Little-Known Features of Illumio Core: Traffic and Map

Solutions Marketing Director

June 21, 2024

23 min. read

In this ongoing series, Illumio security experts highlight the lesser known (but no less powerful) features of Illumio Core.

You can’t secure what you can’t see. It’s crucial to fully understand everything going on across your entire cloud, endpoint, and on-premises environments. This is the only way to make sure you’re fully secured.

Illumio Core offers the tools you need to see and understand how your workloads and apps are communicating. This helps enable secure east-west network security at high scale.

In this blog post, learn how Illumio’s Traffic and Map tools help you quickly and easily understand what’s happening in your network. With this information, you can build the right segmentation policies to secure your organization.

How Illumio Core helps you make sense of network traffic

Illumio operates separately from the underlying environment. This allows you to gain complete visibility into network traffic and enforce Zero Trust Segmentation policies across all environments at scale. This is all performed with Illumio’s Policy Compute Engine (PCE).

There are two ways to manage the PCE:

Use API-driven tools

Use the graphical user interface (GUI), such as Illumio’s Traffic and Map tools

Using APIs to manage the PCE solves many challenges around automating segmentation and discovering traffic. But using the GUI often helps make more sense of behavior between workloads and apps across your entire hybrid multi-cloud.

Illumio Traffic: See how apps and workloads communicate

Traffic is where you will likely spend the most time when discovering and analyzing workload and application behavior.

With Traffic, you will see:

A summary of all network traffic between workloads in a table format

A map of all traffic flows with their associated labels

A clear picture of exactly how workloads and applications are communicating with each other

Illumio’s Traffic tool shows traffic in a table format. After discovering all network traffic, it maps labels to network addresses.

In the example above, a school is using the Traffic tool to show which workload traffic is being blocked between Administration and Student Laptops segments. The Traffic tool doesn’t need to know which IP addresses are used in segments or where the student laptops are physically located. It summarizes all network traffic between all workloads without needing to touch any network appliances. This illustrates how Illumio’s label-based policy helps you understand traffic dependencies across business-defined boundaries, not network boundaries. ‍

Illumio Map: See all traffic flows across every environment ‍

Illumio’s Map tool provides another layer of visibility alongside Traffic. While Traffic summarizes all network behavior, Map creates a visual map of all traffic flows. You can see exactly how workloads and devices are communicating with each other across every environment.

With Illumio’s Map, see all traffic and discover network dependencies.

In Traffic, all lines representing traffic flows are color-coded:

Green is allowed traffic

Red is blocked traffic

Yellow is traffic that's been discovered but isn’t currently enforced

Hovering over each line will display information about traffic. With visuals of network traffic and color-coded sessions, you get a quick understanding of network behavior. This makes correlating traffic during an active security breach much quicker.

Map display options

The Map tool has several options for how to visualize traffic.

Without any labels selected, Map will display the entire network. This includes straight lines between all workloads and all traffic between them. Hovering over each line will display what traffic is being used by workloads on either end of the session. Visualizing traffic this way can be useful, but it can be difficult to make sense of at high scale.

See clear traffic flows with or without labels in Illumio’s Map tool.

Map offers a few different ways to zoom in on or group this information:

The Group By menu will summarize the same environment along hierarchical labels.

The Layout menu can show a simpler view of traffic.

Selecting Tiered Layout and then Reset Layout will show traffic using curved lines between all labeled segments.

‍Use Traffic and Map together for end-to-end visibility

Use Traffic and Map together to quickly see both a visual and summary of all traffic information side by side.

The Traffic and Map tools together provides a full view of network connections.

With Traffic and Map, you can avoid operational silos. Using separate visualization tools for separate environments limits your view of how apps and workloads communicate across environments. Used together, Illumio’s Traffic and Map tools will quickly show traffic behavior from across your cloud, endpoint, and data center environments without needing to access a network appliance within them.

Illumio’s Map visuals, Traffic summaries, and the library of APIs provide an streamlined workflow for gaining a clearer understanding of all network traffic across your hybrid multi-cloud. With this information, you can quickly discover vulnerabilities and enforce the right segmentation policies.