• Review the Branch Connector specifications and sizing requirements.

  • Small VM: requires 16 GB of memory, 4 CPU cores, 128 GB data disk size, and three network interface cards (NICs)
  • Medium VM: requires 32 GB of memory, 6 CPU cores, 128 GB data disk size, and 5 NICs

  Close
• Review the virtual machine specifications for Branch Connector deployed in high availability.

  • The Promiscuous mode option must be enabled (i.e., set to Accept) on the vSphere switch (vSwitch) or at the port group level. Branch Connector uses the Common Address Redundancy Protocol (CARP) to process traffic across multiple Branch Connector instances. To support this, you must enable promiscuous mode on your Branch Connector service interface.
  • The MAC address changes option must be enabled on the vSwitch or port group.
  • The Forged transmits option must be enabled on the vSwitch or port group.
  • Branch Connectors often share the vSwitch with other corporate VMs, and settings you apply on the vSwitch level are applied to all VMs on the vSwitch. When promiscuous mode is enabled, other VMs might be able to detect traffic going through the service interface. To avoid this risk, Zscaler recommends that you create and use a port group for your Branch Connector service interfaces.
  • If multiple physical ports exist on the same vSwitch, then the Net.ReversePathFwdCheckPromisc advanced option must be enabled (i.e., set to 1) on the ESXi host. If it is not enabled, then multicast traffic loops back to the host, causing CARP not to function properly, and link states coalesced messages are sent. To learn more, refer to the VMware documentation.

  Close

Creating and Applying User Data

You must create user data information for your Branch Connector & App Connector VM. For VMware vCenter, user data information is provided during the OVA file import process. For VMware vSphere Hypervisor (ESXi), you must apply the user data information to the VM. You can apply this information to the VM either with an ISO file that you mount via a virtual CD-ROM drive or do so manually to the /etc/cloud/cloud.cfg.d/ directory. For both methods, you must create a text file containing the user data.

1. Create your user data in a text file named userdata.cfg using the following template, formatted in YAML:

   • Branch Connector & App Connector with Static Management IP Template

     ZSCALER:
       cc_url: <CC_URL>
       http_probe_port: 50035 #Optional to change the port for load balancer status checks from the default value 50001 to 50035.
       api_key: <API Key>
       password: <Admin Password>
       username: <Admin Username>
     network: 
       config:
       - name: vmx0 #For the VMXNet3 driver (required)
         type: physical
         subnets:
         - address: <IP Address/Netmask> #IP configuration for the management interface
           gateway: <Gateway>
           type: static
        - name: vmx1 #For the VMXNet3 driver (required)  
          type: physical    
          fib: '1'    
         subnets:    
         - address: <IP Address/Netmask> #IP configuration for the App Connector interface    
           gateway: <Gateway>      
           type: static
       - type: nameserver
         address: 
         - <IP Address>
         - <IP Address>
         search:
         - zscaler.net
       version: '1'
     zscaler_app_connector:  
       enable: 'yes'  
       provisioning_key: <Key> 
     #ssh keys are optional
     ssh_authorized_keys:   
     - ssh-rsa <Key> 
     

     Example user data with default HTTP probe port and no SSH key

     ZSCALER:
       cc_url: connector.zscaler.net/api/v1/provUrl?name=DemoBC
       api_key: adfads2sd
       password: demopass
       username: bac-demoadmin@12345689.zscaler.net
     network: 
       config:
       - name: vmx0
         type: physical
         subnets:
         - address: 10.66.118.71/24
           gateway: 10.66.118.254
           type: static
       - name: vmx1    
         type: physical
         fib: '1'    
         subnets:    
         - address: 10.66.118.72/24      
           gateway: 10.66.118.254
           type: static
         - type: nameserver
           address:
           - 10.66.98.1
           - 8.8.8.8
         search:
         - zscaler.net
       version: '1'
     zscaler_app_connector:
       enable: 'yes'
       provisioning_key: asldkfjalsdkjflaksasldkfjalsdkjflaksasldkfjalsdkjflaksasldkfjalsdkjflaksasldkfjalsdkjflaks 
     

     Close

     Example user data with non-default HTTP probe port and SSH key

     ZSCALER:
       cc_url: connector.zscaler.net/api/v1/provUrl?name=DemoBC
       http_probe_port: 50035
       api_key: adfads2sd
       password: demopass
       username: bac-demoadmin@12345689.zscaler.net
     network: 
       config:
       - name: vmx0
         type: physical
         subnets:
         - address: 10.66.118.71/24
           gateway: 10.66.118.254
           type: static
       - name: vmx1    
         type: physical
         fib: '1'    
         subnets:    
         - address: 10.66.118.72/24      
           gateway: 10.66.118.254
           type: static    
        - type: nameserver      
          address:      
          - 10.66.98.1    
          - 8.8.8.8    
        search:    
        - zscaler.net  
       version: '1'
     zscaler_app_connector:
       enable: 'yes'
       provisioning_key: asldkfjalsdkjflaksasldkfjalsdkjflaksasldkfjalsdkjflaksasldkfjalsdkjflaksasldkfjalsdkjflaks 
     ssh_authorized_keys:  
       - ssh-rsa ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCh3ru9CCnEow69WlQyJuxvZJGHcjhcgJzp8XnoKTJk6o1bit+rq4BNyjS0orauMF6fNMHAyGZqDWw6RICvoeh386xNqnD7+AGE9VGz4cPv0CjoV2HvkKnA2Dj8KZFFJ/bBV0BndNdGATsbDnhq0wkJ+WXFmamb9kx4dSDL5ZD15SybFop0b/3JoqXoU+9pxFc0bQ/cediaifCztliI9i7NAmvIUinLy2OlDW/uPEcB8nBgXhAAc9ALe6+Q4wZt8JUdrcF04bgoAHYsNuzyEk4dNvov97JyExCAwzSLomiHFtdzhGw7/o6KhfhxxBRodKy4wQBwDzPbD6EbN9iCqoK8DY4HZ2L7HyQKRjhnnY/Y0uldO0tleogElbk+4LsoyAPjPAbogu89xSOa6D7sl2G+dPpqTlFBmO/3m/2JhBnGU= admin@branchpc

     Close

     Close

2. Apply your user data to the VM in one of the following ways:

   • ISO Method

     1. Apply the user data to the VM as an ISO image:

        • On Centos, install the genisoimage:

          sudo yum install genisoimage

        • On Ubuntu, install the genisoimage :

          sudo apt install genisoimage

     2. Configure the required user data.

        The user data file must be named user-data.

        zuser@hostname:~$ mkdir isodir
        zuser@hostname:~$ cat > isodir/user-data <<EOF #cloud-config
        <TEXT FROM TEXT FILE>
        EOF
        user@hostname:~genisoimage -o user-data.iso -r isodir/user-data

        You attach the ISO to your Branch Connector & App Connector VM in the Deploying on VMware vSphere Hypervisor (ESXi) procedure.

     Close
   • Manual Method

     You apply your user data at the end of the Deploying on VMware vSphere Hypervisor (ESXi) procedure.

     Close