Flowlink and NEN Deployment

The Flowlink and NEN Deployment add-on sets up Illumio Flowlink, the Illumio Network Enforcement Node (NEN), or both, so that network traffic from systems without a VEN is ingested into the Policy Compute Engine for analysis.

Visibility across all communications is critical for segmentation, and the preferred way to get it is a VEN on each workload. In some cases a VEN can't be installed, or the customer chooses not to install one. Examples include mainframes, storage filers, legacy Windows systems, appliances, systems where an agent would void vendor support, and latency-sensitive high-transaction servers. Flowlink and the NEN fill that gap by bringing network-sourced flow data into the PCE.

Flowlink collects flow records from network devices and uploads them to the PCE. Current releases can also stream flows to Azure Event Hub for higher-throughput ingestion. The NEN is installed as part of the Illumio deployment and paired with the PCE. For switch devices, it can receive traffic flow information from managed network devices and supply that data to the PCE.

These are separate products. They are combined in one service add-on because both do the same job at this stage of the program: getting traffic into the PCE. The add-on is normally delivered during Platform Foundation Deployment, and delivery can continue into the Labeling or Discovery phases. When it is complete, network-sourced traffic is flowing into the PCE and is available for analysis in Discovery before any policy is configured.

Package Dependencies

• Platform Foundation Deployment  

Product Readiness

• Illumio Flowlink and/or NEN licensing purchased
• Operational PCE instance

Technical Readiness

• Customer-managed servers with a supported operating system for each Flowlink or NEN instance, including two servers or Load Balancer where the NEN is deployed as a high-availability pair
• Access privileges to install software on those servers
• Web server certificate for each server
• Network connectivity between the Flowlink or NEN servers, the network devices supplying flow data, and the PCE
• Azure Event Hub available and accessible, where Flowlink will stream flows through it  

Customer Readiness

• Project manager or primary point of contact assigned
• Network device owners identified and available
• Inventory of the network devices and segments that will supply flow data
• Change approvals in place for network device and server changes

Deployment Planning

• Confirm which products are in scope: Flowlink, NEN, or both.
• Identify the systems, network segments, and devices that need network-sourced visibility.
• Review server readiness, including operating system, access, certificates, and high-availability requirements.
• Confirm the ingestion approach for each product, including direct upload to the PCE or streaming through Azure Event Hub where applicable.
• Confirm the network-device configuration the customer must perform to send flow data.

Customer Outcome

The customer has an agreed ingestion design that identifies which traffic will come into the PCE, through which product, and what the customer must prepare before installation.

Flowlink Deployment and Flow Ingestion

• Applies where Flowlink is purchased.
• Install Flowlink on customer-managed servers.
• Configure Flowlink to run as a Linux service where the installed version supports it, so it restarts automatically after a reboot.
• Configure flow ingestion from the customer's network devices.
• Configure flow upload to the PCE, or flow streaming through Azure Event Hub where applicable.
• Record each installation's instance identifier for traceability and troubleshooting.

Customer Outcome

Flow records from the customer's network devices are collected by Flowlink and delivered to the PCE.

NEN Deployment and Pairing

• Applies where NEN is purchased.
• Install the NEN application on customer-managed servers, including a high-availability pair where required. Pair the NEN with the PCE. Register the in-scope network switches or Load-Balancers with the NEN so they can report traffic flow information. Configure the NEN to receive traffic flow information from managed switches and supply that data to the PCE.

Customer Outcome

The NEN is installed, paired with the PCE, and supplying network-sourced traffic data for the in-scope switches.

Ingestion Validation and Handoff

• Confirm that network-sourced traffic is arriving in the PCE.
• Troubleshoot ingestion issues within the Illumio components.
• Document the deployed configuration, including servers, instances, ingestion paths, and connected devices.
• Document operating guidance for maintaining Flowlink and NEN, and for adding more network devices later.
• Document traffic sources that were identified but not connected, along with the customer actions needed to connect them.
• Review the deployment and documentation with customer stakeholders.

Customer Outcome

Network-sourced traffic is ingested into the PCE and ready for analysis in Discovery, and the customer has the documentation it needs to maintain and extend ingestion on its own.

This add-on is normally delivered during Platform Foundation Deployment and may continue into Labeling or Discovery. The delivery schedule is set at project initiation based on:

• Purchased add-on size
• Products in scope: Flowlink, NEN, or both
• Number of instances and connected network devices
• Whether a high-availability NEN pair is required
• Readiness of customer servers, certificates, and network devices
• Network team availability and change-approval cycles.

Delays in server readiness, certificates, network-device configuration, or change approvals may affect the schedule.

Talk to our Sales team to learn more about Services.

Explore our Professional Services at illumio.com/services/professional-services