Cisco Secure Access Help

Deploy Virtual Appliances

Updated: August 24, 2026

Want to summarize with AI?

Describes Deploy Virtual Appliances in Cisco Secure Access. Secure Access requires that you deploy two Virtual Appliances (VAs) for a given site.

Secure Access requires that you deploy two Virtual Appliances (VAs) for a given site. It is critical that these VAs are not cloned or copied in any way.

Guidelines

Set up and configure your virtual appliances manually. Do not copy or clone your virtual appliances.
Cloning your virtual appliances may disrupt syncs with Secure Access if you have to restore the VAs.
VAs do not cache any data that would require backing up. Deploy two VAs on a site in order to avoid downtime if one of the VAs is not available.
You should understand how to deploy a virtual machine in your environments.

Deploy the Secure Access Virtual Appliances

Choose a deployment procedure based on your OS and software:

Deploy VAs in Hyper-V for Windows 2012 or Higher

Deploy Cisco Secure Access Virtual Appliances in Microsoft Hyper-V for Windows Server 2012 or higher.

Note
You must deploy at least two Virtual Appliances (VAs) in a Secure Access Site. It is critical that these VAs are not cloned or copied in any way. Configure and set up each VA manually.

Prerequisites

Full Admin user role. For more information, see Manage Accounts.
For information about the network requirements for deploying VAs, see Prerequisites for Virtual Appliances.
One of the following Windows Server operating systems:
- Windows Server 2012, SP1, or R2 (Standard or Datacenter), 2016 or 2019 with Hyper-V role.
- Hyper-V Server 2012, 2012 R2, 2016 or 2019.
Basic knowledge of Hyper-V.

Note
Secure Access does not support Virtual Appliances that are deployed using System Center Virtual Machine Manager (SCVMM).

Configure Authentication for the Virtual Appliances

Before you can download the Virtual Appliance images in Secure Access, you must configure your Secure Access API keys for the Virtual Appliances in your organization. Secure Access enables the Download Components only after the API keys for the VAs are configured. For more information, see Configure Authentication for Virtual Appliances.

Procedure for Deploying VAs in Hyper-V for Windows 2012 or Higher

Step 1 – Download and Extract the Hyper-V Installer

Procedure

Navigate to Connect > DNS Forwarders and click Download Components.
Click Download next to VA for Hyper-V.
Secure Access generates and downloads a tar file unique to your deployment.

This tar file includes:
- a zip file containing the virtual hard disks that need to be deployed on Hyper-V
- a signature file
- a Cisco public certificate to validate the signature
- a readme file
Extract the contents of the tar file using the command tar –xvf <tar filename> -C <Destination folder>.

To verify the integrity of the downloaded file, validate the signature by following the instructions provided in the readme file. When successful, you will see a message saying “Verified OK."
Extract the .zip file. You'll find two folders—Virtual Hard Disks and Virtual Machines—and a config file.

Step 2 – Import the Virtual Appliance

Tip
Using Windows 2012 R2 or Higher Versions
Microsoft has introduced a "Generation 2" style of VM profile on Hyper-V for Windows 2012 R2 and higher versions. As a result, the import steps below will fail with the error: "Hyper-V did not find virtual machines to import from location [path]"

You will need to create a new virtual machine as "Generation 1", then skip to 3. Copy and Rename Image Files.

For more information about Generation 1 vs. Generation 2, see Generation 2 Virtual Machine Overview.

Note
Step 2 in this procedure applies to Windows 2012 only, and not Windows 2012 R2.

Procedure

Select your Hyper-V server, right-click its name and select Import Virtual Machine from the menu.
Navigate to the extraction folder from your download, select that folder to import, and then click Next.
Select forwarder-va as the virtual machine to import and click Next.
Select Copy the virtual machine (create a new unique ID) and click Next.
Choose destination folders to install to. By default, these are the Hyper-V Configuration folders, but you can choose another folder.

Note
If selecting a different folder, pick a drive with sufficient space and create a folder with a specific name for the virtual machine, such as \opendnsforwarder-1. This can be helpful to ensure you're able to distinguish between the two virtual appliances in your file structure.
Click Finish.

Step 3 – Copy and Rename Image Files

Procedure

In Windows Explorer, navigate to the \Virtual Hard Disks subfolder within the extracted download folder created in Step 1.
Copy the two files from that location to the Virtual Machine Configuration Folder you specified in the previous step.
The two files, dynamic and forwarder-va. must be renamed per the VA that is being installed. For example, rename:

dynamic to Dynamic-VA-1

and

forwarder-va to Forwarder-VA-1

If configuring your second VA, change the number accordingly. This can help ease the management of multiple virtual appliances and avoids conflicts between filenames when configuring your second VA.

Step 4 – Select Network Adapter

Procedure

In the Hyper-V Manager, select the virtual machine you've created, right-click and choose Settings.
Under Hardware, select Network Adapter, and then assign a virtual switch that has internet access.

Step 5 – Select Hard Drive

Procedure

In Settings for Hardware, select the hard drives.

Ideally, they should be under the same IDE controller. For hard drive settings, browse to the Virtual Machine Configuration Folder and the first hard drive should be set to the forwarder file (Forwarder-va) and the second hard drive should be set to the dynamic (Dynamic) file.
Click Apply.

Step 6 – Power on the Virtual Machine

If all is well, you'll see the Virtual Appliance console screen. For information about configuring VAs, see Configure Virtual Appliances.

Powering on the virtual machine in the Virtual Appliance console

Step 7 – Repeat for the Second Virtual Appliance

Two VAs are required per Umbrella site. It is critical that these VAs are not cloned or copied in any way. Each VA must be set up and configured manually.

To build your second VA, repeat procedures starting at 2. Import Virtual Appliance.

Deploy VAs in VMware

Deploy Cisco Secure Access Virtual Appliances (VAs) in VMware.

Note
You must deploy at least two Virtual Appliances (VAs) in a Secure Access Site. It is critical that these VAs are not cloned or copied in any way. Configure and set up each VA manually.

Prerequisites

Full Admin user role. For more information, see Manage Accounts.
For information about the network requirements for deploying VAs, see Prerequisites for Virtual Appliances.
Basic knowledge of VMware ESXi. For more information, see the VMware documentation.

Configure Authentication for the Virtual Appliances

Before you can download the Virtual Appliance images in Secure Access, you must configure your Secure Access API keys for the Virtual Appliances in your organization. Secure Access enables the Download Components button only after the API keys for the VAs are configured. For more information, see Configure Authentication for Virtual Appliances.

Procedure for Deploying VAs in VMware

Step 1 – Download OVF Template

Procedure

Navigate to Connect > DNS Forwarders and click Download Components.
Click Download next to VA for VMWare ESXi.
Umbrella generates and downloads a .tar file unique to your deployment.

This tar file includes:
- an .ovf template containing the virtual hard disks that need to be deployed on VMware
- a signature file
- a Cisco public certificate to validate the signature
- a readme file
Extract the contents of the tar file using the command tar –xvf <tar filename> -C <Destination folder>.

To verify the integrity of the downloaded file, validate the signature by following the instructions provided in the readme file. On successful signature validation, you should see a message saying “Verified OK."

Step 2 – Deploy OVF Template

Procedure

Log into your VMware vSphere client and select the File tab.
Click Deploy OVF Template, choosing the downloaded .ova template.
Follow the deployment wizard prompts, but be sure to follow these steps:
- For the source, browse to the .ova file you just downloaded.
- Specify a unique name and location for your VA.
Select the disks appropriate to your environment. It is recommended to select Thin Provision for the disk format, but it is not mandatory.
Select or map a network.
Click Finish.

The system begins to deploy the VA. During the deployment, subsequent prompts update you about the status of the deployment.

Step 3 – Deploy a Second Virtual Appliance

While the first VA is deploying, repeat the previous two steps to configure your second VA.

Note
Two VAs are required per Umbrella site. It is critical that these VAs are not cloned or copied in any way. Each VA must be set up and configured manually.

Step 4 – Power on the Virtual Machines

If the deployment succeeded, you'll see the VA console screen. For information about configuring VAs, see Configure Virtual Appliances.

Deploy VAs in Microsoft Azure

Deploy Cisco Secure Access Virtual Appliances (VAs) in Microsoft Azure.

Note
You must deploy at least two Virtual Appliances (VAs) in a Secure Access Site. It is critical that these VAs are not cloned or copied in any way. Configure and set up each VA manually.

Prerequisites

Full Admin user role. For more information, see Manage Accounts.
For information about the network requirements for deploying VAs, see Prerequisites for Virtual Appliances.
If you use the VA on Azure as a DNS server for your on-premise endpoints, then DNS traffic from these endpoints should not traverse through a Network Address Translation (NAT) device en route to the VA. The VA should receive DNS packets with the source IP as the internal IP of the endpoints. An ExpressRoute or dedicated MPLS or site-to-site VPN connection from your on-premise environment to Azure will meet this requirement.
A system running Windows 10 with the Hyper-V role enabled to convert VHD images to an Azure-acceptable format.
Only VAs running version 2.4 or above can be deployed in Microsoft Azure.

Configure Authentication for the Virtual Appliances

Before you can download the Virtual Appliance images in Secure Access, you must configure your Secure Access API keys for the Virtual Appliances in your organization. Secure Access enables the Download Components button only after the API keys for the VAs are configured. For more information, see Configure Authentication for Virtual Appliances.

Procedure for Deploying VAs in Microsoft Azure

Before you begin

Add internal.cloudapp.net to the internal domains list for VAs.
Unless you are using your own DNS server in Azure, you should configure 168.63.129.16 as the local DNS server in the VA settings. This is the virtual IP used by Azure for recursive and local DNS queries.

Procedure

Step 1 – Prepare the Virtual Appliance Image on Azure. This is a one time task.
Step 2 – Launch the Virtual Appliance on Azure. Perform this task for each VA after you have performed the one-time task of preparing the VA image.

Step 1 – Prepare the Virtual Appliance Image on Azure

This is a one-time task to create an image in Azure that can be used to launch multiple VAs.

Note
Generation 2 VMs are not supported for VA deployments.

Procedure

Navigate to Connectors > DNS Forwarders and click Download Components.
Click Download next to VA for Hyper-V.
Umbrella generates and downloads to your computer a .tar file unique to your deployment.

This tar file includes:
- a .zip file containing the virtual hard disks that need to be deployed on Azure
- a signature file
- a Cisco public certificate to validate the signature
- a readme file
Extract the contents of the tar file using the command tar –xvf <tar filename> -C <Destination folder>.

To verify the integrity of the downloaded file, validate the signature by following the instructions provided in the readme file. On successful signature validation, you should see a message saying “Verified OK."
Extract the downloaded zip file. You'll find two folders—Virtual Hard Disks and Virtual Machines—and a config file.
Open Windows PowerShell as Administrator, navigate to the Virtual Hard Disks folder, and convert the vhd files (forwarder and dynamic) in their respective folders to a fixed type format acceptable by Azure.
To convert and resize the forwarder file, run the following commands:
```
Convert-VHD -Path .\forwarder-va.vhd -DestinationPath forwarder-fixed.vhd -VHDType fixed
Resize-VHD .\forwarder-fixed.vhd  -SizeBytes 8GB
```
To convert and resize the dynamic file, run the following commands:
```
Convert-VHD -Path .\dynamic.vhd -DestinationPath dynamic-fixed.vhd -VHDType fixed
Resize-VHD .\dynamic-fixed.vhd -SizeBytes 30MB
```
Conversion free disk space requirements
Conversion requires at least 9GB of free disk space to create the modified disks. The new forwarder-fixed.vhd will consume approximately 8GB of space. Machines with less than 9GB of space will fail to convert with a red error message.
Upload the forwarder-fixed.vhd and dynamic-fixed.vhd to a blob in your Azure storage account using the Azure portal or the AZ CLI.

Note
This is a one-time upload.
Create an image in Azure from these virtual hard disks using the Azure portal.

Use the forwarder-fixed.vhd as the OS disk (OS type: Linux) and the dynamic-fixed.vhd as the data disk.

Note
Ensure that Host caching for both the OS disk and data disk is set to Read/write. Since second generation VMs are not supported for VA deployments, ensure that you set VM Generation to Gen 1.
Once the VA image is created in Azure, use this image to launch multiple VAs. For more information, see Step 2: Launch the Virtual Appliance on Azure.

Step 2 – Launch the Virtual Appliance on Azure

Note
Before performing this task, you must complete the one-time task of preparing the virtual appliance image on Azure. For more information, see Step 1: Prepare the Virtual Appliance Image on Azure.

Procedure

Use the Azure portal to launch Secure Access VAs in Azure using the VA image you created in Step 1: Prepare the Virtual Appliance Image on Azure:
- Choose a VM size with at least one VCPU and 1024 MB RAM.
  Note
  VM sizes above eight VCPUs are not supported.
- For the Administrator account, set the Authentication type to Password.
  Note
  It is a security risk to specify a public IP address for the VA, and is not recommended except in case of SNAT port exhaustion issues. If you need to configure a public IP for the VA on Azure for these issues, ensure that inbound access from the Internet is not permitted. For more information, see Troubleshoot Intermittent DNS Resolution Failures on a VA Deployed in Azure.
- Provide the username as vmadmin and enter a password that meets complexity requirements.
  Note
  The admin-password you create here is not actually set on the VA.

You may also use the Azure Cloud Shell to launch VAs in Azure using the VA images you created in Step 1: Prepare the Virtual Appliance Image on Azure. VM sizes above eight VCPUs are not supported.

You may specify the static IP as part of the command. For example:

az vm create --resource-group MyResourceGroup --size Standard_B2s --name UmbrellaVA                
  --image VAImage --authentication-type password --admin-username vmadmin                               
  --admin-password <password> --vnet-name MyVnet --subnet MySubnet                                             
  --private-ip-address 10.0.0.1

In Secure Access, navigate to Connector > DNS Forwarders. Secure Access displays your list of deployed VAs.
Use the same image to launch multiple VAs as required. Provide a different name and different static IP for each VA.

Note
If you do not specify the private IP address, the VA will automatically pull a DHCP IP and register to Umbrella with this IP address. This IP address will be listed as the VA name in Secure Access.

What to do next

Tip
Diagnostic Settings
It is not recommended to turn on Diagnostic Settings (Guest-level monitoring) or install any extension for a VA on Azure. Enabling diagnostics results in huge log files being generated on the VA, which causes the VA to run out of disk space.

If your VA on Azure is reporting disk space issues, navigate to the Settings > Extensions page against your VA on the Azure portal and remove any extensions. Also, navigate to the Monitoring > Diagnostic Settings page against your VA on the Azure portal and verify that Guest-level monitoring is turned off.

Deploy VAs in Amazon Web Services

Deploy Cisco Secure Access Virtual Appliances (VAs) in Amazon Web Services.

Note
You must deploy at least two Virtual Appliances (VAs) in a Secure Access Site. It is critical that these VAs are not cloned or copied in any way. Configure and set up each VA manually.

Prerequisites

Full Admin user role. For more information, see Manage Accounts.
For information about the network requirements for deploying VAs, see Prerequisites for Virtual Appliances.
If you are using the VA on Amazon Web Services as a DNS server for your on-premise endpoints, then DNS traffic from these endpoints should not traverse through a Network Address Translation (NAT) device en route to the VA. The VA should receive DNS packets with the source IP as the internal IP of the endpoints. An AWS Direct Connect or dedicated MPLS or VPN connection from your on-premise environment to AWS will meet this requirement.
Only VAs running version 2.6 or above can be deployed in AWS.

Configure Authentication for the Virtual Appliances

Before you can download the Virtual Appliance images in Secure Access, you must configure your Secure Access API keys for the Virtual Appliances in your organization. Secure Access enables the Download Components button only after the API keys for the VAs are configured. For more information, see Configure Authentication for Virtual Appliances.

Procedure for Deploying VAs in Amazon Web Services

Prepare the Virtual Appliance Amazon Machine Image. This is a one time task.
Launch the Virtual Appliance on Amazon Web Services. Perform this task for each VA after you have performed the one-time task of preparing the VA image.

Step 1 – Prepare the Virtual Appliance Amazon Machine Image

Note
This is a one-time task to create an Amazon Machine Image (AMI) that can be used to launch multiple VAs.

Procedure

Navigate to Connect > DNS Forwarders and click Download Components.
Click Download for VA for Hyper-V.
Secure Access generates and downloads a .tar file to your computer unique to your deployment.

This .tar file includes:
- a .zip file containing the virtual hard disks that need to be deployed on AWS
- a signature file
- a Cisco public certificate to validate the signature
- a readme file
Extract the contents of the tar file using the command tar –xvf <tar filename> -C <Destination folder>.

To verify the integrity of the downloaded file, validate the signature by following the instructions provided in the readme file. On successful signature validation, you see a message saying “Verified OK.“
Extract the .zip file. You'll find two folders—Virtual Hard Disks and Virtual Machines—and a config file.
Follow the steps provided by AWS to (optionally) create an S3 bucket and to create the vmimport service role.
Upload the downloaded vhd files (forwarder-va.vhd and dynamic.vhd) to the S3 bucket.

This should be the same S3 bucket as specified in the role-policy.json file.
Use the AWS CLI to import the image.
Create a file locally named "containers.json" for importing the image. The following is an example of a containers.json file. Specify the S3 bucket where you have saved the vhd images in this file.
```
\[
  {
    "Description": "Forwarder",
    "Format": "vhd",
    "UserBucket": {
        "S3Bucket": "va-vhd-bucket",
        "S3Key": "forwarder-va.vhd"
    }
  },          
  {
    "Description": "Dynamic",
    "Format": "vhd",
    "UserBucket": {
        "S3Bucket": "va-vhd-bucket",
        "S3Key": "dynamic.vhd"
    }
  }
\]
```
You must use the .vhd files to create the Amazon Machine Image and not the .ova file. Creating the AMI using the .ova file will result in the VA not being able to register to Umbrella.
Use the AWS CLI command import-image to create import tasks:

aws ec2 import-image --description "Umbrella VA" --license-type BYOL --disk-containers "file://containers.json"
Note the AMI ID and verify that the import has been completed through the describe-import-image-tasks command:

aws ec2 describe-import-image-tasks --import-task-ids <AMI ID>
Once the VA Amazon Machine Image is created, use this image to launch multiple VAs. For more information, see Step 2. Launch the Virtual Appliance on Amazon Web Services.

Step 2 – Launch the Virtual Appliance on Amazon Web Services

Note
Before performing this task, you must complete the one-time task of preparing the virtual appliance image on AWS.

Tip
Nitro based instance types and instance types that enable the Elastic Networking Adapter (ENA) are currently not supported. Refer to AWS documentation to determine if the instance type is Nitro based or uses ENA.

Procedure

Use the AWS console to launch Secure Access VA instances in AWS using the VA image you created in Step 1. Prepare the Virtual Appliance Image on Amazon Web Services. Choose a VM size with at least 1 VCPU and 1 GB RAM.

Note
Specifying a public IP address for the VA is a security risk and is not a supported configuration.
In Secure Access, navigate to Connectors > DNS Forwarders.

You should see the VA listed here with the dynamic IP address as its name.

You can now configure the VA. For more information and the procedure, see Enter Configuration Mode on a VA Deployed in Azure, AWS, or Google Cloud Platform.

Tip
Route 53 Resolver can also be used to apply network-level protection to your AWS workloads. See How to Point AWS to Umbrella with New Route 53 Feature for more information.
For a VA deployed on AWS, in addition to configuring the IP of the VA via the VA command line, you will also need to assign this IP to the VA instance through the AWS console. If this IP is different from the DHCP IP assigned by AWS, you can add it as the secondary IP for the instance.

Deploy VAs in Google Cloud Platform

Deploy Cisco Secure Access Virtual Appliances (VAs) in Google Cloud Platform.

Note
You must deploy at least two Virtual Appliances (VAs) in a Secure Access Site. It is critical that these VAs are not cloned or copied in any way. Configure and set up each VA manually.

Prerequisites

Full Admin user role. For more information, see Manage Accounts.
For information about the network requirements for deploying VAs, see Prerequisites for Virtual Appliances.
If you are using the VA on Google Cloud Platform (GCP) as a DNS server for your on-premise endpoints, then DNS traffic from these endpoints should not traverse through a Network Address Translation (NAT) device en route to the VA. The VA should receive DNS packets with the source IP as the internal IP of the endpoints. A Google Cloud Interconnect or dedicated MPLS or site-to-site VPN connection from your on-premise environment to GCP meets this requirement.
A Linux system with the qemu-utils package installed, on which you can run qemu-img and tar commands.
Only VAs running version 2.6 or above can be deployed in GCP.

Configure Authentication for the Virtual Appliances

Before you can download the Virtual Appliance images in Secure Access, you must configure your Secure Access API keys for the Virtual Appliances in your organization. Secure Access enables the Download Components button only after the API keys for the VAs are configured. For more information, see Configure Authentication for Virtual Appliances.

Procedure

Step 1 – Prepare the Virtual Appliance Instance Template on GCP. This is a one time task.
Step 2 - Launch the Virtual Appliance on Google Cloud Platform. Perform this task for each VA after you have performed the one-time task of preparing the VA image.

Step 1 – Prepare the Virtual Appliance Instance Template on GCP

Note
This is a one-time task to create an Instance Template that can be used to launch multiple virtual appliances in GCP.

Procedure

Navigate to Deployments > Configuration > Sites and Active Directory and click Download Components.
Click Download for VA for Hyper-V.
Secure Access generates and downloads a .tar file unique to your deployment.

This .tar file includes:
- .zip file containing the virtual hard disks that need to be deployed on Google Cloud Platform
- Signature file
- Cisco public certificate to validate the signature
- README file
Extract the contents of the tar file using the command tar –xvf <tar filename> -C <Destination folder>.

To verify the integrity of the downloaded file, validate the signature by following the instructions provided in the readme file. When successful, you should see a message saying “Verified OK."
Extract the .zip file. The .zip file contains two folders—Virtual Hard Disks and Virtual Machines—and a config file.

Use the qemu-img convert commands to convert each of the VHD files to RAW format and resize them to a multiple of 1 GB.

qemu-img convert -f vpc -O raw forwarder-va.vhd forwarder-va.raw
qemu-img resize forwarder-va.raw -f raw 7G
qemu-img convert -f raw -O raw dynamic.vhd dynamic.raw
qemu-img resize dynamic.raw -f raw 1G

Tar each raw file.

Note
GCP requires that each file be renamed as disk.raw before you tar it. GCP also requires tar to use the oldgnu format.

mv forwarder-va.raw disk.raw
tar --format=oldgnu -Sczf forwarder-va.tar.gz disk.raw
mv disk.raw forwarder-va.raw
mv dynamic.raw disk.raw
tar --format=oldgnu -Sczf dynamic.tar.gz disk.raw
mv disk.raw dynamic.raw

Create a bucket in GCP Storage Engine or use an existing bucket and then upload both the forwarder-va.tar.gz and dynamic.tar.gz files to this bucket.
Create two images in Google Compute Engine: one with source as the forwarder-va.tar.gz file and the other with source as the dynamic.tar.gz file.

Each image is created with roughly the same size as its respective .tar.gz file (7 GB or 1 GB).
Create an Instance Template in the Google Compute Engine using the forwarder image as the boot image and the dynamic image attached as a data disk.

Choose a machine type with at least 1 vCPU and 1 GB memory.

To select the 'forwarder' image as the boot disk, choose Change on the boot disk, and then choose the forwarder image from the Custom Images category.

Note
Do not click Create.
Click Disks, Add new disk to attach the dynamic disk to the instance template.

You must create a new disk with the source as the 'dynamic' image you created earlier. Failure to do so results in your VA not registering with Umbrella.

Note
Google Cloud does not allow you to create a disk of size less than 10 GB from the dynamic image.
After you have added the new disk created from the dynamic image, you can click on Create to create the VA Instance template.
Once the VA Instance template is created, use this image to launch multiple VAs. For more information, see Step 2. Launch the Virtual Appliance on Google Cloud Platform.

Step 2 – Launch the Virtual Appliance on Google Cloud Platform

Note
Before performing this task, you must complete the one-time task of preparing the virtual appliance instance template

Procedure

Create VA instances based on the template.

The VA will automatically pull a DHCP IP and register to Secure Access with this IP address.

Note
Specifying a public IP address for the VA is a security risk and is not a supported configuration.
In Secure Access, navigate to Connectors > DNS Forwarders.

You should see the VA listed here with the dynamic IP address as its name. You can now configure the VA. For information about configuring VAs, see Configure Virtual Appliances.

Deploy VAs in KVM

Deploy Cisco Secure Access Virtual Appliances (VAs) in KVM.

Note
You must deploy at least two Virtual Appliances (VAs) in a Secure Access Site. It is critical that these VAs are not cloned or copied in any way. Configure and set up each VA manually.

Prerequisites

Full Admin user role. For more information, see Manage Accounts.
For information about the network requirements for deploying VAs, see Prerequisites for Virtual Appliances.
A Linux system with qemu-utils package installed.
Only VAs running 2.5 or above can be deployed in KVM.
Virtual Appliance deployments in KVM are supported with specific Red Hat Linux and Ubuntu Linux versions only.
- KVM on Ubuntu Linux (supported LTS versions)
- KVM on Red Hat Linux (supported versions)

Configure Authentication for the Virtual Appliances

Procedure for Deploying VAs in KVM

Prerequisites

Full Admin user role. For more information, see Manage Accounts.
For information about the network requirements for deploying VAs, see Prerequisites for Virtual Appliances.
A Linux system with qemu-utils package installed.
Only VAs running 2.5 or above can be deployed in KVM.
Virtual Appliance deployments in KVM are supported with specific Red Hat Linux and Ubuntu Linux versions only.
- KVM on Ubuntu Linux (supported LTS versions)
- KVM on Red Hat Linux (supported versions)

To successfully deploy a virtual appliance in a KVM envinronment, follow the steps as they are listed below:

Step 1 – Download and Extract the KVM Installer

Procedure

Navigate to Connect > DNS Forwarders and click Download Components.
Click Download next to VA for KVM.

Secure Access generates and downloads a .tar file unique to your deployment.
This tar file includes:
- A zip file containing the KVM-compatible virtual hard disk images (.qcow2 format) and configuration files
- A signature file
- A Cisco public certificate to validate the signature
- A readme file
Extract the contents of the tar file using the tar –xvf <tar filename> -C <Destination folder> command.
Verify the integrity of the downloaded file by following the signature validation instructions in the readme file. On a successful verification, the message Verified OK is displayed.
Extract the .zip file.

The extracted contents include the Virtual Hard Disks folder, the Virtual Machines folder, and a configuration file.

The Virtual Hard Disks folder contains the KVM-compatible .qcow2 files (namely, dynamic.qcow2 and forwarder-va.qcow2).

Step 2 – Launch the Virtual Appliance on KVM

Procedure

Open the Virtual Machine Manager on your Linux system running KVM and click Create a new virtual machine.
In the first step of the wizard, choose Import existing disk image.
Provide the existing storage path to your forwarder-va.qcow2. Set the OS type to Linux and click Forward.
Set the memory and CPU settings to at least 1 CPU and 1 GB RAM and click Forward.
In the last step of the wizard, select Customize configuration before install and then click Finish.
Select Add Hardware.
Select Storage, add or create custom storage, add the dynamic disk, and then click Finish.

You should then see two disks.
Click Begin installation to create the VA.
If your network supports DHCP, the VA will get auto-configured with a DHCP IP address and will register to Umbrella using this IP. You can configure the VA on KVM through two mechanisms:
- Press Ctrl+B on the VA console and entering the Configuration mode.
  
  Or
- Initiate an SSH connection to the DHCP IP—this IP can be retrieved in Secure Access—and enter Configuration mode.

What to do next

You can now configure the VA. For information about configuring VAs, see Configure Virtual Appliances.

Deploy VAs in Nutanix

Deploy Cisco Secure Access Virtual Appliances in Nutanix.

Note
You must deploy at least two Virtual Appliances (VAs) in a Secure Access Site. It is critical that these VAs are not cloned or copied in any way. Configure and set up each VA manually.

Before you begin

Full Admin user role. For more information, see Manage Accounts.
For information about the network requirements for deploying VAs, see Prerequisites for Virtual Appliances.
Virtual Appliance deployments are supported on the current LTS version of Nutanix AHV only.

Configure Authentication for the Virtual Appliances

Before you can download the Virtual Appliance images in Secure Access, you must configure your Secure Access API keys for the Virtual Appliances in your organization. Secure Access enables the Download Components button only after the API keys for the VAs are configured. For more information, see Configure Authentication for Virtual Appliances.

Procedure

Navigate to Connectors > DNS Forwarders and click Download Components.
Click Download for VA for hyper-V.
1. Secure Access generates and downloads to your computer a .tar file unique to your deployment.
  
  This tar file includes:
  - a .zip file containing the virtual hard disks that need to be deployed on Nutanix
  - a signature file
  - a Cisco public certificate to validate the signature
  - a readme file
Extract the contents of the tar file.
To verify the integrity of the downloaded file, validate the signature by following the instructions provided in the readme file. When successful, a message saying Verified OK will appear.

Run:
```
tar –xvf <tar filename> -C <Destination folder>
```
Extract the downloaded zip file.

You will find two folders—Virtual Hard Disks and Virtual Machines—and a config file. Navigate to the Virtual Hard Disks folder and find the forwarder-va.vhd and dynamic.vhd files.
Log into the Nutanix AHV console, navigate to Settings > Image Configuration, and create two images (VAForwarder and VADynamic) by uploading the forwarder-va.vhd and dynamic.vhd respectively.
Create a new VM with at least 1 VCPU (1 core), 1 GB RAM, and 1 NIC.
Add a new disk using the VAForwarder image. Choose the operation Clone from Image Service and Bus Type as SCSI.
Remove the CD-ROM. Add another disk using the VADynamic image with operation as Clone from Image Service and Bus Type as SCSI.

Note
The disk order is important. The VAForwarder should be Disk 0, the VADynamic should be Disk 1.

You can now power on the VA and configure it using either the console or by initiating an SSH connection to the VA. For information about configuring VAs, see Configure Virtual Appliances.

For more information about how to enhance throughput of the VA on Nutanix, see Enabling RSS Virtio-Net Multi-Queue by Increasing the Number of VNIC Queues.

Deploy VAs in Alibaba Cloud

This guide describes how to deploy Cisco Secure Access Virtual Appliances in the Alibaba Cloud environment.

Note
You must deploy at least two Virtual Appliances (VAs) in a Secure Access Site. It is critical that these VAs are not cloned or copied. Configure and set up each VA manually.

Prerequisites

Full Admin user role. For more information, see Manage Accounts.
For information about the network requirements for deploying VAs, see Prerequisites for Virtual Appliances.
An Alibaba account. Create your account at https://www.alibaba.com/.
A qemu-utils package installed, such as Homebrew, to run the qemu-img and tar commands.
Only VAs running version 3.6.1 or above can be deployed in Alibaba.
An SSH client (for example, PuTTY on Windows or Terminal on Macintosh) to access the VA console.

Configure Authentication for the Virtual Appliances

Procedure

Download and Extract the Hyper-V Installer. This is a one time task.
Alibaba Cloud Setup
Create a Custom Image. Perform this task for each VA after performing the one-time task of preparing the VA images.
Deploy the Secure Access VAs from the Imported Custom Image
First-time Login to Secure Access VA
Related Topics

Download and Extract the Hyper-V Installer

Procedure

Navigate to Connectors > DNS Forwarders and click Download Components.
Click Download for VA for Hyper-V.
Secure Access generates and downloads a tar file unique to your deployment.

This tar file includes:
- a zip file containing the virtual hard disks that need to be deployed on Hyper-V
- a signature file
- a Cisco public certificate to validate the signature
- a readme file
Extract the contents of the tar file using the command tar –xvf <tar filename> -C <Destination folder>.

To verify the integrity of the downloaded file, validate the signature by following the instructions provided in the readme file. When successful, there will be a message saying “Verified OK."
Extract the .zip file. You'll find two folders—Virtual Hard Disks and Virtual Machines—and a config file.
In Windows Explorer, navigate to the Virtual Hard Disks subfolder within the extracted download folder created in Step 1.
Note the two VA files, dynamic and forwarder-va. Convert the forwarder-va.vhd file to .raw format:

qemu-img convert -f vpc -O raw forwarder-va.vhd forwarder-va.raw
Zip the forwarder-va.raw file.

Note
Alibaba only allows for 5Gb uploads.

Alibaba Cloud Setup

This section describes the configuration requirements within Alibaba Cloud to support deploying the Secure Access VA instances to your virtual private cloud (VPC). For more details on setting up a VPC and other components, please refer to Alibaba's Cloud Documentation here.

Create an Alibaba Virtual Private Cloud (VPC)

A virtual private cloud (VPC) is required to deploy your Alibaba Cloud resources, such as Secure Access VAs.

Procedure

Log in to your Alibaba Cloud Account and log on to the VPC console.
In the top navigation bar, select the region where you want to deploy the VPC.

Note
The VPC and the cloud resources that you want to deploy in the VPC must belong to the same region.
On the VPCs page, click Create VPC.
On the Create VPC page, set the required parameters and click OK.

What to do next

To find more information about this, please click here.

Alibaba Cloud page with an option to create a VPC

Create a Bucket for the Secure Access VAs

An Object Storage Service (OSS) bucket is needed. Alibaba OSS is a secure, cost-effective, and highly reliable cloud storage service that allows for the storage of large amounts of data.

Procedure

On the Alibaba Cloud Console home page, select Object Storage Service (OSS).
In the left-side navigation pane, click Buckets. On the Buckets page, click Create Bucket.
In the Create Bucket panel, enter the Bucket Name and Region.

The bucket must be in the same region as the VPC in which the Secure Access VAs are to be deployed. Keep the default settings for other parameters or configure the parameters after the bucket is created.
Click OK.

After the bucket is created, the Created message is displayed.

Configure a ZIP Package Decompression Rule

Alibaba Cloud accepts uploads of objects up to 5 GB in size using the OSS console. Because the Secure Access Forwarder VA is larger than 5 GB, the forwarder-va.vhd file needs to be converted to .raw format and then compressed to a zip file, as described in Download and Extract the Hyper-V Installer.

Procedure

In the left navigation pane of the OSS console, click Buckets. On the Buckets page, find and click the desired bucket.
In the left navigation tree, choose Data Processing > Decompress ZIP Package.
Click Start Activation and follow the prompts.
Once activation is complete, go to the bucket and click Decompress ZIP Package. In the Decompress ZIP Package panel, configure the following parameters:
1. Service Authorization - Authorize Function Compute to read data from and write data to OSS and to execute functions. Click Authorize. Complete authorization on the page that appears.
2. Authorize Trigger - Authorize OSS to access Function Compute. Click Authorize. Complete authorization on the page that appears. If OSS is authorized to access Function Compute, the Trigger Role parameter is displayed instead of the Authorize Trigger parameter.
3. Destination Directory - To store the objects extracted from a ZIP package in a subdirectory that has the same name as the package in the destination directory, select Add the compressed object name to the destination directory.
Click OK.

What to do next

Now that the bucket is created, click Go to Bucket. Alternatively, click Buckets in the left-side navigation pane and click the name of the created bucket.

Upload the Secure Access VHD Images to the OSS Bucket

Upload the Secure Access VHD images that were downloaded in Download and Extract the Hyper-V Installer to your bucket.

Procedure

Select your bucket, choose Files > Upload, and click here to upload.
Select the compressed forwarder-va zip file on your local drive. Wait for the automatic decompression to be triggered before continuing. The forwarder-va.raw file should be seen in the table on the Upload page if it is uploaded successfully.
Select the dynamic.vhd on your local drive. Given the small size of this file, no conversion or compression is required.
The file will be displayed in the table on the Upload page if it is uploaded successfully.
Click View Details, the click Copy File URL. This URL is needed in later steps when creating a custom image.

Create a Custom Image

Procedure

Select the Alibaba Elastic Compute Service (ECS).
Select Instances & Images > Images > Custom Images.
Click Import Image.
Paste the forwarder-va.raw URL in the Import Image window. See Upload the Secure Access VHD Images to the OSS Bucket for where to find the URL.

Note
If the following error is seen, ECS does not have access to the OSS resources. Enable access by clicking the here hyperlink shown.
If necessary, click Confirm Authorization Policy.
Repeat the Import Image action and fill the necessary fields as below.
Check the Configure Disk Attributes box and adjust the Disk SizeGiB setting.

Note
Make sure that the forwarder-va.raw disk size is 6.5 GB.
Repeat for the dynamic.vhd file.

Note
Make sure that the dynamic.vhd disk size is 20 MB.
If the image is successfully created, the following window is shown.
Note that if the forwarder-va.vhd is uploaded instead of .raw image, or if the size is not supported, the following error is shown.

Deploy the Secure Access VAs from the Imported Custom Image

An Elastic Compute Service (ECS) image provides the information that is required to create an ECS instance. An image must be specified when creating an ECS instance. An image is a copy of data from one or more disks. An instance image can contain data from only the system disk or from both the system disk and data disks.

Procedure

Navigate to Elastic Compute Service > Instances. Click Create Instance.
Complete the following Basic Configuration settings:
1. Select the Region and zone. Select a region that is close to your geographical location to reduce latency. After an instance is created, the region and the zone of the instance cannot be changed.
2. Select the Instance type. Different instance types have different CPU, RAM and throughput capacity.
  
  Note
  It is recommended to have an instance type having a minimum capability of ecs.c6.xlarge for optimal DNS performance, with enhanced clock speed as the VA is a DNS proxy.
Select the Custom image, Duration and click Next.

Note
The System Disk size increase will not help scale the VA as dynamic disk size change is not supported. The VA only supports a 7 GB system and 1 GB data disk.
Select the VPC and VSwitch as per the topology. In this example, default values are selected.

The Virtual Appliance will have a private IP with which it will be registered with the dashboard. Specify the private IP so that it does not change on power cycle.
If a Security Group has already been created, the same can be reused. This example proceeds with basic configuration and enable the ports later as per VA pre-requisites.
Alibaba cloud does not support password setting for users other than "root", so the vmadmin password cannot be set through the Cloud and it has to be Set Later through SSH or console access.
Select the Resource Group in the next window. In this example, the Default Resource Group is used.
Click Create Order and proceed.
Once the subscription is created, the instance will show up on the ECS console.

What's Next

Go to the newly created instance and edit Security Group rules; see the virtual appliances (VA) network requirements.
The vmadmin password can be reset by doing remote SSH via the public IP as port 3389 is allowed by default.
If the instance does not have a public IP, a Bastion host has to be created in the same region to access it via Private IP as per Alibaba documentation.
Please note that connecting to the VA through the Alibaba Cloud workbench will fail due to the change password prompt, so the first time password reset has to happen via SSH.
Once the password is reset, the Alibaba workbench can be used to login to the console.
After the password is set, you can SSH to the VA via the ECS Workbench as well.

Procedure

If the VA has a public IP associated, use the default vmadmin/<orgid> credentials and reset the password.
If the VA is inside private network, create another OAM VM (not the Alibaba bastion) inside the same network and SSH through the private IP using the vmadmin/<orgid> credentials and reset the password.
ECS instances can also be added to a Bastion host enterprise edition available on the Alibaba cloud; refer to the following guidelines. When doing so, please note that the password should be reset from the ECS instance UI also before trying to login through the Bastion. Please note that even though the instance password is reset through UI, it won't apply to the instance as we do not have a root account.

Dual-NIC Support on the VA

In the Alibaba Cloud elastic network interfaces (ENIs) are logical networking components that represent virtual NICs, providing network connectivity and IP addresses for Elastic Compute Service (ECS) instances deployed in virtual private clouds (VPCs).

The Secure Access VA supports a dual-NIC configuration. This dual-NIC configuration is intended to enable DMZ deployment of a VA for traffic segregation with one network interface being used for outbound communication and the other network interface used for internal communication.

There is no change to existing behavior if the VA is deployed with a single NIC. Configuring more than two NICs on the VA is not supported.

For more information about Secure Access Dual-NIC support and how to configure Alibaba ENIs, see the following:

Note: Do not connect more than one ENI the same VSwitch. Network issues will result.

IP Addressing

General Guidelines

The Secure Access VA supports both IPv4 and IPv6 addressing (dual stack). However there are some observations on the Alibaba cloud regarding IP addressing:

While the Alibaba ECS ENI supports multiple private IP address, please note that the Secure Access VA only supports a single IPv4 or Single IPv4 + IPv6 pair per ENI.
One private IPv4 and one private IPv6 address can be added to the Secure Access VA.
The Alibaba Cloud is not supporting public IPv6 address to ECS instances.
An IPv6 gateway can be set up at the VPC level and establish connectivity to Secure Access global IPv6 resolvers. However, it has been observed during testing that IPv6 packets are not getting a response even after setting up the gateway. This has been observed in the Germany Frankfurt Region.

Support for IPv6 Addressing

The following are observations regarding IPv6 addressing on the Alibaba Cloud:

The IPv6 address range should be enabled on the VSwitch.
By default, when creating an Elastic Compute Service (ECS) instance, an IPv4 address instead of an IPv6 address is assigned to the instance. To have the instance communicate over IPv6, configure an IPv6 address for the instance.
IPv6 addressing is not supported on every ECS instance types. It depends on system resources selected during deployment. Refer to ECS instance type family.
See Configure IPv6 addresses for information on how to configure an IPv6 address for the instance.

Anycast Configuration Support

The Umbrella VA enables the use of Anycast DNS addressing within an enterprise.

The VA currently supports enabling Anycast using the BGP protocol. This requires support for BGP on the VA's neighboring router, or any router that is reachable from the VA within 255 hops. See the Configure Anycast topic for information about how to configure Anycast on the VA.

In addition, keep the following in mind when configuring Anycast on the Alibaba cloud:

Configure an additional route on the VSwitch for the Anycast IP address for packets with the destination IP as Anycast.
The Anycast IP/network can be routed only per single ECS or ENI per VSwitch, where the next hop is the VA instance on which Anycast is enabled and 10.0.0.5 is the Anycast IP.

Note
VAs participating in anycast DNS should belong to different VSwitches or different networks; the following image shows the route table of a VSwitch configured with an Anycast route.

Screen displaying the route table of a VSwitch configured with an Anycast route

DNS Performance on Alibaba ECS Instances

Different instance types have different CPU, RAM and throughput capacity. Latency and throughput testing was performed on the following instances using dnsperf. The results captured after running the test for 1 minute are collected in the following table.

From these statistics, it is recommended to have an instance type having a minimum capability of ecs.c6.xlarge for optimal DNS performance. Refer to the Alibaba Cloud Instance family documentation for information on instance configurations.


Instance Type	Maximum DNS Throughput
ecs.c6.large	2000 qps
ecs.c6.xlarge	5000 qps
ecs.c6.2xlarge	10000 qps
ecs.hfc6.large	2200 qps
ecs.g6e.large	3000 qps

Extensions on Alibaba ECS Instances

Alibaba ECS instance supports installing agents/plugins for monitoring purpose, example CloudMonitor argusagent. It is not recommended to do so as it puts the VA under risk for root partition exhaustion. On a newly deployed VA instance, the memory usage is 66 % due to the aliyun default packages installation.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.