
The pcemigrate migrate and pcemigrate sync commands can fail due to SaaS PCE object limits or insufficient credentials for certain operations.
After resolving the issue, rerun the command; by default, it resumes from the point of failure. To restart from the beginning, specify the --force-restart option.
pcemigrate transplant-vens
The pcemigrate transplant-vens failures are typically caused by migration not being enabled on the on-prem PCE or by an incorrectly formatted JSON href file. After fixing the issue, rerun the command.
VEN Migration Failures
VEN migration failures generally occur after the PCE migration workflow has started and affect connectivity, clone activation, or the health of the migrated VEN. Use the VEN and PCE status information, along with the pcemigrate logs, to determine which condition applies.
A VEN migration can fail for the following reasons:
Connectivity issues with the SaaS PCE
The VEN continues sending heartbeats to the on-prem PCE. Resolve the connectivity issue, then rerun the
pcemigrate transplant-venscommand. Possible causes include:The VEN is in an enforcement mode other than visibility-only, and no special ruleset allows the VEN host to communicate with the SaaS PCE.
Incorrect proxy or port configuration.
The VEN cannot complete clone activation with the SaaS PCE
No corresponding managed workload appears on the SaaS PCE, even though the VEN sends heartbeats to it. This will likely require intervention from Illumio Support.
The VEN migrated to the SaaS PCE but is not healthy
Follow the standard investigation and escalation procedure to resolve the issue.