What's New in 26.30
Learn about new features in this release.
About all_except
The all_except feature simplifies policy management by applying broad rules across your entire environment while excluding specific workloads or IP addresses.
Illumio now supports all_ips_except as well as all_labels_except , which was previously available.
Note
If a workload with both public and private IP addresses is placed into quarantine, and a single Controlled Access rule contains both public and private IP addresses, the private IP address defined in that Controlled Access rule is not included in the quarantine exclusion list.
Scope Expansion: Labels vs. IPs
The addition of the All IPs Except capability allows for more comprehensive exception coverage depending on how you scope your rules:
All [Label Type] Except: Covers any workload that possesses a label of that specific type, minus the specified exclusions.
Example: A ruleset scoped with All Location Except L-Lab covers all workloads with a Location label, except those labeled with L-Lab.
All IPs Except: Covers the entire IP space (0.0.0.0/0), minus the workloads tied to your specific exclusions.
Example: A ruleset scoped with All IPs Except L-Lab covers all traffic (0.0.0.0/0), except for specific workloads carrying the L-Lab location label.
Where to find it in the UI
You’ll see all_except in segmentation rule‑building workflows.
Important
You will see all_except available throughout segmentation rule-building workflows.
Release 26.30 Limitation: Rule Coverage Results do not currently reflect policy rules that use All IPs Except. Consequently, your rule coverage dashboard metrics will not accurately display the enforcement status for these specific configurations in this release.
Benefits of all_except
Here are some benefits of the all_except feature.
Reduced Maintenance: New workloads or services automatically inherit the global "all" rule. You don't need to manually update your policies every time you spin up a new service unless it requires a specific exclusion.
Scalable Policy Design: Avoids the need for massive, complex selection lists. Your security policies can grow seamlessly alongside your environment.
Ideal for Stable Scopes: Perfect for environments where the overall scope is stable over time and where label-driven policies can benefit from automatic inheritance
Difference between all_ips_except versus all_labels_except
Important
The feature all_ips_except allows writing a rule to block all traffic from all IP addresses other than those with this set of labels, which is a limitation of all_labels_except.
While both features allow you to create broad inclusion rules with specific exceptions, they handle network layers differently.
all_labels_except: Best for internal, label-driven microsegmentation. However, it is limited to workloads with defined labels.
all_ips_except: Overcomes this limitation by allowing you to write a rule that applies to all IP addresses (including external or unlabeled traffic) except for the specific IPs or labels you explicitly choose to exclude.
Typical Use Cases
Apply the All Except feature in these situations.
Protect Sensitive Systems: Apply a broad global policy to the vast majority of your workloads while easily isolating a few highly sensitive or unique systems.
Enable Automatic Scaling: Allow new workloads to automatically inherit existing policies as they are spun up and labeled—eliminating manual updates unless your specific exclusions change.
Simplify Policy Management: Minimize long, tedious inclusion lists and drastically reduce maintenance overhead in rapidly growing environments.