This deployment guide provides information on prerequisites, how to deploy Zscaler Branch Connector & App Connector as a virtual machine (VM) on Hyper-V platforms, and post-deployment configurations.

Infrastructure as Code (IaC) deployment templates are not available for Branch Connector & App Connector deployment on Hyper-V platforms.

Prerequisites

The role that you assign to an admin dictates the level of access they have to the Admin Portal. Zscaler provides a default admin account that provides full access to the portal and scope over the entire organization. Admins must have this access to perform the procedures in this article. To learn more, see About Role Management and Adding Admin Roles.

Make sure the following prerequisites are met:

• In the Admin Portal, create a dedicated username for the Branch Connector & App Connector deployment.
• In the Admin Portal, create a dedicated password for the Branch Connector & App Connector deployment. The password must be at least 8 characters in length and include at least one uppercase letter, one number, and one special character. The password must not contain a $, &, >, <, ;, ', or ". If the password does not meet these requirements, the deployment fails.
• Configure a Branch Provisioning Template and copy the Branch Provisioning URL for later use.
• Download the Branch Connector Virtual Hard Disk v2 (VHDX) image from the Branch Connector Images page for Hyper-V.
• Branch Connector uses an API key to authenticate and register the VM with the Zscaler service. If you do not already have an API key, generate a new key. Then copy the API key from the API Keys page.
• Review the following Branch Connector & App Connector specifications and sizing requirements:
  • Small VM: Requires 16 GB of memory, two CPU cores, 128 GB data disk size, and three network interface cards (NICs).
  • Medium VM: Requires 32 GB of memory, 4 CPU cores, 128 GB data disk size, and 5 NICs.
• If a Hyper-V virtual switch does not exist, create one.
• VM specification for Branch Connector & App Connector deployed in high availability (HA): MAC Address Spoofing must be enabled on each network adapter.

Creating and Applying User Data

You must create user data information for your Branch Connector & App Connector VM. You can either apply this information to the VM in the Hyper-V Manager UI with an ISO file that is mounted via a virtual CD-ROM drive or apply it manually in the VM console in the /etc/cloud/cloud.cfg.d/ directory. For both methods, you must create a text file containing the user data.

1. Create your user data in a text file named userdata.cfg using the following template, formatted in YAML:

   • Branch Connector & App Connector with Static Management IP Template

     ZSCALER:
       cc_url: <CC_URL>
       http_probe_port: 50035 #Optional to change the port for load balancer status checks from the default value 50001 to 50035.
       api_key: <API Key>
       password: <Admin Password>
       username: <Admin Username>
     network: 
       config:
       - name: hn0
         type: physical
         subnets:
         - address: <IP Address/Netmask> #IP configuration for management interface
           gateway: <Gateway>
           type: static
       - name: hn1    
         type: physical    
         fib: '1'    
         subnets:    
         - address: <IP Address/Netmask> #IP configuration for App Connector interface     
           gateway: <Gateway>      
           type: static  
         - type: nameserver    
           address:    
          - <IP Address>    
          - <IP Address>    
          search:    
          - zscaler.net  
       version: '1' 
     zscaler_app_connector:  
       enable: 'yes'  
       provisioning_key: <Key>
     #ssh keys are optional
     ssh_authorized_keys:
      - ssh-rsa <Key>

     Example user data with default HTTP probe port and no SSH key

     ZSCALER:
       cc_url: connector.zscaler.net/api/v1/provUrl?name=DemoBC
       api_key: adfads2sd
       password: demopass
       username: bac-demoadmin@12345689.zscaler.net
     network: 
       config:
       - name: hn0
         type: physical
         subnets:
         - address: 10.66.118.71/24
           gateway: 10.66.118.254
           type: static
       - name: hn1    
         type: physical
         fib: '1'    
         subnets:    
         - address: 10.66.118.72/24      
           gateway: 10.66.118.254
           type: static
         - type: nameserver
           address:
           - 10.66.98.1
           - 8.8.8.8
         search:
         - zscaler.net
       version: '1'
     zscaler_app_connector:
       enable: 'yes'
       provisioning_key: asldkfjalsdkjflaksasldkfjalsdkjflaksasldkfjalsdkjflaksasldkfjalsdkjflaksasldkfjalsdkjflaks 
     

     Close

     Example user data with non-default HTTP probe port and SSH key

     ZSCALER:
       cc_url: connector.zscaler.net/api/v1/provUrl?name=DemoBC
       http_probe_port: 50035
       api_key: adfads2sd
       password: demopass
       username: bac-demoadmin@12345689.zscaler.net
     network: 
       config:
       - name: hn0
         type: physical
         subnets:
         - address: 10.66.118.71/24
           gateway: 10.66.118.254
           type: static
       - name: hn1    
         type: physical
         fib: '1'    
         subnets:    
         - address: 10.66.118.72/24      
           gateway: 10.66.118.254
           type: static    
        - type: nameserver      
          address:      
          - 10.66.98.1    
          - 8.8.8.8    
        search:    
        - zscaler.net  
       version: '1'
     zscaler_app_connector:
       enable: 'yes'
       provisioning_key: asldkfjalsdkjflaksasldkfjalsdkjflaksasldkfjalsdkjflaksasldkfjalsdkjflaksasldkfjalsdkjflaks 
     ssh_authorized_keys:  
       - ssh-rsa ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCh3ru9CCnEow69WlQyJuxvZJGHcjhcgJzp8XnoKTJk6o1bit+rq4BNyjS0orauMF6fNMHAyGZqDWw6RICvoeh386xNqnD7+AGE9VGz4cPv0CjoV2HvkKnA2Dj8KZFFJ/bBV0BndNdGATsbDnhq0wkJ+WXFmamb9kx4dSDL5ZD15SybFop0b/3JoqXoU+9pxFc0bQ/cediaifCztliI9i7NAmvIUinLy2OlDW/uPEcB8nBgXhAAc9ALe6+Q4wZt8JUdrcF04bgoAHYsNuzyEk4dNvov97JyExCAwzSLomiHFtdzhGw7/o6KhfhxxBRodKy4wQBwDzPbD6EbN9iCqoK8DY4HZ2L7HyQKRjhnnY/Y0uldO0tleogElbk+4LsoyAPjPAbogu89xSOa6D7sl2G+dPpqTlFBmO/3m/2JhBnGU= admin@branchpc

     Close

     Close

2. Apply your user data to the VM in one of the following ways:

   • ISO Method

     1. Apply the user data to the VM as an ISO image:

        • On Centos, install the genisoimage:

          sudo yum install genisoimage

        • On Ubuntu, install the genisoimage:

          sudo apt install genisoimage

     2. Configure the required user data.

        The user data file must be named user-data.

        zuser@hostname:~$ mkdir isodir
        zuser@hostname:~$ cat > isodir/user-data <<EOF #cloud-config
        <TEXT FROM TEXT FILE>
        EOF
        user@hostname:~genisoimage -o user-data.iso -r isodir/user-data

        You attach the ISO to your Branch Connector & App Connector VM as described in the Deploying the Branch Connector & App Connector procedure.

     Close
   • Manual Method

     You apply your user data as described in the Deploying the Branch Connector & App Connector procedure.

     Close

Deploying the Branch Connector & App Connector

After you have met all the prerequisites, created user data, and applied user data to the VM (if you used the ISO method), perform the following procedure to deploy your Branch Connector & App Connector with Hyper-V.

Deployment Procedure

Managing the Branch Connector & App Connector

After your VM is fully deployed, you can manage the Branch Connector & App Connector VM from the Admin Portal. A deployed VM is displayed in the dashboard. The Cloud & Branch Connector Monitoring page provides information on the name, group, location, geolocation, and status of the VMs deployed in your branch account.

After verifying deployment, you can configure the following policies:

• Traffic Forwarding
• Log and Control Forwarding
• DNS Filtering