Aller au contenu principal

Zscaler App Connector - Specifications

Architecture​

This VNF deploys the ZPA App Connector (App Connector image) and implements the Cloud Connector function defined by the blueprint. The blueprint supports single and dual deployment modes. The example topology and default blueprint present a single virtual machine.

Flavors​

Available IaaS flavors for the Zscaler App Connector are listed below. Select one during provisioning.

Standard
Small
4 vCPU
8 GB Mem
64 GB Disk
Medium
8 vCPU
16 GB Mem
64 GB Disk

In case of a dual deployment you may select flavors independently for each virtual device that makes up the deployment.

Interfaces​

The diagram above is a simplified view of the topology. It shows one Zscaler App Connector virtual machine with three numbered interfaces. Multiple VLAN sub-interfaces (101–148) are attached to the MPLS-VPN interface; the internal blueprint lists each VLAN individually.

#1 - Internet Interface​

This Internet-facing interface receives a Public IP address that the platform allocates and displays as a provisioning output. The Public IP is informational and is not entered by the customer during creation.

  • Customer action: none to provide the Public IP. Inspect the allocated address after provisioning.

#2 - Management interface​

This interface is used for management traffic. The platform allocates and displays a Management IP address as a provisioning output.

  • Customer action: none to provide the Management IP. Inspect the allocated address after provisioning.

#3 - MPLS-VPN interface (with VLAN sub-interfaces)​

This interface connects to the MPLS-VPN using multiple VLAN sub-interfaces. For each VLAN sub-interface you configure in the portal, the following customer-facing fields or groups are available:

  • VPN list (per VLAN sub-interface) — Add one or more VPN entries (minimum 1, maximum 99). Each entry identifies a VPN to associate with the VLAN sub-interface.
    • VPN Name — Alphanumeric string; allowed characters: letters, digits, hyphen and underscore.
    • VPN role — Choose one of: any-to-any, client, server.
  • Enable BGP (optional) — Toggle to enable BGP configuration for the VLAN sub-interface. Default is disabled.
  • AS prepend (optional) — When BGP is enabled and applicable, provide an integer between 1 and 6 to configure AS path prepend behavior for the VM AS. The specification does not describe routing exchange or automatic failover behavior.
  • Optional addressing fields — Subnet, Gateway address, Service Address and Subnet mask fields are available if your IPAM or network design requires them. These fields are optional in the blueprint.

Do not assume additional routing, peering or failover behaviors from these fields beyond their documented purpose.

Routing and BGP parameters​

BGP is an optional, per-VLAN-sub-interface setting. Key points:

  • Enable BGP is optional and updatable on each VLAN sub-interface; the blueprint marks the default as disabled.
  • AS prepend is an optional integer between 1 and 6. Provide this only when BGP is enabled and you require AS path prepend behavior.

If BGP is not enabled for a sub-interface, the blueprint does not apply BGP-specific configuration through this setting. The specification does not describe which routes are exchanged or any routing failover logic.

Virtual machine configuration​

The deployed VNF is presented as a virtual machine. Important VM-level parameters:

  • VM AS number — Mandatory. Provide an Autonomous System number (2- or 4-byte allowed). The value must be an integer within the range supported by the platform. This value is requested during provisioning and is used if you enable BGP.
  • Software image — Select the exact image referenced by the blueprint: ubuntu-22.04.5-server-cloudimg-amd64-20251203. Use the exact name shown in the image selector.
  • Flavor — Choose one of the supported flavors: std1.c4 (Small) or std1.c8 (Medium). These map to the sizes shown in the Flavors section.
  • Cloud-init — Cloud-init is generated and managed by the platform for this VNF. Custom user data upload is not supported for this blueprint.

Service specific parameters​

Service-specific parameters are the service-level values required during provisioning. They are not VM image selections, interface IPs or platform-generated outputs — they are customer-provided values used by the provisioning process.

  • ZPA license (provision key)

    • What is it?
      • A vendor-provided provision key or license string required to register the App Connector with Zscaler services.
    • Why the platform needs it:
      • The provisioning process uses this key to associate the deployed App Connector with the customer's ZPA account.
    • Customer action:
      • Provide the ZPA provision key during the Create journey. This field is mandatory and is not updated by the platform.

  • Login user

    • What is it?
      • The name of the administrative user account that will be created on the VNF during provisioning.
    • Why the platform needs it:
      • The cloud-init provisioning template creates this user so the VM has a local administrative account.
    • Customer action:
      • Enter the login user name during provisioning. This value is mandatory and not updatable in the blueprint.

  • user password

    • What is it?
      • Password for the configured login user.
    • Why the platform needs it:
      • The provisioning process configures the user account with this password as part of initial VM setup.
    • Customer action:
      • Provide the password during provisioning. This value is mandatory and not updated by the platform.

  • Root password

    • What is it?
      • The initial root account password for the VM image.
    • Why the platform needs it:
      • The cloud-init template sets the root password when initialising the VM image.
    • Customer action:
      • Provide the root password during provisioning. This value is mandatory and not updatable in the blueprint.

All service-specific parameters above are required by the blueprint at provisioning time.

Platform-generated outputs​

The platform allocates and returns informational addresses after provisioning. These are shown in the deployment results and are not customer-provided inputs.

  • Public IP address (platform-generated) — Shown for #1 - Internet Interface after provisioning. Inspect the deployment results to find the allocated address.
  • Management IP address (platform-generated) — Shown for #2 - Management interface after provisioning. Inspect the deployment results to find the allocated address.

Do not interpret these outputs as indicating peering, upstream routing or automatic configuration beyond allocation and display by the platform.

Software device versions​

Below are the software image versions referenced by the blueprint. Select the exact image name when creating the VNF.

  • 22.04

Licence​

The service requires a ZPA provision key (ZPA license) provided by the customer. The blueprint expects a provision key supplied during provisioning rather than an automatically provided license.

Zscaler Cloud & Branch Connector Help - Cloud Connector overview and configuration
Step-by-Step Configuration Guide for Zscaler Cloud Connector
Deploying Zscaler Cloud Connector with Amazon Web Services