icon-zia.svg
Secure Internet and SaaS Access (ZIA)

Configuring Virtual Service Edge for Microsoft Azure

Zscaler supports standalone Virtual Service Edge for production deployments on Microsoft Azure.

Before you begin deployment, contact Zscaler Support to obtain the SAS token for the VHD to deploy Azure Virtual Service Edge and the Azure VM instance type recommendations.

Configuring a Standalone Virtual Service Edge

To configure a standalone Virtual Service Edge:

  • You'll need the following to deploy Virtual Service Edge over your VM:

    • A subscription to Virtual Service Edge.
    • VM specifications:
      • VM Size: Standard_A4m_v2CPU.
      • CPU: 4 CPU cores. Each CPU core independently handles a portion of the traffic for the Virtual Service Edge.
      • Instance Memory: 32 GB for production.
      • Storage account: General Purpose.
      • Data disk size: 500 GB.
    • Network Specs:
      • Two network interfaces.
        • The first network interface is the management IP address. It's used to control connections to the Zscaler cloud and make an SSH connection to the Virtual Service Edge VM for configuration and management. You can customize the deployment and define a separate IP address for the SSH connection to the Virtual Service Edge VM.
        • The second network interface is the service IP address.
      • Two public IPs.

        The two public IPs are not required when using a NAT. A NAT network configuration works correctly as long as it has sufficient network bandwidth.

    • Firewall Requirements: It's mandatory to deploy the Virtual Service Edge instance behind a VM network security group. The Virtual Service Edge instance only requires outbound connections to the Zscaler cloud. It does not require any inbound connections to your network from the Zscaler cloud. To view the firewall requirements for your specific account, go to the following URL:
      • https://config.zscaler.com/<zscaler cloud name>/zia-v-sedge.

        The <zscaler cloud name> can be found in the URL you use to log in to the ZIA Admin Portal. For example, if you log in to admin.zscaler.net, then go to https://config.zscaler.com/zscaler.net/zia-v-sedge. ​​​​​​

    Close
  • To add a Virtual Service Edge instance:

    1. Go to Administration > Virtual Service Edges.
    2. Click Add Virtual Service Edge.

      The Add Virtual Service Edge window appears.

    3. In the Add Virtual Service Edge window:
      • Name: Enter a name for the Virtual Service Edge.
      • Status: Choose to enable or disable the Virtual Service Edge. The default status is Enabled.
      • Deployment Status: Choose either In Production or Trial. The default deployment status is In Production.

        In Production represents Virtual Service Edge instances deployed for production purposes, and Trial represents Virtual Service Edge instances deployed for internal uses or testing purposes.

        The trial Virtual Service Edge instances are upgraded first during a maintenance window, followed by production Virtual Service Edge instances. This setting does not affect the behavior, functionality, or performance of the Virtual Service Edge instance, and it helps Zscaler prioritize production Virtual Service Edge instances over trial if an issue or a bug affects Virtual Service Edge instances.

      • Your Used Virtual Service Edges: You can see the total number of Virtual Service Edges as well as the available number of subscriptions. You can't modify this field.
      • Proxy IP Address: Enter the IP address to which you’ll forward the traffic. All user and server workload traffic is forwarded to the proxy IP address of the Virtual Service Edge. If the Virtual Service Edge has to receive and service traffic from users or workloads over the internet, ensure that this IP address has access to the internet as well as users.
      • Subnet Mask: Enter the corresponding subnet mask.
      • Default Gateway: Enter the IP address of the default gateway to the internet.
      • Load Balancer IP Address: Appears only when Cluster is selected as the deployment mode. Enter the IP address of the load balancer.
      • Deployment Mode: Select either Cluster or Standalone if you have the VMware ESXi platform. Otherwise, select only Standalone.

        If clustering fault tolerance is required, ensure to have an external load balancer for Standalone deployment.

      • IPSec Local Termination: Enable this option to terminate IPSec traffic from the client at the Virtual Service Edge node. By default, this option is disabled.

        If you select the deployment mode as Cluster, this option becomes read-only and displays the actual status of IPSec Local Termination of the Virtual Service Edge in the cluster. If you want to change the IPSec Local Termination status of the Virtual Service Edge in a cluster, you can do it from the Administration > Virtual Service Edges > Virtual Service Edge Clusters page. To learn more, see Adding Virtual Service Edge Clusters.

      • Zscaler Initiated On-Demand Support Tunnel: Enable this option to allow Zscaler to establish a support tunnel whenever required. This option is disabled by default.

        If this option is enabled, you cannot establish a support tunnel from the ZIA Admin Portal. Also, the Establish Support Tunnel option is grayed out.

      • Establish Support Tunnel: Enable this option to allow the service to establish a support tunnel for Zscaler Support to access the Virtual Service Edge. This option is disabled by default.

        This option is available only when the Zscaler Initiated On-Demand Support Tunnel is disabled.

      • Virtual Service Edge ID: You can see the Virtual Service Edge ID used by Zscaler to identify and access the Virtual Service Edge using the established support tunnel.

    4. Click Save.
    5. Activate the change.

    Azure reserves five IP addresses within each subnet. These are x.x.x.0-x.x.x.3 and the last address of the subnet. x.x.x.1-x.x.x.3 is reserved in each subnet for Azure services.

    • x.x.x.0: Network address.
    • x.x.x.1: Reserved by Azure for the default gateway.
    • x.x.x.2, x.x.x.3: Reserved by Azure to map the Azure DNS IPs to the VNet space.
    • x.x.x.255: Network broadcast address.
    Close
  • To download a Virtual Service Edge certificate:

    1. Go to Administration > Virtual Service Edges.
    2. In the SSL Certificate column, click Download for the Virtual Service Edge that you added previously, and then save the certificate.

    If you're downloading multiple certificates, you might want to change the certificate name so that you can differentiate between them. For example, if the Virtual Service Edge instances in a cluster are called VSE1 and VSE2, you can rename the certificate's ZIP files to VSE1.zip and VSE2.zip.

    Close
  • To copy the OS disk VHD file to your Azure Storage Account using Azure Storage Explorer:

    1. Contact Zscaler Support for OS disk URLs and tokens for your region to ensure the fastest copy time.
    2. Copy the VHD files using Azure Storage Explorer:
      1. Make sure you have two storage accounts with Virtual Service Edge blob containers created in the Azure portal. One is your template storage account and the other is your final destination storage account. Zscaler recommends that you clone the VHD files to your final destination storage account, associated with the VM. Retain your template storage account if you'd like to deploy another Virtual Service Edge in the future.
      2. Download and launch Azure Storage Explorer.
      3. Click the Add Account icon (plug icon).

        The Connect to Azure Storage window appears.

      4. In the Connect to Azure Storage window, select Storage account or service.

      5. Click Next.
      6. In this window, select Shared access signature URL (SAS).

      7. Click Next.
      8. In the following fields:

        1. Display name: Enter Zscaler.
        2. Service URL: Enter the URL and SAS token received from the Zscaler Support team.

        The other fields are auto-populated.

      9. Click Next.
      10. Review the connection summary and click Connect.
      11. When the connection is successful, in the left-side navigation, go to Storage Accounts > Zscaler Storage (SAS) > Blob Containers > <Folder name>. The VHD file is located here.
      12. Select the VHD file and click Copy.

      13. On the left panel, go to each of your personal storage accounts, and click Paste to add the VHD file to your blob containers. The transfer may take some time. The Activities tab at the bottom indicates when the transfer is complete.
        You see the VHD file in the blob container.

      14. Log in to the Azure Web Portal.
      15. Go to your destination blob container. You see the VHD file in the blob container.

    Close
  • To create a Virtual Service Edge image in Microsoft Azure:

    1. Log in to the Azure Portal.
    2. In the search bar, enter images, then select Images from the results.

    3. Click Create on the Images page.

    4. On the Create an image page:

      • Subscription: Select a subscription from the menu.
      • Resource group: Select the resource group that contains the desired VHD file.
      • Region: Select the region that has your storage account (VHD file).
      • Zone resiliency: Leave this box unchecked.
      • Name: Enter a name for the Virtual Service Edge image.
      • OS type: Select Linux.
      • VM generation: Select Gen 1.
      • Storage blob: Click Browse.

        On the Storage Accounts page:

        1. Locate and select the account with the container of the desired VHD file.

        2. On the Containers page, select the container with the desired VHD file.

        3. Click the VHD file then click Select.

      • Account type: Zscaler recommends Standard SSD.
      • Host Caching: Zscaler recommends Read-only.
      • Key management: Select a preferred key management method from the menu

    5. Click Review + create to validate the image and review the configuration.
    6. Click Create to create the image.

      The newly created image appears on the Images page.

    Close
  • Create a new VM instance using the Virtual Service Edge image:

    1. Create a virtual network.
      1. In the Azure portal, go to Home > Resource Groups and select your resource group.
      2. In the left-side navigation, click Virtual networks.

        Alternatively, on the Home page, in the Search field, search for the virtual networks.

      3. On the Virtual networks page, click Create.

        The Create virtual network page appears.

      4. On the Create virtual network page, on the Basics tab:
        • Resource group: Select the desired resource group.
        • Virtual network name: Enter a name for the virtual network.
        • Region: Select the region that has your Virtual Service Edge image.
      5. Go to the IP addresses tab.

        By default, the subnet is 16 and it's named default. If required, click Edit icon for the subnet and make the necessary changes.

      6. Click Review + create to validate the network and review the configuration.
      7. Click Create to create the virtual network.

    2. Create public IP addresses for the service network interface.
      1. In the left-side navigation, click Public IP addresses.

        Alternatively, on the Home page, in the Search field, search for the public IP addresses.

      2. On the Public IP addresses page, click Create.

        The Create public IP address page appears.

      3. On the Create public IP address page, on the Basics tab:
        • Resource group: Select the desired resource group.
        • Region: Select the region that has your Virtual Service Edge image.
        • Name: Enter a name for the public IP address.
        • IP Version: Select IPv4.
        • SKU: Select Basic.
        • IP address assignment: Select Static.
      4. Click Review + create to validate the public IP address and review the configuration.
      5. Click Create to create the public IP address.

    3. Create a service network interface (NIC).
      1. In the left-side navigation, click Network interfaces.

        Alternatively, on the Home page, in the Search field, search for the network interfaces.

      2. On the Network interfaces page, click Create.

        The Create network interface page appears.

      3. On the Create network interface page, on the Basics tab:
        • Resource group: Select the desired resource group.
        • Name: Enter a name for the network interface.
        • Region: Select the region that has your Virtual Service Edge image.
        • Virtual network: Select the virtual network created in the preceding step.
        • Subnet: Select the subnet created in the preceding step.
        • IP Version: Select IPv4.
        • Private IP address assignment: Select Dynamic.
      4. Click Review + create to validate the NIC and review the configuration.
      5. Click Create to create the NIC.

    4. Create a virtual machine (VM).

      1. In the left-side navigation, click Virtual Machines.

        Alternatively, on the Home page, in the Search field, search for the virtual machines.

      2. On the Virtual machines page, click Create > Azure virtual machine.

        The Create virtual machine page appears.

      3. On the Create virtual machine page, on the Basics tab:
        • Resource group: Select the desired resource group.
        • Virtual machine name: Enter a name for the VM.
        • Region: The region of the VM is automatically populated. It's not editable.
        • Availability options: Select either No infrastructure redundancy required (for VMs without Azure Load Balancer (LB)) or Availability set (for VMs with Azure LB).
        • Security type: The security type is automatically set to Standard. It's not editable.
        • Image: Go to See all images > My Images and then locate and select the image created in the preceding step.

        • VM architecture: Select x64.
        • Size: Select Standard_A4m_v2.
        • Authentication type: Select either SSH public key or Password.
        • Username: Enter zsroot.
        • SSH public key source: Select Generate new key pair.

          This field appears only if SSH public key is selected.

        • Key pair name: Enter the key pair name.

          This field appears only if SSH public key is selected.

        • Password: Enter the password.

          This field appears only if Password is selected.

        • Public inbound ports: Select Allow selected ports.
      4. On the Create virtual machine page, on the Networking tab:
        • Virtual network: The virtual network created in the preceding step is automatically populated.
        • Subnet: The subnet created in the preceding step is automatically populated.
        • Public IP: Click Create new to create a public IP.
          • Name: Enter the name for the public IP.
          • SKU: Select Basic.
          • Assignment: Select Static.
        • NIC network security group: Select Basic.
        • Public inbound ports: Select Allow selected ports.
        • Select inbound ports: Select SSH (22).
      5. Click Review + create to validate the VM and review the configuration.
      6. Click Create to create the VM.

        The Generate new key pair window appears.

      7. In the Generate new key pair window, click Download private key and create resource.

      The VM deployment takes about two minutes.

    5. After the VM is deployed to the resource group that has your Virtual Service Edge image, click Go to resource.
    6. Click Stop to stop the VM.
    7. After the VM is stopped, go to the Network settings of the VM.
    8. On the Network settings page, click Attach network interface to attach the second NIC created in the preceding step.

    9. Attach the public IP address to the service NIC.
      1. Go to the Network interfaces page, locate and select the NIC created in the preceding step.
      2. Click IP configurations in the Settings section.

      3. Locate and select the public IP created in the preceding step.
      4. In the Edit IP configuration window:
        • Associate public IP address: Select the checkbox.
        • Public IP address: Select the public IP created in the preceding step.
        • Click Save.

    10. Go to the Virtual machines page, locate and select the VM created in the preceding step.
    11. Click Start to start the VM.

    1. Manually configure the network security groups' settings. You can find more details about the outbound connection requirements at https://config.zscaler.com/<zscaler cloud name>/zia-v-sedge. The <zscaler cloud name> can be found in the URL you use to log in to the ZIA Admin Portal. For example, if you log in to admin.zscaler.net, then go to https://config.zscaler.com/zscaler.net/zia-v-sedge. To connect to your instance via SSH, you're required to open port 22 for inbound connections. In production, you should authorize only a specific IP address or range of addresses to access your instance and not use 0.0.0.0. If you use a NAT gateway, you can disassociate and delete the two public IP addresses.

    Close
  • Zscaler performs ICMP and HTTP monitoring from the Azure LB to the Virtual Service Edge to monitor the health of the Virtual Service Edge and ensure that traffic is distributed appropriately. For health probes to work, you must create a Firewall Filtering policy rule to allow Azure proxy and load balancer IP addresses.

    To create a Firewall filtering rule to bypass Azure LB IP addresses:

    1. Go to Policy > Firewall Control.
    2. Click Add Firewall Filtering Rule.
      The Add Firewall Filtering Rule window appears.
    3. In the Source IP tab, under IP Addresses add the following IP addresses from Azure:
      • Proxy IP address
      • Load balancer IP address
    4. Under Action, select Allow.
    5. Complete the configuration for the new rule as detailed in Configuring Firewall Filtering Policy.
    Close
  • The following Virtual Service Edge configuration steps are run through an SSH terminal connection.

    To configure the Virtual Service Edge on the VM:

    1. Configure the network.
      1. Select the Virtual Service Edge VM and click either Power On or Power On the virtual machine.
      2. In the Azure Web Console, enter the following credentials in the FreeBSD command prompt to log in:
        Username: zsroot

        Password: zsroot

        The following guidelines apply:

        • Zscaler strongly recommends that you change this default password by running the passwd command.
        • Direct root login is not permitted. Administrators must use the sudo utility to run a command with higher privileges.
      3. Run the sudo vzen configure-network command, and then enter the following details:

        • Address of the DNS server (e.g., 10.84.0.100) used for name resolution of Zscaler cloud domains and also for domain names in the proxy traffic.
        • Hostname of the Virtual Service Edge.

        The Virtual Service Edge management IP, gateway IP for management, and resolvers are obtained from DHCP.

        This command does not allow you to modify the management IP and gateway IP.

    2. Install the SSL certificate of the Virtual Service Edge instance. This is the certificate that you downloaded from the ZIA Admin Portal. A Virtual Service Edge uses this certificate to authenticate itself to the Zscaler service.
      When you configure a Virtual Service Edge, ensure that you upload the correct certificate for the Virtual Service Edge instance.
      To install the SSL certificate of the Virtual Service Edge instance:
      1. Navigate to the SSL certificate that you saved.
      2. Use SCP or SFTP to upload it to the management IP address of the Virtual Service Edge.
      3. In the Azure Web Console, log in with the following credentials:
        Username: zsroot
        Password: zsroot
      4. Go to the Azure Web Console or use SSH to connect to the management IP address.
      5. Run the command, sudo vzen install-cert <cert-bundle.zip>.

        Ensure to specify the absolute path to the SSL certificates (e.g., sudo vzen install-cert /tmp/cert-bundle.zip).

    3. (Optional) if you want to use an SNMP management system to monitor the Virtual Service Edge cluster, enable SNMP for Virtual Service Edge and configure SNMP parameters. Virtual Service Edges support SNMPv3 only.
      1. Run the command, sudo vzen snmp-admin-configure.
        1. Enter a user name for the SNMPv3 management system that sends queries to the Virtual Service Edge. The Virtual Service Edge accepts queries only from this user name.
        2. Enter the password that the Virtual Service Edge uses to authenticate the SNMP management system.
        3. Specify the authentication protocol that the Virtual Service Edge can use to authenticate the SNMP user. Enter either MD5 or SHA1.
        4. Specify the encryption method that the Virtual Service Edge can use to authenticate the SNMP user. Enter either DES or AES.
      2. Run the command, sudo vzen snmp-trap-configure.
        1. When asked which traps you want to configure, specify v3 traps.
        2. Enter the IP address of the SNMP trap management system to which the Virtual Service Edge sends traps.
        3. Enter a user name for the SNMP management system.
        4. Enter the password that the Virtual Service Edge uses to authenticate the SNMP management system.
        5. Specify the authentication protocol that the Virtual Service Edge can use to authenticate the SNMP user. Enter either MD5 or SHA1.
        6. Specify the encryption method that the Virtual Service Edge can use to authenticate the SNMP user. Enter either DES or AES.
    4. Download the Virtual Service Edge build and start the Virtual Service Edge.
      1. Go to the Azure Web Console or use SSH to connect to the management IP address.
      2. Run the following command to download the Virtual Service Edge build: sudo vzen download-build.
        The initial build is around 1 GB, so it may take a while depending on your Internet connection. The downloaded build is automatically installed. The Virtual Service Edge automatically starts after the installation is complete.
    5. Verify the configuration.
    6. Go to the Azure Web Console or use SSH to connect to the management IP address.
      1. Run the sudo vzen status command.
        The output should display that the Virtual Service Edge service and load balancer are running.
      2. Run the sudo vzen troubleshoot connection | grep 9422 command.
        The output should display an established connection.
    Close

Associating Multiple Virtual Service Edges with Azure LB

To associate a single Virtual Service Edge VM with Azure LB, skip the first two steps. To associate multiple Virtual Service Edges with Azure LB:

  • To create availability sets in your Azure account:

    1. In the Azure Web Console, go to Home > Resource Groups and select your resource group.
    2. Click Add > Availability sets.
      Alternatively, on the Home page, in the Search field, search for the availability sets.
    3. On the Availability sets page, click Add.

      The Create availability sets page appears.

    4. On the Create availability sets page:
      • Subscription: Select your subscription.
      • Resource group: Select the resource group in which you want to create the availability sets.
      • Name: Enter a name for the availability sets.
      • Region: Select the region.
      • Fault domains: Select the number of Virtual Service Edge VMs in a fault domain.
      • Update domains: Select the number of Virtual Service Edge VMs in an update domain.
      • Use manage disks: Select No (Classic).
    5. Click Review + create.
    Close
  • To create Virtual Service Edge VMs using the deployment script with the availability set parameter:

    1. Populate the values in conf_file.txt.

      • ValueDescription
        nameName of the instance.
        locationLocation to deploy the instance.
        rgnameName of the destination resource group containing the VM instance.
        creatergN if the resource group is allocated already. Y if it needs to be provisioned.
        storenameName of the destination storage account to create the instance disks.
        createstorageN if the storage account is already provisioned. Y if it needs to be provisioned.
        vnetnameName of the virtual network to which this instance is associated. Creates a VNet if the one with a specified name doesn't exist.
        vnetprefixIP address range in CIDR for the virtual network.
        vnetrgIf the virtual network is in a different resource group, specify the resource group name here, or else remove this line from the config. Though the network and VM instance can be in different resource groups, they should be in the same region.
        mgmtsubnetnameName of the subnet hosting management interface.
        mgmtsubnetprefixCIDR prefix for the management interface subnet.
        svcsubnetnameName of the subnet in the virtual network to which the service interface is associated.
        svcsubnetprefixCIDR prefix for the subnet of the service interface.
        niccountNumber of NICs to attach to the instance. You can have 2 unless advanced deployment is in place.
        vmsizeInstance type according to azure machine specifications.
        avsetAvailability set for VM provisioning, ignore if not used.
        srcOsURIURI of the OS disk copied in the previous step. <Path to copied OS disk, the disk blob copied from Zscaler including the vhd file name>
        dstStorageURIURI of the storage account to which the OS disk is copied. The URI should not include the ending forward slash.
        dstContainerThe name of the container to which the OS disk VHD file is copied.
        Close
      • name=vzen57shaunak_aug29
                                                            location=westus
                                                            rgname=shaunakdesh
                                                            createrg=n
                                                            storename=57vzenshaunak
                                                            createstorage=n
                                                            vnetname=57vzenshaunak_2
                                                            vnetprefix=10.2.0.0/16
                                                            mgmtsubnetname=57vzensub_2
                                                            mgmtsubnetprefix=10.2.0.0/24
                                                            svcsubnetname=57vzensub_3
                                                            svcsubnetprefix=10.2.0.0/18
                                                            niccount=2
                                                            vmsize=Standard_A4m_v2
                                                            avset=vzenshaunak_set
                                                            dstStorageURI=https://57vzenshaunak.blob.core.windows.net 
                                                            dstContainer=57vzenshaunak1 
                                                            srcOsURI=https://57vzenshaunak.blob.core.windows.net/57vzenshaunak1/zsos24_vse_rev3.vhd
        Close

      Ensure that you associate all Virtual Service Edge VMs with availability set to the same location.

    2. Run the following script.

      deployment_script.ps1 config_file.txt 
      • #Test if the azure powershell modules are present on the system
                                                                                                                    $scmd="Connect-AzAccount"
                                                                                                                    $cmdout=Get-Command $scmd -eA SilentlyContinue -EV $serr -OV $sout
                                                                                                                    if(!$cmdout.CommandType) {
                                                                                                                        echo "Required powershell modules are missing. Please install the azure modules and retry"
                                                                                                                        exit
                                                                                                                    }
                                                                                                                    #Sign in for this session
                                                                                                                    Connect-AzAccount
                                                                                                                    #Fetch the config file to be loaded
                                                                                                                    if( $args[0] -ne $null ){
                                                                                                                        $filename=$args[0]
                                                                                                                        }
                                                                                                                    else
                                                                                                                        {
                                                                                                                            $filename="./config.txt"
                                                                                                                        }
                                                                                                                    $SubSelect = 'n'
                                                                                                                    Set-Item Env:\SuppressAzurePowerShellBreakingChangeWarnings "true"
                                                                                                                    Do {
                                                                                                                        $subs=Get-AzSubscription
                                                                                                                        echo "Listing available subscriptions in your account"
                                                                                                                        $subid=0
                                                                                                                        $ProvisionSub=99999
                                                                                                                        foreach ($sub in $subs) {
                                                                                                                            echo "Subscription $subid :"
                                                                                                                            echo $sub
                                                                                                                            $subid++
                                                                                                                        }
                                                                                                                        if($subid -ge 1)
                                                                                                                        {
                                                                                                                            $ProvisionSub=Read-Host -Prompt "Select one of the above for provisioning"
                                                                                                                        }
                                                                                                                        else
                                                                                                                        {
                                                                                                                            $ProvisionSub=0
                                                                                                                        }
                                                                                                                        echo "Selected subscription for provisioning :"
                                                                                                                        echo $subs[$ProvisionSub]
                                                                                                                        $SubSelect=Read-Host -Prompt "Enter `"y`" to continue with this subscription or `"n`" to choose again"
                                                                                                                    } While($SubSelect -eq 'n' -or $SubSelect -eq 'N')
                                                                                                                    if($SubSelect -ne 'y' -and $SubSelect -ne 'Y') {
                                                                                                                        echo "You did not choose a subscription to deploy in, script will exit now"
                                                                                                                        exit
                                                                                                                    }
                                                                                                                    $subscription=$subs[$ProvisionSub]
                                                                                                                    echo "Script will continue to provision in the selected subscription $subscription "
                                                                                                                    Set-AzContext -SubscriptionId $subscription.Id
                                                                                                                    echo "Azure Subscription for current session set to the following"
                                                                                                                    Get-AzContext
                                                                                                                    $select=Read-Host -Prompt "Do you wish to continue(y/n):"
                                                                                                                    if($select -ne 'y' -or $select -ne 'Y')    
                                                                                                                    {
                                                                                                                        echo "Script terminating per user input"
                                                                                                                        exit
                                                                                                                    }
                                                                                                                    echo "Provisioning will continue with the selected subscription"
                                                                                                                    if ( -not (Test-Path $filename))
                                                                                                                    {
                                                                                                                            echo "Config file not found at $filename"
                                                                                                                            exit
                                                                                                                    }
                                                                                                                    else
                                                                                                                        {
                                                                                                                            echo "Found the configuration file, populating deployment variables from $filename"
                                                                                                                        }
                                                                                                                    #Sanity run, set this to n when running actual creation
                                                                                                                    $sanityrun='n'
                                                                                                                    #Initialize config entries from the configuration file provided
                                                                                                                    $name=''
                                                                                                                    $rgname=''
                                                                                                                    $niccount=1
                                                                                                                    $rgcreate="n"
                                                                                                                    $storename=''
                                                                                                                    $mgmtsubnetname=''
                                                                                                                    $svcsubnetname=''
                                                                                                                    $vnetname=''
                                                                                                                    $vnetprefix=''
                                                                                                                    $mgmtsnetprefix=''
                                                                                                                    $svcsubnetprefix=''
                                                                                                                    $vmsize=''
                                                                                                                    $location=''
                                                                                                                    $osimage=''
                                                                                                                    $dstStorageURI=''
                                                                                                                    $datadisk="Copy"
                                                                                                                    $datadisksize=0
                                                                                                                    $datadisksrcURI=''
                                                                                                                    $osdisksrcURI=''
                                                                                                                    $dataimageURI=''
                                                                                                                    $dstContainer=''
                                                                                                                    $vnetrgname=''
                                                                                                                    $avsetname=''
                                                                                                                    $avcheck="No"
                                                                                                                    #Parse the config file provided and load the values
                                                                                                                    foreach ($line in Get-Content $filename) {
                                                                                                                        if($line -match "^#.*") {
                                                                                                                            #Commented
                                                                                                                            continue
                                                                                                                        }
                                                                                                                        if( [string]::IsNullOrWhitespace($line)) {
                                                                                                                            #Empty line
                                                                                                                            continue
                                                                                                                        }
                                                                                                                        $entries=$line.split("=",2,[StringSplitOptions]'RemoveEmptyEntries')
                                                                                                                        #$entries=$line.split("=")
                                                                                                                        $e1=$entries[0]
                                                                                                                        $e2=$entries[1]
                                                                                                                        Write-Host $e1 $e2 -Separator ","
                                                                                                                        $key=$e1.Trim()
                                                                                                                        $value=$e2.Trim()
                                                                                                                        #echo "Got entries" $entries[0] "->" $entries[1]
                                                                                                                        if($key -eq "name") {
                                                                                                                            $name=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "avset") {
                                                                                                                            $avsetname=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "rgname") {
                                                                                                                            $rgname=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "vnetrg") {
                                                                                                                            $vnetrgname=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "createrg") {
                                                                                                                            $rgcreate=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "storename") {
                                                                                                                            $storename=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "createstorage") {
                                                                                                                            $storecreate=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "mgmtsubnetname") {
                                                                                                                            $mgmtsubnetname=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "svcsubnetname") {
                                                                                                                            $svcsubnetname=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "vnetname") {
                                                                                                                                $vnetname=$value
                                                                                                                                continue
                                                                                                                            }        
                                                                                                                        if($key -eq "niccount") {
                                                                                                                            $niccount=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "vnetprefix") {
                                                                                                                            $vnetprefix=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "mgmtsubnetprefix") {
                                                                                                                            $mgmtsnetprefix=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "svcsubnetprefix") {
                                                                                                                            $svcsubnetprefix=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "vmsize") {
                                                                                                                            $vmsize=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "location") {
                                                                                                                            $location=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "dstStorageURI") {
                                                                                                                            $dstStorageURI=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "srcOsURI") {
                                                                                                                            $osimage=$value
                                                                                                                            continue
                                                                                                                            }    
                                                                                                                        if($key -eq "osuri") {
                                                                                                                            $osdisksrcURI=$value
                                                                                                                            continue
                                                                                                                            }    
                                                                                                                        if($key -eq "sastok") {
                                                                                                                            $sastok=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        if($key -eq "attach") {
                                                                                                                            $attachdisk=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                         if($key -eq "dstContainer") {
                                                                                                                            $dstContainer=$value
                                                                                                                            continue
                                                                                                                            }
                                                                                                                        
                                                                                                                        }
                                                                                                                    echo "Name=$name Rgname=$rgname Location=$location"
                                                                                                                    if($vnetrgname -eq '')
                                                                                                                    {
                                                                                                                        $vnetrgname=$rgname
                                                                                                                    }
                                                                                                                    $loclist=Get-AzLocation
                                                                                                                    $loccheck=0
                                                                                                                    foreach($loc in $loclist.Location){
                                                                                                                        if($loc -like $location){
                                                                                                                            $loccheck=1
                                                                                                                        }
                                                                                                                    }
                                                                                                                    if($loccheck -eq 1){
                                                                                                                        Write-Host "The virtual instance will be deployed in $location"
                                                                                                                    } else {
                                                                                                                        Write-Error -Message "The location provided in configuration file :- $location is not a valid input. Please correct the same and rerun the script"
                                                                                                                        exit
                                                                                                                    }
                                                                                                                        
                                                                                                                    #Fetch resource group and storage account configured in the conf file
                                                                                                                    $rg=Get-AzResourceGroup -ResourceGroupName $rgname -ev notPresent    -ea 0
                                                                                                                    $rgcreatechoice='n'
                                                                                                                    $storecreatechoice='n'
                                                                                                                    #If resource group does not exist, provision it before proceeding 
                                                                                                                    if($rg.ProvisioningState -ne "Succeeded") {
                                                                                                                        echo "The resource group $rgname does not exist, do you wish to create it in $location(y/n):"
                                                                                                                        $rgcreatechoice=Read-Host
                                                                                                                        if($rgcreatechoice -eq 'y' -or $rgcreatechoice -eq 'Y') {
                                                                                                                            echo "Creating resourcegroup $rgname in $location"
                                                                                                                            $rg=New-AzResourceGroup -Name $rgname -Location $location
                                                                                                                            if($rg.ProvisioningState -ne "Succeeded") {
                                                                                                                                echo "Error creating resource group. Script will exit now"
                                                                                                                                exit
                                                                                                                            }
                                                                                                                            echo "Created resource group. Continuing to provision the storage account"
                                                                                                                            $storecreatechoice='y'
                                                                                                                        }else
                                                                                                                        {
                                                                                                                            echo "Resource group specified does not exist in the selected subscription. Exiting"
                                                                                                                            exit
                                                                                                                        }
                                                                                                                    }
                                                                                                                    if($rgcreatechoice -eq 'n')
                                                                                                                    {
                                                                                                                        $store=Get-AzStorageAccount -ResourceGroupName $rgname -Name $storename -ev stnotPresent -ea 0
                                                                                                                        if($store.ProvisioningState -ne "Succeeded"){
                                                                                                                            echo "The Storage account provided `"$storename`" doesn't exist in $rgname"
                                                                                                                            echo "Do you wish to provision the storage account now(y/n):"
                                                                                                                            $storecreatechoice=Read-Host
                                                                                                                            if($storecreatechoice -ne 'y' -or $storecreatechoice -ne 'Y'){
                                                                                                                                echo "VM creation cannot continue without storage account. Exiting."
                                                                                                                                if($rgcreatechoice -eq 'y' -or $rgcreatechoice -eq 'Y'){
                                                                                                                                    echo "Resource group $rgname was provisioned in $location while script executed"
                                                                                                                                    echo "Please delete it if no longer in use"
                                                                                                                                }
                                                                                                                                exit
                                                                                                                            }
                                                                                                                        }
                                                                                                                    }
                                                                                                                    $storetype='Standard_LRS'
                                                                                                                    if($storecreatechoice -eq 'y' -or $storecreatechoice -eq 'Y'){
                                                                                                                        echo "Preparing to provision storage account $storename in resource group $rgname"
                                                                                                                        echo "Do you need geo redundant store or locally reduntant store"
                                                                                                                        echo "Enter 1 for geo reduntant(Standard_GRS) or 2 for locally reduntant(Standard_LRS), if you need"
                                                                                                                        echo "other options, enter `"n`" to exit now and provision the storage account manually "
                                                                                                                        echo "Enter your choice: "
                                                                                                                        $storetypechoice=Read-Host
                                                                                                                        if($storetypechoice -eq 1)
                                                                                                                        {
                                                                                                                            echo "Store type set to Standard_GRS"
                                                                                                                            $storetype="Standard_GRS"
                                                                                                                        }
                                                                                                                        if($storetypechoice -eq 2)
                                                                                                                        {
                                                                                                                            echo "Store type set to Standard_LRS"
                                                                                                                            $storetype="Standard_LRS"
                                                                                                                        }
                                                                                                                        if($storetypechoice -eq 'n' -or $storetypechoice -eq 'N')
                                                                                                                        {
                                                                                                                            echo "Exiting deployment as per user input"
                                                                                                                            exit
                                                                                                                        }
                                                                                                                        echo "Creating storage account. This is a long operation. Please wait till it completes."
                                                                                                                        $store=New-AzStorageAccount -ResourceGroupName $rgname -Name $storename -Location $location -SkuName $storetype
                                                                                                                                
                                                                                                                    }
                                                                                                                    if($store.ProvisioningState -ne "Succeeded")
                                                                                                                    {
                                                                                                                        echo "Storage account creation did not complete successfully. Exiting deployment"
                                                                                                                        if($rgcreatechoice -eq 'y' -or $rgcreatechoice -eq 'Y'){
                                                                                                                            echo "Resource group $rgname was provisioned in $location. Please delete it manually if not needed"
                                                                                                                        }
                                                                                                                        exit
                                                                                                                    }else
                                                                                                                    {
                                                                                                                        #Check if the container exists in target account
                                                                                                                        $containercheck=Get-AzStorageContainer -Name $dstContainer -Context $store.Context -ErrorAction SilentlyContinue
                                                                                                                        if($containercheck.Name -ne $dstContainer)
                                                                                                                        {
                                                                                                                            #Create Storage container with the provided name
                                                                                                                            echo "Storage account creation successful, creating container for disk storage."
                                                                                                                            New-AzStorageContainer -Name $dstContainer -Permission Off -Context $store.Context 
                                                                                                                        }
                                                                                                                    }
                                                                                                                    #Availability set check
                                                                                                                    if($avsetname -ne '') {
                                                                                                                        $avset=Get-AzAvailabilitySet -Name $avsetname -ResourceGroupName $rgname -ErrorAction SilentlyContinue
                                                                                                                        if($avset.Name -eq $avsetname) {
                                                                                                                            if($avset.Managed) {
                                                                                                                                echo "This availability set is not supported by the vm type being deployed,"
                                                                                                                                echo "Please use a classic availability set to deploy this VM"
                                                                                                                                exit
                                                                                                                            }
                                                                                                                            echo "Availability set present, vm instance will be provisioned within availability set"
                                                                                                                            $avcheck="Yes"
                                                                                                                            sleep 10
                                                                                                                        }
                                                                                                                    }
                                                                                                                    if($avcheck -eq "No" -and $avsetname -ne '') {
                                                                                                                        echo "Creating availability set for the VM"
                                                                                                                        $avset=New-AzAvailabilitySet -Name $avsetname -ResourceGroupName $rgname -Location $location -Sku classic
                                                                                                                        sleep 10
                                                                                                                        if($avset.Name -eq $avsetname) {
                                                                                                                            echo "Created availability set, deployment in progress"
                                                                                                                            sleep 5
                                                                                                                        }else
                                                                                                                        {
                                                                                                                            echo "Deployment will stop now, failed to create availability set"
                                                                                                                            echo "To deploy, create a classic availability set in the required resource group"
                                                                                                                            echo "And execute the script again"
                                                                                                                            exit
                                                                                                                        }
                                                                                                                        $avcheck="Yes"
                                                                                                                    }
                                                                                                                        
                                                                                                                        
                                                                                                                    #Network configuration for the virtual machine
                                                                                                                    #create the interface names
                                                                                                                    $nicnames=@()
                                                                                                                    if($niccount -gt 0) {
                                                                                                                        echo "Creating $niccount nic names"
                                                                                                                        for($i=0; $i -lt $niccount; $i++) {
                                                                                                                            $nicname=$name+"_nic_"+$i
                                                                                                                            $nicnames+=$nicname
                                                                                                                            
                                                                                                                        }
                                                                                                                    }else {
                                                                                                                        echo "The vm needs at least 1 interface to be configured, current value is $niccount"
                                                                                                                        echo "Script will exit now. Please correct the config file as per recommendations and try again"
                                                                                                                        exit
                                                                                                                    }
                                                                                                                    $ipnames=@()
                                                                                                                    if($niccount -gt 0) {
                                                                                                                        echo "Creating $niccount ip names"
                                                                                                                        for($i=0; $i -lt $niccount; $i++) {
                                                                                                                            $ipname=$name+"_ip_"+$i
                                                                                                                            $ipnames+=$ipname
                                                                                                                            
                                                                                                                        }
                                                                                                                    }
                                                                                                                    if($vnetrgname -ne $rgname){
                                                                                                                        #Validate the resource group for provisioning vnet exists
                                                                                                                    }
                                                                                                                      
                                                                                                                    $vnet=Get-AzVirtualNetwork -Name $vnetname -ResourceGroupName $vnetrgname -ev vnetError -ea 0
                                                                                                                    $vnetcreate='n'
                                                                                                                    if($vnet.ProvisioningState -eq "Succeeded") 
                                                                                                                    {
                                                                                                                            echo "VirtualNetwork $vnetname exists, checking for subnet"
                                                                                                                            $mgmtsnet=Get-AzVirtualNetworkSubnetConfig -Name $mgmtsubnetname -VirtualNetwork $vnet -ev snetPresent -ea 0
                                                                                                                            $svcsnet=Get-AzVirtualNetworkSubnetConfig -Name $svcsubnetname -VirtualNetwork $vnet -ev snetPresent -ea 0
                                                                                                                    }else
                                                                                                                    {
                                                                                                                        echo "Do you wish to create the Virtual Network as per the configuration provided"
                                                                                                                        $vnetcreate=Read-Host -Prompt "Enter y/n"
                                                                                                                        if($vnetcreate -ne 'y' -and $vnetcreate -ne 'Y')
                                                                                                                        {
                                                                                                                            echo "Virtual Network configuration for the VM instance is not provisioned"
                                                                                                                            echo "This script will now exit"
                                                                                                                            if($rgcreatechoice -eq 'y' -or $rgcreatechoice -eq 'Y' ){
                                                                                                                                echo "Resource group $rgname was provisioned in $location "
                                                                                                                                echo "It can be removed if not in use"
                                                                                                                            }
                                                                                                                            if($storecreatechoice -eq 'y' -or $storecreatechoice -eq 'Y'){
                                                                                                                                echo "Storage account $storename was provisoned by this script"
                                                                                                                                echo "It can be removed if not used"
                                                                                                                            }
                                                                                                                            exit
                                                                                                                        }
                                                                                                                        echo "New Virtual network $vnetname with prefix $vnetprefix will be created in $location"
                                                                                                                        $vnetcreate=Read-Host -Prompt "Do you wish to continue (y/n)"
                                                                                                                        if($vnetcreate -ne 'y' -and $vnetcreate -ne 'Y')
                                                                                                                        {
                                                                                                                            echo "Script will exit now as per user input"
                                                                                                                            if($rgcreatechoice -eq 'y' -or $rgcreatechoice -eq 'Y' ){
                                                                                                                                echo "Resource group $rgname was provisioned in $location "
                                                                                                                                echo "It can be removed if not in use"
                                                                                                                            }
                                                                                                                            if($storecreatechoice -eq 'y' -or $storecreatechoice -eq 'Y'){
                                                                                                                                echo "Storage account $storename was provisoned by this script"
                                                                                                                                echo "It can be removed if not used"
                                                                                                                            }
                                                                                                                            exit
                                                                                                                        }
                                                                                                                        $mgmtsnet=New-AzVirtualNetworkSubnetConfig -Name $mgmtsubnetname -AddressPrefix $mgmtsnetprefix -ev sNetCreate -ea 0
                                                                                                                        if($mgmtsnetprefix -ne $svcsubnetprefix) {
                                                                                                                            $svcsnet=New-AzVirtualNetworkSubnetConfig -Name $svcsubnetname -AddressPrefix $svcsnetprefix -ev sNetCreate -ea 0
                                                                                                                            $vnet=New-AzVirtualNetwork -Name $vnetname -ResourceGroupName $vnetrgname -Location $location -AddressPrefix $vnetprefix -Subnet $mgmtsnet,$svcsnet -ev vNetCreate -ea 0
                                                                                                                        }
                                                                                                                        else
                                                                                                                        {
                                                                                                                            $vnet=New-AzVirtualNetwork -Name $vnetname -ResourceGroupName $vnetrgname -Location $location -AddressPrefix $vnetprefix -Subnet $mgmtsnet -ev vNetCreate -ea 0
                                                                                                                            $svcsnet=$mgmtsnet
                                                                                                                        }
                                                                                                                        
                                                                                                                    }
                                                                                                                    if($vnet.ProvisioningState -ne "Succeeded"){
                                                                                                                        echo "Virtual network creation failed or script was unable to fetch"
                                                                                                                        echo "the Virtual network configuration. Please check the configuration"
                                                                                                                        echo "for possible errors and execute the script further"
                                                                                                                        if($rgcreatechoice -eq 'y' -or $rgcreatechoice -eq 'Y' ){
                                                                                                                            echo "Resource group $rgname was provisioned in $location "
                                                                                                                            echo "It can be removed if not in use"
                                                                                                                        }
                                                                                                                        if($storecreatechoice -eq 'y' -or $storecreatechoice -eq 'Y'){
                                                                                                                            echo "Storage account $storename was provisoned by this script"
                                                                                                                            echo "It can be removed if not used"
                                                                                                                        }
                                                                                                                        exit
                                                                                                                    }
                                                                                                                    $snetcreate='n'
                                                                                                                    $mgmtsnet=Get-AzVirtualNetworkSubnetConfig -Name $mgmtsubnetname -VirtualNetwork $vnet -ev sNetPresent -ea 0
                                                                                                                    if($mgmtsnet.ProvisioningState -ne "Succeeded") {
                                                                                                                        echo "A subnet $mgmtsubnetname with the required configuration $mgmtsnetprefix"
                                                                                                                        echo "Was not found in $vnetname "
                                                                                                                        echo "The instance provisioning will exit if subnet is not created"
                                                                                                                        $snetcreate=Read-Host -Prompt "Do you wish to create it now (y/n)"
                                                                                                                        if($snetcreate -ne 'y' -and $snetcreate -ne 'Y') {
                                                                                                                            echo "You have chosen not to provision the subnet"
                                                                                                                            echo "The script will exit now"
                                                                                                                            echo "Please make sure all prerequisites are met and "
                                                                                                                            echo "execute the script to provision the instance"
                                                                                                                            if($rgcreatechoice -eq 'y' -or $rgcreatechoice -eq 'Y' ){
                                                                                                                                echo "Resource group $rgname was provisioned in $location "
                                                                                                                                echo "It can be removed if not in use"
                                                                                                                            }
                                                                                                                            if($storecreatechoice -eq 'y' -or $storecreatechoice -eq 'Y'){
                                                                                                                                echo "Storage account $storename was provisoned by this script"
                                                                                                                                echo "It can be removed if not used"
                                                                                                                            }
                                                                                                                            exit
                                                                                                                        }
                                                                                                                        $mgmtsnet=New-AzVirtualNetworkSubnetConfig -Name $subnetname -AddressPrefix $snetprefix -ev sNetCreate -ea 0
                                                                                                                        Set-AzVirtualNetworkSubnetConfig -Name $mgmtsubnetname -VirtualNetwork $vnet -ev sNetAssign -ea 0
                                                                                                                    }
                                                                                                                    $svcsnet=Get-AzVirtualNetworkSubnetConfig -Name $svcsubnetname -VirtualNetwork $vnet -ev sNetPresent -ea 0
                                                                                                                    if($svcsnet.ProvisioningState -ne "Succeeded") {
                                                                                                                        echo "A subnet $svcsubnetname with the required configuration $svcsnetprefix"
                                                                                                                        echo "Was not found in $vnetname "
                                                                                                                        echo "The instance provisioning will exit if subnet is not created"
                                                                                                                        $snetcreate='n'
                                                                                                                        $snetcreate=Read-Host -Prompt "Do you wish to create it now (y/n)"
                                                                                                                        if($snetcreate -ne 'y' -and $snetcreate -ne 'Y') {
                                                                                                                            echo "You have chosen not to provision the subnet"
                                                                                                                            echo "The script will exit now"
                                                                                                                            echo "Please make sure all prerequisites are met and "
                                                                                                                            echo "execute the script to provision the instance"
                                                                                                                            if($rgcreatechoice -eq 'y' -or $rgcreatechoice -eq 'Y' ){
                                                                                                                                echo "Resource group $rgname was provisioned in $location "
                                                                                                                                echo "It can be removed if not in use"
                                                                                                                            }
                                                                                                                            if($storecreatechoice -eq 'y' -or $storecreatechoice -eq 'Y'){
                                                                                                                                echo "Storage account $storename was provisoned by this script"
                                                                                                                                echo "It can be removed if not used"
                                                                                                                            }
                                                                                                                            exit
                                                                                                                        }
                                                                                                                        $svcsnet=New-AzVirtualNetworkSubnetConfig -Name $svcsubnetname -AddressPrefix $svcsnetprefix -ev sNetCreate -ea 0
                                                                                                                        Set-AzVirtualNetworkSubnetConfig -Name $svcsubnetname -VirtualNetwork $vnet -ev sNetAssign -ea 0
                                                                                                                    }
                                                                                                                    if(($mgmtsnet.ProvisioningState -ne "Succeeded") -or ($svcsnet.ProvisioningState -ne "Succeeded")){
                                                                                                                        echo "Subnet provisioning failed"
                                                                                                                        echo "Deployment cannot continue"
                                                                                                                        if($rgcreatechoice -eq 'y' -or $rgcreatechoice -eq 'Y' ){
                                                                                                                            echo "Resource group $rgname was provisioned in $location "
                                                                                                                            echo "It can be removed if not in use"
                                                                                                                        }
                                                                                                                        if($storecreatechoice -eq 'y' -or $storecreatechoice -eq 'Y'){
                                                                                                                            echo "Storage account $storename was provisoned by this script"
                                                                                                                            echo "It can be removed if not used"
                                                                                                                        }
                                                                                                                        exit
                                                                                                                    }
                                                                                                                    if($sanityrun -eq 'y'){
                                                                                                                        Write-Host "Exiting sanity check" -Foreground Green 
                                                                                                                        exit
                                                                                                                    }
                                                                                                                    #Start creation of the VM object
                                                                                                                    echo "Creating the vm object...."
                                                                                                                    #$cred=Get-Credential
                                                                                                                    if($avcheck -eq "Yes") {
                                                                                                                        $vm = New-AzVMConfig -VMName $name -VMSize $vmsize -AvailabilitySetId $avset.Id
                                                                                                                    }else
                                                                                                                    {
                                                                                                                       $vm = New-AzVMConfig -VMName $name -VMSize $vmsize
                                                                                                                    }
                                                                                                                    #$vm = Set-AzureRmVMOperatingSystem -VM $vm -Linux -ComputerName $name -Credential $cred
                                                                                                                    #Create interfaces and ip objects as per config file
                                                                                                                    $nics=@()
                                                                                                                    $pip=@()
                                                                                                                    $pipopt='n'
                                                                                                                    echo "Do you wish to allocate public ip address to the instance"
                                                                                                                    $pipopt=Read-Host -Prompt "Enter y or n to proceed"
                                                                                                                    echo "Generating interface configuration and attaching ip addresses...."
                                                                                                                    if($pipopt -eq 'y' -or $pipopt -eq 'Y'){
                                                                                                                        for($i=0; $i -lt $niccount ; $i++) {
                                                                                                                                $pip=New-AzPublicIpAddress -Name $ipnames[$i] -ResourceGroupName $rgname -Location $location -AllocationMethod Dynamic
                                                                                                                                #$nic=New-AzureRmNetworkInterface -Name $nicnames[$i] -ResourceGroupName $rgname -Location $location -SubnetId $svcsnet.Id -PublicIpAddressId $pip.Id
                                                                                                                                if($i -eq 0) {
                                                                                                                                    $nic=New-AzNetworkInterface -Name $nicnames[$i] -ResourceGroupName $rgname -Location $location -SubnetId $mgmtsnet.Id -PublicIpAddressId $pip.Id
                                                                                                                                    $vm = Add-AzVMNetworkInterface -VM $vm -Id $nic.Id -Primary
                                                                                                                                }else
                                                                                                                                {
                                                                                                                                    $nic=New-AzNetworkInterface -Name $nicnames[$i] -ResourceGroupName $rgname -Location $location -SubnetId $svcsnet.Id -PublicIpAddressId $pip.Id
                                                                                                                                }
                                                                                                                                $vm = Add-AzVMNetworkInterface -VM $vm -Id $nic.Id
                                                                                                                                echo "Nics = $nics"
                                                                                                                            }
                                                                                                                    }
                                                                                                                    else {
                                                                                                                        for($i=0; $i -lt $niccount ; $i++) {
                                                                                                                            
                                                                                                                            if($i -eq 0) {
                                                                                                                                $nic=New-AzNetworkInterface -Name $nicnames[$i] -ResourceGroupName $rgname -Location $location -SubnetId $mgmtsnet.Id
                                                                                                                                $vm = Add-AzVMNetworkInterface -VM $vm -Id $nic.Id -Primary
                                                                                                                            }
                                                                                                                            else
                                                                                                                            {
                                                                                                                                $nic=New-AzNetworkInterface -Name $nicnames[$i] -ResourceGroupName $rgname -Location $location -SubnetId $svcsnet.Id
                                                                                                                            }
                                                                                                                            $vm = Add-AzVMNetworkInterface -VM $vm -Id $nic.Id
                                                                                                                            echo "Nics = $nics"
                                                                                                                        }
                                                                                                                    }
                                                                                                                    #Setting up disks for the VM
                                                                                                                    clear
                                                                                                                    echo "Setting up the disks."
                                                                                                                    $osdiskname=$name+"_"+"osdisk.vhd"
                                                                                                                    $blob="$dstStorageURI/$dstContainer"
                                                                                                                    $osDiskUri = "$blob/$osdiskname"
                                                                                                                    $osimageUri = "$osimage"
                                                                                                                    echo "Disk info for the VM "
                                                                                                                    echo "OS Disk : $osdiskname"
                                                                                                                    echo "Blob : $blob"
                                                                                                                    echo "OS disk URI : $osDiskUri"
                                                                                                                    sleep 10
                                                                                                                    clear
                                                                                                                    echo "Copying disks to the path"
                                                                                                                    $storecontext=$store.Context
                                                                                                                    Start-AzStorageBlobCopy -AbsoluteUri $osimageUri -Context $storecontext -DestContainer $dstContainer -DestBlob $osdiskname
                                                                                                                    $osstatus=Get-AzStorageBlobCopyState -Context $storecontext -Blob $osdiskname -Container $dstContainer
                                                                                                                    While($osstatus.Status -ne "Success") {
                                                                                                                        sleep 20
                                                                                                                        $osstatus=Get-AzStorageBlobCopyState -Context $storecontext -Blob $osdiskname -Container $dstContainer
                                                                                                                        if($osstatus.Status -ne "Pending") {
                                                                                                                            Break
                                                                                                                        }
                                                                                                                    }
                                                                                                                    $vm=Set-AzVMOSDisk -VM $vm -Name $osdiskname -VhdUri $osDiskUri -CreateOption Attach -Linux
                                                                                                                    #Create the azure Virtual machine
                                                                                                                    clear
                                                                                                                    echo "Disk setup completed, vm object generated succesfully. Creating the instance."
                                                                                                                    New-AzVM -ResourceGroupName $rgname -Location $location -VM $vm -Verbose
                                                                                                                    
        Close
    3. In the pop-up window, enter your Azure credentials to run the script.

    4. After completing the previous steps, verify that you have the following resources:

      • A clone of the two VHD files in the destination container.
      • Two public IPs.
      • Two NICs.
      • A VNet/Subnet.
      • A network security group.
      • Virtual Service Edge VM.

    5. Manually configure the network security groups' settings. By default, the script creates the outbound connection rules to any IP address. You can find more details about the outbound connection requirements at https://config.zscaler.com/<zscaler cloud name>/zia-v-sedge. The <zscaler cloud name> can be found in the URL you use to log in to the ZIA Admin Portal. For example, if you log in to admin.zscaler.net, then go to https://config.zscaler.com/zscaler.net/zia-v-sedge. To connect to your instance via SSH, you're required to open port 22 for inbound connections. In production, you should authorize only a specific IP address or a range of IP addresses to access your instance and not use 0.0.0.0. If you use a NAT gateway, you can disassociate and delete the two public IP addresses.

    6. Ensure that the deployment script completes the following:
      1. Optionally, creates 2 public IP addresses.
      2. Associates the VM to an existing/new virtual network (VNet) and subnet.
      3. Creates and associates a new network security group to the VM.
      4. Copies the OS and data disk VHD files to a final storage account from which the VM is provisioned. If you are using PowerShell, then the script clones the VHD files. This ensures that the original VHD files aren't attached to the VM and can be used to start additional Virtual Service Edge VMs in the future. You can delete the original VHD files, if necessary.
      5. Attaches the OS and data disks to the Virtual Service Edge VM.
      6. Starts the Virtual Service Edge VM.
    Close
  • To associate Virtual Service Edge with Azure LB:

    • To create an Azure LB in the resource group:

      1. In the Azure portal, go to Home > Resource Groups and select your resource group.
      2. Click Add > Add Load Balancer.
        Alternatively, on the Home page, in the Search field, search for the load balancer.
      3. On the Create Load Balancer page:
        • Subscription: Select your subscription.
        • Resource group: Select the resource group in which you want to create the load balancer.
        • Name: Enter a load balancer name.
        • Region: Enter the same region as the Virtual Service Edge.
        • Type: Select either Internal (for private IP) or Public (for public IP) option.
        • SKU: Select the Basic option.
        • Public IP address: Select Create new. If you have an existing Public IP that you would like to use, select Use existing.
        • Public IP address name: Enter a public IP address name.

          The public IP addresses of the VMs should be according to the SKU selection. By default, the VMs are created with the Basic SKU public IP addresses.

        • Assignment: Select Static.
        • Add a public IPv6 address: Select No.
      4. In the Review + create tab, click Create.
      Close
    • To create a backend pool and link Virtual Service Edge VMs to it:

      1. In the load balancer, click Backend pools.
      2. Click Add.

        The Add backend pool page appears.

      3. On the Add backend pool page:
        • Name: Enter a backend pool name.
        • Virtual network: Select the virtual network in which the Virtual Service Edge VMs and load balancers are created.
        • IP version: Select IPv4.
        • Associate to: Select Virtual machine.

          • Virtual Machine: Select the Virtual Service Edge VM that you want to link to the backend pool.
          • IP address: Select the corresponding service IP address.

          You can associate up to 500 virtual machines to a backend pool, provided they are in the same availability set.

      4. Click Add.
      Close
    • To create health probes for ports:

      1. In the load balancer, click Health probes.
      2. Click Add.

        The Add health probe page appears.

      3. On the Add health probe page:
        • Name: Enter a health probe name.
        • Protocol: Select the protocol.
        • Port: Enter the port number that you want to monitor.
        • Interval: Enter the interval in seconds between each probe attempt.
        • Unhealthy threshold: Enter the consecutive number of probe failures that must occur before the Virtual Service Edge VM is considered unhealthy.
      4. Click Ok.
      Close
    • To create load balancing rules:

      1. In the load balancer, click Load balancing rules.
      2. Click Add.

        The Add load balancing rule page appears.

      3. On the Add load balancing rule page:
        • Name: Enter a load balancing rule name.
        • IP Version: Select IPv4.
        • Frontend IP address: Select the load balancer's frontend IP address.
        • Protocol: Select the protocol.
        • Port: Enter the same port number that is exposed in the health probe.
        • Backend port: Enter the same port number that is exposed in the health probe.
        • Backend pool: Select the backend pool.
        • Health probe: Select the health probe.
        • Session persistence: Select a session persistence value based on your requirement. The values can be None, Client IP, or Client IP and protocol.
        • Idle timeout (minutes): Don't make any changes to the default value, 4.
        • Floating IP (direct server return): Don't make any changes to the default value, Disabled.
      4. Click Ok.
      Close
    Close

You can forward the traffic to the Azure LB virtual IP after creating load balancing rules.

Zscaler recommends Azure's best practices for securing VMs.

If you face any issues with Virtual Service Edge, you can Troubleshoot Virtual Service Edge.

Related Articles
About Virtual Service EdgesAbout Virtual Service Edge ClustersConfiguring Virtual Service Edge ClustersUsing an External Load Balancer for Virtual Service Edge ClustersConfiguring Virtual Service Edge for Microsoft AzureConfiguring Virtual Service Edge for Amazon Web ServicesConfiguring Virtual Service Edge for Amazon Web Services with GWLBConfiguring Virtual Service Edge for Microsoft Hyper-VConfiguring Virtual Service Edge for Google Cloud PlatformAdding Virtual Service Edge InstancesAdding Virtual Service Edge ClustersDownloading a Virtual Service Edge VMDownloading Virtual Service Edge CertificatesConfiguring Virtual Service Edge and NTP Server SynchronizationVirtual Service Edge Configuration Guide for Dual Arm ModeDeploying Kerberos for Virtual Service EdgesForwarding Traffic to Virtual Service Edges