Reference: PCE Runtime Parameters

Includes sub-parameters to enable identified preview features

The full path to the location of the PCE binaries and scripts

The software does not write to any files in this directory, so it can be read-only.

For example:

install_root: /opt/illumio-pce

The full path to the location where the PCE writes runtime data

This data can be deleted on reboot if necessary. This directory should have 700 permissions, but all of its files will have 600 permissions. This directory must be owned by the user that runs the PCE software.

For example:

runtime_data_root: /var/lib/illumio-pce/runtime

The full path to the location where the PCE writes persistent data

This data must persist across reboots for the software to work properly. This directory should have 700 permissions, but all of its files will have 600 permissions. This directory must be owned by the user that runs the PCE software.

For example:

persistent_data_root: /var/lib/illumio-pce/data

The full path to the location where the PCE writes temporary files

These files must not be deleted while the software is running, but they should be deleted on reboot. This directory should have 700 permissions, but all of its files will have 600 permissions.

For example:

ephemeral_data_root: /var/lib/illumio-pce/tmp

The directory where the PCE software writes some text file logs (although most PCE services log to syslog)

logrotate (or similar) should be used to manage these files.

For example:

log_dir: /var/log/illumio-pce

The fully qualified domain name (FQDN) of the PCE cluster

For example:

pce_fqdn: pce.mycompany.com

cluster_public_ips:

cluster_fqdn

The FQDN of your entire cluster

Full path to the X.509 public certificate used by this node for TLS

See TLS Requirements for more information on the contents of the certificate files.

For example:

web_service_certificate: /etc/pki/tls/certs/my_cert.crt

The RSA private key for TLS that matches the public certificate

The private key must be PEM encoded in PKCS#12 format without a password.

For example:

web_service_private_key: /var/lib/illumio-pce/cert/rsa_private_key.key

Alternatively, you can specify a script (using $ notation) that outputs the private key. This approach is useful when you need to store the key in a hardware security module (HSM) or other key store.

For example:

web_service_private_key: $ /var/lib/illumio-pce/cert/get_rsa_private_key.sh

This script can be located anywhere on the file system as long as it is executable by the ilo-pce user.

Example script output:

$ /local/scripts/get_rsa_private_key.sh

-----BEGIN RSA PRIVATE KEY-----

MIIE...

many lines trimmed here

-----END RSA PRIVATE KEY-----

email_address

Email sender address used by the PCE when sending emails from the system; for example, to send invitations and notifications

For example:

email_address: noreply@exampleblocked_traffic.com

The FQDN or IP address of the first core node

The key used to encrypt Service Discovery node traffic.

This value must be the same for all PCE nodes. This key must be 16 bytes that are base64 encoded.

For example:

service_discovery_encryption_key: 05TlqH1W0cKcK797DV73yg==

The type of the PCE software node

Allowable values:

• core: core node
• data0: data node
• data1: data node
• snc0: single-node cluster
• citus_coordinator: coordinator node for multi-node traffic database
• citus_worker: worker node for multi-node traffic database

For example:

node_type: core

The base URL used to fetch the VENs and to enable workload pairing with the PCE

Required format: https://host[:port]/repo_dir

You can use alternate ports by specifying the port at the end of hostname. repo_dir cannot be empty.

For example:

https://repo.example.com:8443/onpremgCBURz8Y4zkGk1u7N9ialjPGlZ

Default: None

IP addresses of the VEN repository

These IP addresses are injected into iptables to allow outbound access to the yum/apt get repositories without having to write an explicit PCE policy.

Setting this parameter allows outbound access on ports 80 and 443 to these IP addresses. You can specify both single IP addresses or IP addresses with CIDR notation.

When you do not specify this parameter, the VEN won't be allowed to access the repository containing VEN software packages.

For example:

ven_repo_ips: 
- 1.2.3.4 
- 5.6.7.8/8

Default: None

PCE cluster type

One of the following:

• 4node_v0: 2x2 PCE cluster
• 6node_v0: 4x2 PCE cluster
• 4node_dx: 2x2 PCE cluster with multi-node traffic database
• 6node_dx: 4x2 PCE cluster with multi-node traffic database

Default: 4node_v0

The IP address of the PCE

Set this value manually only when you want to use a public IP address or the PCE node has multiple interfaces.

For example:

internal_service_ip: 10.2.8.89

Default: The first available private IP address on the node

The front end HTTPS port

When the cluster is front-ended by a server load balancer, such as F5, it must be configured to forward this port.

For example:

front_end_https_port: 8443

Default: TCP 8443 if not set by front_end_management_https_port or front_end_https_port

The front end Event Service port

When the cluster is front-ended by a server load balancer, such as F5, it must be configured to forward this port. The idle connection timeout on the server load balancer might need to be configured to maintain the connections on this port. Please contact your Illumio Professional Services representative for information on configuring your server load balancer.

For example:

front_end_event_service_port: 8444

Default: 8444

The port for PCE web console and REST API

This key separates different kinds of communication. See also front_end_https_port.

Default: TCP 8443 if not set by front_end_management_https_port or front_end_https_port

The export format (CEF, LEEF, or JSON) for VEN flow summaries and Organization events.

When you specify CEF or LEEF format, you will continue getting traffic flows and Organization events in JSON format.

For example:

syslog_event_export_format: cef

Default: json

The path to the trusted root certificate bundle

The PCE uses this parameter to validate that the certificates are trusted and indicates the path to the trusted root certificate bundle file.

For example:

trusted_ca_bundle: 
/etc/ssl/certs/ca-bundle.crt

Default: /etc/ssl/certs/ca-bundle.crt

Email display name to be used when sending email from the system. For example, to send invitations and notifications from the PCE.

For example:

email_display_name:'noreply'

Default: noreply

SMTP relay information used by the PCE to send email; for example, to send invitations and notifications

The PCE assumes that an SMTP Relay runs on localhost and listens on 127.0.0.1/587. When this isn't the case, you must specify the configuration on the core nodes.

Use one of the following formats:

• ip_address (e.g. 127.0.0.1)
• ip_address:port (e.g. 127.0.0.1:587)

For example:

smtp_relay_address: 127.0.0.1:587

Default: 127.0.0.1:587

The types of traffic flow summaries to export to Fluentd

Values: accepted (allowed), potentially_blocked, blocked

For example:

export_flow_summaries_to_fluentd:
  - accepted

  - potentially_blocked

  - blocked