Illumio PCE-based interface classification (PCE NLA) for endpoints in ZTNA client environments
On domain-joined Windows endpoints, Illumio can apply different policy depending on whether the host is on the corporate network or on an external network. That distinction normally relies on Windows Network Location Awareness (NLA) classification of the host's interfaces.
Introducing a modern Zero Trust Network Access (ZTNA) client, such as Netskope Private Access, into a domain-joined Windows environment makes standard NLA classification ineffective. PCE-based interface classification (PCE NLA) resolves this so that ingress enforcement remains correct in ZTNA client environments.
With PCE NLA, enforcement responsibilities are separated cleanly:
Ingress traffic is enforced on the domain-joined Windows host using Illumio policy provided by the PCE.
Egress traffic is enforced through the ZTNA client.
This keeps policy control consistent even when the ZTNA client shifts traffic paths away from the local network.
Why a ZTNA client affects NLA classification
Windows classifies a network connection as domain or corporate versus public or external, and enforcement can depend on that classification. Windows determines this from interface state: the domain-join status of the host is evaluated when the VEN starts, and per-interface domain-authenticated status is re-evaluated whenever an interface changes, for example when an address is assigned or a VPN connects.
A modern ZTNA client establishes its secure tunnel over the host's existing interfaces without creating a new network interface. Because there is no interface state change for Windows to react to, standard NLA classification no longer reflects the host's true connection to corporate resources, and enforcement that depends on it becomes unreliable.
How PCE NLA works
When PCE NLA is enabled, the Windows VEN uses PCE-provided interface classification, rather than local Windows NLA classification, to decide which policy applies for ingress enforcement.
On corporate versus external networks. The same rules apply in both cases. What changes is which classification, and therefore which policy, the host applies to ingress traffic based on the PCE classification.
Peer policy. The VEN reports each interface's corporate or non-corporate status to the PCE so the PCE can compute the correct rules for peer workloads.
Egress. Egress rules are still delivered to and present on the host, and egress is enforced through the ZTNA client when the client routes traffic through Private Access.
Policy refresh. After a classification change, policy is refreshed on the next heartbeat or sooner.
How traffic classification is reported
PCE NLA governs how ingress policy is enforced on the host. How individual flows are labeled as corporate or external in traffic reporting reflects the Windows operating system's own runtime network classification, which is determined independently of the Illumio enforcement decision. As a result, the network classification shown for a flow reflects what Windows reports, while enforcement follows the PCE classification.
Enabling PCE NLA
PCE NLA is a selectable interface-classification method for domain-joined Windows hosts, chosen between Windows NLA and PCE NLA. It is configured as an organization-wide setting through the PCE.
Requirements and supported versions
Platform: domain-joined Windows endpoints running the Illumio Windows VEN.
ZTNA client: a modern ZTNA client such as Netskope Private Access.
VEN version: 26.2.20 or later.
PCE version: the PCE-side support is available in PCE 26.2.20 and 26.4.0+
Behavior and timing
Interface classification is evaluated on interface status changes.
After a classification change, ingress policy is refreshed on the next heartbeat or sooner.
In ZTNA client environments, the client can connect without an interface state change. PCE NLA addresses this by having ingress enforcement follow the PCE-provided policy for the host, so policy control remains consistent.