Illumio

The Illumio integration reads the workloads from your Illumio Policy Compute Engine (PCE) and brings them into Connect's Inventory, one item per workload with its IP addresses and labels. A first discovery runs as soon as you provision the account, and it re-runs automatically every day.

This integration only reads. Nothing is created, changed, or deleted in the PCE.

Before you start

Prerequisite	Why it's needed	Where to check in the PCE
An API key for a user or service account with read access to workloads (a read-only role such as Global Viewer is enough)	Discovery lists workloads only	Your user menu > My API Keys for a user key, or Access > Service Accounts for a service account key
Your Organization ID	Every request is scoped to it	Shown with the API key's credentials when you create it
The PCE API reachable from the internet over HTTPS	Connect connects to the PCE from the cloud	If your PCE is only reachable inside your network, contact FireMon Support

When you create the API key, the PCE shows the Authentication Username (it starts with api_) and the Secret once. Copy both: the secret is shown that one time.

Set up an Illumio account

1. In Connect, go to Integrations and click New Integration Account.
2. Provider: Illumio. In Illumio Organization ID, enter your PCE organization ID. Give the account a name and a project.
   • Illumio Organization ID must match the organization ID in your PCE, because Connect sends it with every API call. Name is just the label shown throughout Connect.
3. Click Continue to Provisioning, then on the Provision page fill in:
   • API URL: the base URL of the PCE REST API, including the /api/v2 path, for example https://example.illum.io/api/v2/.
   • Username: the API key's authentication username (api_…).
   • Secret: the API key's secret. Once saved, it opens blank; leave it blank to keep it. See Passwords and tokens are write-only.
4. Click Provision Account, then press Test to confirm Connect can reach the PCE and sign in. The first discovery starts on its own.

What gets discovered

Each workload becomes one inventory item of type Workload, sourced from Illumio:

Workload field	Where it lands
Name, falling back to the hostname	The item's name
Hostname	The item's hostname
Public IP, plus the address and public IP of every interface	The item's IP addresses, deduplicated
Labels	The item's tags, one per label key

A renamed workload updates in place, and a workload dropped from the PCE is removed on the next run.

Verify it landed

What to check	Where to look
The account is healthy	Integrations: the Illumio row's Status stays clear, and the account's Provision page shows a Provisioned tag
The item count	Integrations in the main navigation: the Illumio row's Assets count roughly matches Workloads in the PCE (Workloads and VENs > Workloads)
The items themselves	Inventory > Resources, filtered by Vendor > Illumio. Open one: its IPs and tags should match the workload's interfaces and labels in the PCE

Once the workloads are in inventory, a Group can select them by label (as tags), by CIDR, or by any other filter, and export them like any other Group.

Details and edge cases

Large PCEs take longer. Above 500 workloads, the PCE delivers the list as a background job, so the first discovery of a large organization takes longer.

An expired or revoked key fails the next discovery with an authentication error. Create a new key in the PCE and re-enter the username and secret on the Provision page.

For common issues, see Troubleshooting.

Illumio documentation

• REST API limits: the 500-item limit that makes large collections asynchronous
• Asynchronous GET collections: how discovery reads a large PCE
• The API Keys section of the Illumio Core REST API Developer Guide for your PCE version: creating user and service account keys, and what the authentication username and secret are