Illumio: Inventory Discovery

The Illumio integration reads the workloads from your Illumio Policy Compute Engine (PCE) and brings them into Connect's Inventory, one item per workload with its IP addresses and labels. A first discovery runs as soon as you provision the account, and it re-runs automatically every day.

This integration only reads. Nothing is created, changed, or deleted in the PCE.

Before you start

Prerequisite	Why it's needed	Where to check in the PCE
An API key for a user or service account with read access to workloads (a read-only role such as Global Viewer is enough)	Discovery lists workloads and nothing else	Your user menu > My API Keys for a user key, or Access > Service Accounts for a service account key
Your Organization ID	Every request is scoped to it	Shown with the API key's credentials when you create it
The PCE API reachable from the internet over HTTPS	Connect connects to the PCE from the cloud	If your PCE is only reachable inside your network, contact FireMon Support

When you create the API key, the PCE shows the Authentication Username (it starts with api_) and the Secret once. Copy both; the secret isn't shown again.

Set up an Illumio account

1. In Connect, go to Settings > Accounts and add a new account.
2. Cloud Provider: Illumio. In Illumio Organization ID, enter your PCE organization ID. Give the account a name and a project.
3. Save. You land on the Provision page. Fill in:
   • API URL: the base URL of the PCE REST API, including the /api/v2 path, for example https://example.illum.io/api/v2/.
   • Username: the API key's authentication username (api_…).
   • Secret: the API key's secret. It must be re-typed on every save of this page; see Passwords and tokens are never shown back to you.
4. Save. The first discovery starts on its own.

What gets discovered

Each workload becomes one inventory item of type Workload, sourced from Illumio:

Workload field	Where it lands
Name (or the hostname, if the workload has no name)	The item's name
Hostname	The item's hostname
Public IP, plus the address and public IP of every interface	The item's IP addresses, deduplicated
Labels	The item's tags, one per label key

A renamed workload updates in place, and a workload that no longer exists in the PCE is removed on the next run.

Verify it landed

What to check	Where to look
The account has no errors	Settings > Accounts: no warning icon on the Illumio account, and its Provision page shows no Resource Errors
The item count	Integrations in the main navigation: the Illumio row is Active and its Items count roughly matches Workloads in the PCE (Workloads and VENs > Workloads)
The items themselves	Inventory > Resources, filtered by Vendor > Illumio. Open one: its IPs and tags should match the workload's interfaces and labels in the PCE

Once the workloads are in inventory, a Group can select them by label (as tags), by CIDR, or by any other filter, and export them like any other Group.

Details and edge cases

Large PCEs take longer. Above 500 workloads, the PCE delivers the list as a background job, so the first discovery of a large organization takes longer.

An expired or revoked key fails the next discovery with an authentication error. Create a new key in the PCE and re-enter the username and secret on the Provision page.

For common issues, see Troubleshooting.

Illumio documentation

• REST API limits: the 500-item limit that makes large collections asynchronous
• Asynchronous GET collections: how discovery reads a large PCE
• The API Keys section of the Illumio Core REST API Developer Guide for your PCE version: creating user and service account keys, and what the authentication username and secret are