CloudGuard Controller for Illumio Policy Compute Engine

The CloudGuard ControllerClosed Provisions SDDC services as Virtual Data Centers that provide virtualized computer networking, storage, and security. integrates the Check Point Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. with an Illumio Policy Compute Engine (PCE).

Authentication to the Illumio Data CenterClosed Virtual centralized repository, or a group of physical networked hosts, Virtual Machines, and datastores. They are collected in a group for secured remote storage, management, and distribution of data. is performed using a username and a secret.

Important - The CloudGuard Controller server clock must be synchronized with the current, local time. Use of an NTP server is recommended. Time synchronization issues can cause polling information from the cloud to fail.

Prerequisites

Connecting to the Illumio Server

Step

Instructions

1

In the Illumio PCE console, record the PCE FQDN and the Organization ID that appear in My Profile settings.

2

Create an API Token:

Go to My API Keys and click Add. In the Create API Key window, enter a name for the key.

3

Click Create and save the Authentication Username and the Secret.

Important: The Secret appears only once.

Connecting to an Illumio Data Center Server with SmartConsole

Step

Instructions

1

In SmartConsole, create a new Data Center object in one of these ways:

  • In the top left corner, click the Objects menu > Cloud > Data Center > New Illumio

  • In the top right corner, click the Objects Pane > New > Cloud > Data Center > Illumio

2

In Enter Name, enter the applicable name.

3

In the Hostname field, enter the PCE FQDN in this format (HTTP or HTTPS), for example:

example.illum.io

172.0.1.2<:Port>

Note: The Illumio port is optional and defaults to 443 by. If your Illumio server uses port 443, you do not need to provide the port.

4

In the Organization ID field, enter the same name value from the Illumio Console.

5

In the Authentication Username and Secret field, enter the values you saved before.

6

Click Test Connection.

If the certificate window opens, confirm the certificate and click Trust.

7

When the connection status changes to Connected, click OK.

If the status is not Connected, troubleshoot the issue before you continue.

8

Click OK.

9

Click the Publish button to publish the SmartConsole session.

10

Install the Access Control policy on the Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. object.

Connecting to an Illumio Data Center Server with Terraform

Refer to checkpoint_management_illumio_data_center_server.

Illumio Objects and Properties

Illumio Objects

Object

Description

Label

A tag that identifies a workload’s role or context to control security policiesClosed Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection..

Workload

Any compute resource (like a server or VM) that Illumio monitors and protects.

Notes:

  • A Workload can have multiple Labels, one Label, or no Labels.

  • Important:

    • Import of IPv6 addresses is disabled by default. To enable it, you must set the illumio.collectIpv6 parameter in the vsec.conf file:

      • illumio.collectIpv6=true

      For details, refer to the Configuration Parameters section.

Illumio PCE advanced configuration

To change the default settings of Illumio Data Center in CloudGuard Controller, you can:

  1. Add this section to the vsec.conf file:

    Copy 
    # Illumio Data Center configuration values.
    # Overrides:
    # global.scannerInterval                        
    # global.scanSleepUpperLimitInSeconds
    # global.connectTimeoutInMilliseconds
    # global.readTimeoutInMilliseconds
    # Default value: 30, 300, 5000000, 120000
    illumio.scannerInterval=30
    illumio.scanSleepUpperLimitInSeconds=300
    illumio.connectTimeoutInMilliseconds=5000000
    illumio.readTimeoutInMilliseconds=120000
    illumio.collectIpv6=false

  2. Modify the default settings as required.

  3. Save the file and restart the CloudGuard Controller service.

For details, refer to the Configuration Parameters section.

Limitations

  • If the IP address of a Workload object is localhost (127.0.0.1, ::1, or “localhost”), it is not imported to the Management database.