Overview of VEN on DPU
Learn the basics of running Illumio VEN on NVIDIA BlueField-3 DPU for hardware-accelerated, agentless workload discovery.
About NVIDIA BlueField-3 DPU
The NVIDIA BlueField-3 DPU (Data Processing Unit) is a specialized processor commonly used in modern data centers to accelerate cloud workloads, improve security, and free up CPU resources so applications can run faster.
Unlike a standard network card, an NVIDIA DPU combines high‑speed network interfaces with its own programmable CPU cores and dedicated hardware accelerators. This allows hosts to offload work to it. A DPU can run infrastructure services independently and speed up tasks such as packet processing, encryption, and system monitoring. They're increasingly used in OT environments to bring stronger security and zero‑impact enforcement to industrial systems.
Tip
Read NVIDIA docs to learn more about DPUs.
About Illumio VEN
The Illumio VEN (Virtual Enforcement Node) is a lightweight software agent that runs in a workload (such as a virtual machine, container host, or bare‑metal server) to provide visibility and control over how that workload communicates on the network. The VEN observes process activity and connection attempts locally, and it uses an operating system’s own capabilities to enforce segmentation policies. This allows it to deliver strong security with minimal overhead and no complex network changes.
Typically, VENs are used to map application dependencies, monitor real‑time traffic flows, and enforce zero‑trust segmentation policies that limit the spread of ransomware or lateral movement in data centers and cloud environments.
Tip
Read Illumio docs to learn more about VENs.
About VEN workload discovery
Workload discovery is the process Illumio uses to automatically identify the applications, services, and network connections running on a workload.
Workload discovery is foundational to Illumio because it enables:
Accurate application dependency mapping. You see how workloads talk to each other across environments.
Change awareness. If a workload starts talking to something new or unexpected, Illumio can detect it immediately.
When a VEN is installed on a workload, it observes what that machine is doing, such as which processes are running, what ports they listen on, and which other machines they connect to. The VEN sends this information to the Illumio Policy Compute Engine (PCE), which builds an accurate, real‑time map of dependencies across your environment.
Benefits of Illumio VEN on NVIDIA DPU
Running an Illumio VEN on an NVIDIA BlueField-3 DPU enables performance and security benefits, including:
Hardware-accelerated VEN functionality. DPU is dedicated hardware for VEN workload discovery, improving parallelism and performance.
Agentless workload discovery: Improves host performance and latency of workload discovery by offloading the VEN agent from host to DPU.
Securing critical OT infrastructure: Non-intrusively secures and accelerates OT digital transformation.
Agentless workload discovery
Agentless workload discovery refers to Illumio’s ability to identify and understand workloads without installing a VEN agent inside the workload itself. Instead of running on the workload’s host operating system, the VEN and its discovery logic runs independently on the NVIDIA BlueField DPU as a separate platform. This frees up host resources and improves both host and VEN performance.
The DPU runs the VEN : it detects which VM workloads exist on a host, discovers their network interfaces, IPs, and metadata, and identifies communication patterns that the Illumio PCE uses for mapping and policy.
The DPU securely reads host system memory using specialized hardware-level tools such as DOCA Argus. Argus provides real-time visibility into system processes, memory, and activity by inspecting host memory externally to perform live machine introspection, without relying on host CPU or agents.
Securing critical OT infrastructure
OT infrastructure is traditionally legacy‑heavy and difficult to secure without disrupting production. With Illumio VEN on NVIDIA DPU, the VEN can run as an in-line device (at Purdue Model Level 2 or 3). This enables OT digital transformation benefits:
No impact on OT workloads. Modernizes security capabilities without disrupting OT operations and legacy components.
Scalable, non-intrusive architecture. Improves system performance and resilience by offloading networking and security functionality from the host.