• Review the Branch Connector specifications and sizing requirements.

  • Small VM: requires 4 GB of memory, two CPU cores, 128 GB data disk size, and two network interface cards (NICs)
  • Medium VM: requires 8 GB of memory, 4 CPU cores, 128 GB data disk size, and 4 NICs

  Close
• Review the virtual machine specifications for Branch Connector deployed in high availability.

  • The Promiscuous mode option must be enabled (i.e., set to Accept) on the vSphere switch (vSwitch) or at the port group level. Branch Connector uses the Common Address Redundancy Protocol (CARP) to process traffic across multiple Branch Connector instances. To support this, you must enable promiscuous mode on your service interface.
  • The MAC address changes option must be enabled on the vSwitch or port group.
  • The Forged transmits option must be enabled on the vSwitch or port group.
  • Branch Connectors often share the vSwitch with other corporate VMs, and settings you apply on the vSwitch level are applied to all VMs on the vSwitch. When promiscuous mode is enabled, other VMs might be able to detect traffic going through the service interface. To avoid this risk, Zscaler recommends that you create and use a port group for your Branch Connector service interfaces.
  • If multiple physical ports exist on the same vSwitch, then the Net.ReversePathFwdCheckPromisc advanced option must be enabled (i.e., set to 1) on the ESXi host. If it is not enabled, then multicast traffic loops back to the host, causing CARP not to function properly, and link states coalesced messages are sent. To learn more, refer to the VMware documentation.

  Close

Creating and Applying User Data

You must create user data information for your Branch Connector VM. For VMware vCenter, user data information is provided during the OVA file import process. For VMware vSphere Hypervisor (ESXi), you must apply the user data information to the VM. This information can either be applied to the VM with an ISO file that you mount via a virtual CD-ROM drive or applied manually to the /etc/cloud/cloud.cfg.d/ directory. For both methods, you must create a text file containing the user data.

1. Create your user data in a text file named userdata.cfg using one of the following templates, formatted in YAML:

   • Branch Connector with Management DHCP Template

     ZSCALER:
       cc_url: <CC_URL>
       http_probe_port: 50035 #Optional to change the port for load balancer status checks from the default value 50001 to 50035.
       api_key: <API Key>
       password: <Admin Password>
       username: <Admin Username>
     network: 
       config:
       - name: vmx0 #For the VMXNet3 driver (required)
         type: physical
         subnets:
         - type: dhcp 
     version: '1'
     #ssh keys are optional
     ssh_authorized_keys: 
       - ssh-rsa <Key>

     Example user data with default HTTP probe port and no SSH key

     ZSCALER:
       cc_url: connector.zscaler.net/api/v1/provUrl?name=DemoBC
       api_key: adfads2sd
       password: demopass
       username: bac-demoadmin@12345689.zscaler.net
     network: 
       config:
       - name: vmx0
         type: physical
         subnets:
         - type: dhcp 
       version: '1'
     

     Close

     Example user data with non-default HTTP probe port and SSH key

     ZSCALER:
       cc_url: connector.zscaler.net/api/v1/provUrl?name=DemoBC
       http_probe_port: 50035
       api_key: adfads2sd
       password: demopass
       username: bac-demoadmin@12345689.zscaler.net
     network: 
       config:
       - name: vmx0
         type: physical
         subnets:
         - type: dhcp 
       version: '1'
     ssh_authorized_keys: 
       - ssh-rsa ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCh3ru9CCnEow69WlQyJuxvZJGHcjhcgJzp8XnoKTJk6o1bit+rq4BNyjS0orauMF6fNMHAyGZqDWw6RICvoeh386xNqnD7+AGE9VGz4cPv0CjoV2HvkKnA2Dj8KZFFJ/bBV0BndNdGATsbDnhq0wkJ+WXFmamb9kx4dSDL5ZD15SybFop0b/3JoqXoU+9pxFc0bQ/cediaifCztliI9i7NAmvIUinLy2OlDW/uPEcB8nBgXhAAc9ALe6+Q4wZt8JUdrcF04bgoAHYsNuzyEk4dNvov97JyExCAwzSLomiHFtdzhGw7/o6KhfhxxBRodKy4wQBwDzPbD6EbN9iCqoK8DY4HZ2L7HyQKRjhnnY/Y0uldO0tleogElbk+4LsoyAPjPAbogu89xSOa6D7sl2G+dPpqTlFBmO/3m/2JhBnGU= admin@branchpc

     Close

     Close
   • Branch Connector with Static Management IP Template

     ZSCALER:
       cc_url: <CC_URL>
       http_probe_port: 50035 #Optional to change the port for load balancer status checks from the default value 50001 to 50035.
       api_key: <API Key>
       password: <Admin Password>
       username: <Admin Username>
     network: 
       config:
       - name: vmx0
         type: physical
         subnets:
         - address: <IP Address/Netmask>
           gateway: <Gateway>
           type: static
       - type: nameserver
         address: 
         - <IP Address>
         - <IP Address>
         search:
         - zscaler.net
       version: '1'
     #ssh keys are optional 
     ssh_authorized_keys:  
     - ssh-rsa <Key>
     

     Example user data with default HTTP probe port and no SSH key

     ZSCALER:
       cc_url: connector.zscaler.net/api/v1/provUrl?name=DemoBC
       api_key: adfads2sd
       password: demopass
       username: bac-demoadmin@12345689.zscaler.net
     network: 
       config:
       - name: vmx0
         type: physical
         subnets:
         - address: 10.66.118.71/24
           gateway: 10.66.118.254
     
           type: static
       - type: nameserver
         address:
         - 8.8.8.8
         - 8.8.4.4
         search:
         - zscaler.net
       version: '1'
     

     Close

     Example user data with non-default HTTP probe port and SSH key

     ZSCALER:
       cc_url: connector.zscaler.net/api/v1/provUrl?name=DemoBC
       http_probe_port: 50035
       api_key: adfads2sd
       password: demopass
       username: bac-demoadmin@12345689.zscaler.net
     network: 
       config:
       - name: vmx0
         type: physical
         subnets:
         - address: 10.66.118.71/24
           gateway: 10.66.118.254
     
           type: static
       - type: nameserver
         address:
         - 8.8.8.8
         - 8.8.4.4
         search:
         - zscaler.net
       version: '1'
     ssh_authorized_keys:  
       - ssh-rsa ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCh3ru9CCnEow69WlQyJuxvZJGHcjhcgJzp8XnoKTJk6o1bit+rq4BNyjS0orauMF6fNMHAyGZqDWw6RICvoeh386xNqnD7+AGE9VGz4cPv0CjoV2HvkKnA2Dj8KZFFJ/bBV0BndNdGATsbDnhq0wkJ+WXFmamb9kx4dSDL5ZD15SybFop0b/3JoqXoU+9pxFc0bQ/cediaifCztliI9i7NAmvIUinLy2OlDW/uPEcB8nBgXhAAc9ALe6+Q4wZt8JUdrcF04bgoAHYsNuzyEk4dNvov97JyExCAwzSLomiHFtdzhGw7/o6KhfhxxBRodKy4wQBwDzPbD6EbN9iCqoK8DY4HZ2L7HyQKRjhnnY/Y0uldO0tleogElbk+4LsoyAPjPAbogu89xSOa6D7sl2G+dPpqTlFBmO/3m/2JhBnGU= admin@branchpc
     

     Close

     Close

2. Apply your user data to the VM in one of the following ways:

   • ISO Method

     1. Apply the user data to the VM as an ISO image:

        • On Centos, install the genisoimage:

          sudo yum install genisoimage

        • On Ubuntu, install the genisoimage:

          sudo apt install genisoimage

     2. Configure the required user data.

        The user data file must be named user-data.

        zuser@hostname:~$ mkdir isodir
        zuser@hostname:~$ cat > isodir/user-data <<EOF #cloud-config
        <TEXT FROM TEXT FILE>
        EOF
        user@hostname:~genisoimage -o user-data.iso -r isodir/user-data

        You attach the ISO to your Branch Connector VM in the Deploying on VMware vSphere Hypervisor (ESXi) procedure.

     Close
   • Manual Method

     You apply your user data at the end of the Deploying on VMware vSphere Hypervisor (ESXi) procedure.

     Close