This README serves as a quick start guide to deploy Zscaler Branch Connector resources in a Linux KVM environment using Terraform. To learn more about the resources created when deploying Branch Connector with Terraform, see Deployment Templates for Zscaler Branch Connector. These deployment templates are intended to be fully functional and self service for production use. All modules may also be utilized as design recommendation based on the Zscaler Zero Trust SD-WAN Datasheet.
Use this repository to create the deployment resources required to deploy and operate Branch Connector in an existing Linux KVM environment. The examples directory contains complete automation scripts for all deployment template solutions.
Our Deployment scripts are leveraging Terraform v1.1.9 that includes full binary and provider support for MacOS M1 chips, but any Terraform version 0.13.7 and higher should be generally supported.
- provider registry.terraform.io/providers/dmacvicar/libvirt v0.7.x
- provider registry.terraform.io/hashicorp/random v3.3.x
- provider registry.terraform.io/hashicorp/local v2.2.x
- provider registry.terraform.io/hashicorp/null v3.1.x
- provider registry.terraform.io/providers/zscaler/zpa v2.5.x
- A valid connection URI to connect to the KVM hypervisor. For full more information on connection URI methods, click here.
Note:
On Ubuntu distros SELinux is enforced by qemu even if it is disabled globally, this might cause unexpected Could not open '/var/lib/libvirt/images/<FILE_NAME>': Permission denied errors. Double check that security_driver = "none" is uncommented in /etc/libvirt/qemu.conf and issue sudo systemctl restart libvirt-bin to restart the daemon.
- If executing Terraform via the "zsec" wrapper bash script, it is advised that you run from a MacOS or Linux workstation. Minimum installed application requirements to successfully from the script are:
- bash
- curl
- unzip
Even if you are running Terraform manually, there are still the following local application dependencies for the libvirt Terraform provider: - mkisofs - xsltproc
These can all be installed via your distribution app installer. ie: sudo apt install bash curl unzip mkisofs xsltproc
- A valid Zscaler Branch Connector provisioning URL generated from the Branch Connector Portal
- Zscaler Branch Connector Credentials (api key, username, password)
- Download the Branch Connector qcow2 image file and save to the desired deployment type 'bootstrap' directory.
- A valid Zscaler Private Access subscription and portal access
- Zscaler ZPA API Keys. Details on how to find and generate ZPA API keys can be located here:
- Client ID
- Client Secret
- Customer ID
- (Optional) An existing App Connector Group and Provisioning Key. Otherwise, you can follow the prompts in the examples terraform.tfvars to create a new Connector Group and Provisioning Key
Use the Starter Deployment Template to deploy your Branch Connector in an existing KVM environment.
Use the Starter Deployment Template with App Connector to deploy your combined Branch Connector + App Connector in an existing KVM environment.
Use the Starter Deployment Template with High-Availability to deploy your Branch Connector in an existing KVM environment. This template achieves high availability between two Branch Connectors.
This will deploy both VMs on a single KVM host. For production deployments, it is recommended to deploy VMs on separate physical hypervisor hosts for resiliency.
Use the Starter Deployment Template with App Connector and High-Availability to deploy your combined Branch Connector + App Connector in an existing KVM environment. This template achieves high availability between two Branch Connectors.
This will deploy both VMs on a single KVM host. For production deployments, it is recommended to deploy VMs on separate physical hypervisor hosts for resiliency.