Illumio Community Hub

What if I can't get details about what ports an application needs to function? What about 3rd party apps or contractors?

I would recommend to first start deploying VENs in visibility only mode. This mode does not enforce any port blocking and will not impact traffic in any way, but it will allow you to monitor traffic. From there you can use the traffic data to determine what traffic you want to continue to allow, and what traffic may be risky and need blocking. For best results, monitor traffic for about 6 weeks before writing rules.

Even if you do accidentally block a port for something important, you can easily and quickly edit or revert the rule, to allow the traffic again. App owners should contact your helpdesk or IT team, to alert your security team in case of any inadvertent port blockings.

For outside vendors, first communicate with the app owners separately to bring them up to speed, and then arrange meetings with the app owners and the vendors to find out what traffic is needed and what can be blocked. The vendor can talk to their security team to get the details.

I would like to add one note of caution.......

Deploying VENs in visibility mode is not always 100% safe, and can indeed effect traffic in specific scenarios. The scenario that caught us off-guard, with the belief that visibility mode can't effect anything, was with Linux servers running Docker. Having the VEN in visibility mode without configuring Containers Policy on a server using Docker will still cause Illumio to take over IPTABLES. When it does this it disables IP Forwarding, which basically breaks the Docker setup.

Unless you are certain you are not using containers in your environment it may be safest to install the VEN in idle mode, at least for Linux. Then check the Compatibility Report, configure Container Policy where needed, then place the server(s) into visibility mode. If you are dealing with a larger rollout, that total process is easiest done using the workloader tool.

On a side note..... We found it easiest to create a new label called F-CONTAINER, add that label to the Containers Policy, then add the label to servers that need it.

Had issues as well with Visibility Only. High traffic, public facing, DNS servers (we're an ISP) we're affected by it. Used up more processor than expected.

YMMV, but for most situations inside a corporate network, it's fine.