Illumio Community Hub

March 2023 Webinar Schedule

Here are the upcoming webinars during the month of March 2023. These are designed to provide guidance during your Illumio implementation journey.

A Q&A session will follow each webinar. If you have any questions or suggestions for upcoming webinars, feel free to comment below. We look forward to having you join us! 

Ransomware: Ports and how to block them with Illumio

During this webinar we will review some of the top ransomware ports you will want to prevent access. We will discuss why some of the ports are challenging to block and how to systematically roll out Enforcement Boundaries to get protection faster.

• Important ports to block
• Risk assessment
• Q&A

Speakers: Greg DiRubbio and Steve Tatro

Original Broadcast Date: Tuesday, March 7th, 2023

Q&A thread and recording here.

Design Review: Preparation Application Part 2

Join us as we continue discussing the necessary steps in the Design Review process with Jason Emerson, Professional Services Consultant. This event will be a continuation of the discussion on the preparation needed for writing policy for applications. Jason will talk in detail about how to use Explorer and Illumination Plus to gather data and create reports.

Speaker: Jason Emerson

Original Broadcast Date: Wednesday, March 23rd, 2023

 Q&A thread and recording here.

Master Class: Installing a Containment Switch and Automating Quarantine Procedures 

Join us and Christer Swartz, Principal Technical Marketing Engineer, for our upcoming Master Class on automating the isolation of compromised workloads, quickly quarantining infected workloads without needing to access the PCE GUI.

Learn how to set up a Containment Switch solution as a stand-alone deployment, and also how this is integrated into Illumio’s SOAR integrations with Splunk, IBM QRadar, and Palo Alto Networks Cortex.

Speaker: Christer Swartz

Original Broadcast Date: Tuesday, March 14th, 2023

Q&A thread and recording here.

Policy Workload 1

Join us and Christer Swartz, Principal Technical Marketing Engineer, for our upcoming webinar to learn how to define Policy using Illumio’s multi-dimensional Labeling, using either Labels manually defined within Illumio, auto-discovered using Core Services Detector, or from external sources such as a CMDB or Containers Manifest files.

You'll also learn: 

• Best-practices for creating Policy from broad Ringfence segments to segmenting specific application processes.
• How to use Illumio’s declarative model to define a Policy’s end-state, without needing to worry about rule order.

Presenter: Christer Swartz

Original Broadcast Date: Wednesday, March 22nd,

Q&A thread and recording here.

Illumio Product Roadmap

Join us for a discussion with Faraz Aladin, Senior Director Technical Product Management. Faraz will share a look ahead of what's coming in some of our Illumio products. You will also have an opportunity to ask questions live.

Presenter: Faraz Aladin

Original Broadcast Date: Wednesday, March 29, 2023

Q&A thread.

I enjoyed the roadmap webinar. Yesterday a participant had asked for merging the Ven and Workloads screens back together. I have the same request here.

https://community.illumio.com/s/ideas#0873w0000019OgXAAU

Hello @Richard Walz 

Thank you for the kind words. We were happy to see you at the roadmap webinar yesterday.

I've pinged Faraz with your feature request, and while at this time I cannot make any commitments about the requested addition, we've definitely heard your feedback and thank you very much for that.

Thanks for the webinar. I would like to see a different method for determining when a device is on the corporate network. I know there is a workaround for making rules work, but it also makes using explorer more difficult because the PCE then classifies corporate traffic as external and the server VEN doesn't show up with it's labels.

Hello @Nathan Kitchens  Thanks for the feedback, we're glad to hear you enjoyed the webinar.

Just to clarify about your question, are you asking about an Endpoint related application where you're tracking a portable device such as a laptop that connects to different networks? Servers typically aren't portable, so they'd always be on the same network in the same location.

Could you explain a little bit more about the scenario you're asking? My apologies for any confusion on the question, I want to make sure you're getting the best answer we can provide.

Yes, I'm talking about a laptop or desktop. However since we don't have domains the traffic gets classified as external and the explorer queries don't pick up server traffic based on labels. Notice in the screenshot below how the servers in the provider column don't have the associated labels because they are listed as external even though they are on the corporate network.

@Nathan Kitchens  - for Windows endpoints that are connected to Active Directory (on-prem or hybrid) we use the built in method in Windows to determine if an interface is domain joined. For Windows endpoints that are connected to Azure AD only or Mac endpoints, you'd want to make sure your Corporate Public IPs are listed in Main Menu -> Settings -> Corporate Public IPs. The VEN connects to the PCE on each interface and the PCE checks if the source IP of the communication is coming from an IP listed in this page. If it is, then that interface is labeled as corporate; if not, it's labeled as external. See below for the description of Corporate Public IPs on the PCE:

When using Network Address Translation, this set of IPs appear for communication between Workloads of the corporate network and services on the Internet. This information is required to identify the interfaces on Endpoint Workloads that are connected to the corporate network vs. interfaces that connect to the Internet via an external network (e.g. home or public network) when the information cannot be obtained directly from the Endpoint Workload's operating system.

Hope this helps, but let us know if you have any other questions.

Thanks!

Brian

As I previously stated we are not using AD/domains. That's why I'm asking for a different method of determining if a device is connected to the corporate method.

@Nathan Kitchens - then you'd fall into the same bucket as Azure AD only and Mac endpoints (i.e., endpoints that are not connected to domains) and use the Corporate Public IPs setting mentioned in the post above.

Brian would you have time to look at my setup for this? I've tried using the corporate public IPs but it didn't seem to help.

@Nathan Kitchens  - just sent you an email to take it offline.