Illumio Community Hub

New VEN's are needing to be deployed to VM's hosted in GCP. However the IP ranges in GCP conflict with remote offices. GCP and the remote offices are not connected (GCP is access over internet, not a private connection).  

Although Illumio is label based, it's still working with IP addresses in the background. Does a new Illumio tenant need to be created to avoid any confusion with workloads using the same IP ranges? Or is it smart enough to deal with this??

As far as I know, there is no elegant way to deal with overlapping IP addresses. A second tenant is an interesting approach. If the GCP IPs and the remote office IPs need to talk to the same assets, then keep in mind that the common assets can only exist as managed workloads in one of your tenants. In the other tenant, you'll need to create unmanaged workloads to represent the common assets. I suppose that one set of the overlapping IPs is being NAT'ed somewhere and that will need to be addressed in policy. (The VEN will report the traffic flow as originating from its private IP, but what the destination sees is likely to be a different IP, which could be a single IP or a unique IP for each workload in GCP.)

thanks Katy, been away on PTO. Ideally I would prefer not to create a second tenant. We don't know if the conflicts actually communicate yet. We might need to deploy the VEN's in GCP and see if the reported traffic flows become messy in terms of reported source/destination.