Illumio Community Hub

iptables is originally off on our servers. When going from IDLE to TEST/BUILD, iptables gets enabled by illumio, which also enables nf_conntrack modules on the kernel. When going from TEST/BUILD back to IDLE, iptables is left enabled. Why is it left enabled, it would be good if it was disabled when going back to IDLE in order to have the server as it was, as nf_conntrack causes an overhead in the interrupts than when its left off. The server should be back as the original state as it was when it was in IDLE mode.

Hi Mariano,

First off, a big thank you for using the community forum. Your question is a great one and other members of the community would definitely benefit from this discussion.

The answer really has to do with the historic evolution of the Illumio VEN modes. Idle mode was simply introduced as a precautionary mode to handle workloads where the customers were using iptables already. The idea was to deploy in Idle and not wipe their iptables out. The goal was that the customers would move to Build/Test only after they had taken care of the pre-existing iptables.

Initially, we didn't even allow customers to go back to Idle from Build/Test. But, that was requested by customers afterwards. So, we added that functionality. However, we decided that we would simply revert the iptables to the saved version (customer's pre-existing iptables) because that's probably what they would expect us to do. In this case, the assumption was that nf_conntrack and iptables would have been enabled by the customers and there would be no reason to turn those off. We wanted to be careful because if we disabled iptables and conntrack, customers' pre-existing iptables would stop working.

Does this make sense? If you believe that turning off iptables and conntrack would be safer in this case, we would be happy to look into that. Please let us know.

Thanks

Mukesh

What we have seen is - When one moves back from Build/Test mode back to Idle mode, it is most likely that one will shortly move back into Build/Test mode. Thus, the nf_conntrack is left enabled in idle mode so that

1)overhead due to iptables is minimal. It will also be present in Build/Test/Enforced modes.

2)system level changes are kept to a minimum.

That makes sense and I undertand where you are coming from... one thing that I would suggest then, would be to have a pre-installation requirement into the RPM where IRQBALANCE is installed... if you do not have irqbalance installed and running, iptables can be an overhead that starts dropping packets on the interface level due to a single core being in-charge of handling network interrupts.. this is something that we learned as we were deploying illumio and iptables was enabled as we did not run iptables at all.

Hi Mariano,

Thank you so much for the excellent feedback. Would you be willing to do us a favor and create an Idea with this feedback on our Ideas portal. That would allow others to vote on it and help us in prioritizing it accordingly on the roadmap.

Also, we would love to have other similar questions/feedback from the team at NetSuite/Oracle on the forums and Ideas portal. So, would appreciate you spreading the word about this.

Thanks

Mukesh