SSE Zscaler Feature

Configure SSE Zscaler feature.

Diagram

Classes

sse_profiles (sdwan.feature_profiles)

Name	Type	Constraint	Mandatory	Default Value
zscaler	Class	[zscaler]	No

zscaler (sdwan.feature_profiles.sse_profiles)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[^&<>! "]{1,128}$	Yes
description	String		No
aup_enabled	Boolean	true, false	No
aup_enabled_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
aup_timeout	Integer	min: 1, max: 180	No
aup_timeout_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
auth_required	Boolean	true, false	No
auth_required_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
block_internet_until_accepted	Boolean	true, false	No
block_internet_until_accepted_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
caution_enabled	Boolean	true, false	No
caution_enabled_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
country	Boolean	true, false	No
country_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
display_time_unit	Choice	MINUTE, HOUR, DAY	No
display_time_unit_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
download_bandwidth	Number	min: 0.1, max: 99999	No
download_bandwidth_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
enforce_bandwidth_control	Boolean	true, false	No
enforce_bandwidth_control_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
firewall_enabled	Boolean	true, false	No
firewall_enabled_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
force_ssl_inspection	Boolean	true, false	No
force_ssl_inspection_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
idle_time	Integer	min: 1, max: 99999	No
idle_time_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
interface_pairs	List	[interface_pairs]	Yes
interfaces	List	[interfaces]	Yes
ip_enforced_for_known_browsers	Boolean	true, false	No
ip_enforced_for_known_browsers_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ips_control	Boolean	true, false	No
ips_control_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
location_name_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
primary_data_center	String	min: 1, max: 128	No
primary_data_center_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
refresh_time	Integer	min: 1, max: 99999	No
refresh_time_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
refresh_time_unit	Choice	MINUTE, HOUR, DAY	No
refresh_time_unit_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
secondary_data_center	String	min: 1, max: 128	No
secondary_data_center_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
src_vpn	Boolean	true, false	No
sub_locations	List	[sub_locations]	No
surrogate_ip	Boolean	true, false	No
surrogate_ip_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
tracker_source_ip	IP		No
tracker_source_ip_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
trackers	List	[trackers]	No
upload_bandwidth	Number	min: 0.1, max: 99999	No
upload_bandwidth_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
xff_forward_enabled	Boolean	true, false	No
xff_forward_enabled_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No

interface_pairs (sdwan.feature_profiles.sse_profiles.zscaler)

Name	Type	Constraint	Mandatory	Default Value
active_interface	String	Regex: (^ipsec(?:1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|\d)$)|(^gre(?:1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|\d)$)	No
active_interface_weight	Integer	min: 1, max: 255	No
backup_interface	String	Regex: (^ipsec(?:1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|\d)$)|(^gre(?:1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|\d)$)|None	No
backup_interface_weight	Integer	min: 1, max: 255	No

interfaces (sdwan.feature_profiles.sse_profiles.zscaler)

Name	Type	Constraint	Mandatory	Default Value
dpd_interval	Integer	min: 10, max: 3600	No
dpd_interval_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
dpd_retries	Integer	min: 2, max: 60	No
dpd_retries_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ike_ciphersuite	Choice	aes256-cbc-sha1, aes256-cbc-sha2, aes128-cbc-sha1, aes128-cbc-sha2	No
ike_ciphersuite_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ike_group	Choice	2, 5, 14, 15, 16, 19, 20, 21	No
ike_group_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ike_local_id	String	min: 1, max: 128	No
ike_local_id_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ike_rekey_interval	Integer	min: 300, max: 86400	No
ike_rekey_interval_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ike_remote_id	String	min: 1, max: 128	No
ike_remote_id_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ike_version	Integer	min: 1, max: 2	No
ike_version_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
interface_description	String	min: 1, max: 128	No
interface_description_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
interface_name	String	Regex: (^ipsec(?:1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|\d)$)|(^gre(?:1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|\d)$)	No
ipsec_ciphersuite	Choice	aes256-cbc-sha1, aes256-cbc-sha384, aes256-cbc-sha256, aes256-cbc-sha512, aes256-gcm	No
ipsec_ciphersuite_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ipsec_rekey_interval	Integer	min: 300, max: 1209600	No
ipsec_rekey_interval_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ipsec_replay_window	Choice	64, 128, 256, 512, 1024	No
ipsec_replay_window_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ipv4_address	IP		No
ipv4_address_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
mtu	Integer	min: 576, max: 2000	No
mtu_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
perfect_forward_secrecy	Choice	group-2, group-5, group-14, group-15, group-16, group-19, group-20, group-21, none	No
perfect_forward_secrecy_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
shutdown	Boolean	true, false	No
tcp_mss_adjust	Integer	min: 500, max: 1460	No
tcp_mss_adjust_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
track_enable	Boolean	true, false	No
tracker	String	min: 1, max: 128	No
tunnel_dc_preference	Choice	primary-dc, secondary-dc	No
tunnel_destination	IP		No
tunnel_destination_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
tunnel_public_ip	String	min: 1, max: 128	No
tunnel_public_ip_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
tunnel_route_via	String	Regex: ^ge0/\d+(?:\.\d+)?$	No
tunnel_route_via_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
tunnel_set	Choice	secure-internet-gateway-umbrella, secure-internet-gateway-zscaler, secure-internet-gateway-other	No
tunnel_source	IP		No
tunnel_source_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
tunnel_source_interface	String	Regex: (ATM|ATM-ACR|AppGigabitEthernet|AppNav-Compress|AppNav-UnCompress|Async|BD-VIF|BDI|CEM|CEM-ACR|Cellular|Dialer|Embedded-Service-Engine|Ethernet|Ethernet-Internal|FastEthernet|FiftyGigabitEthernet|FiveGigabitEthernet|FortyGigabitEthernet|FourHundredGigE|GMPLS|GigabitEthernet|Group-Async|HundredGigE|L2LISP|LISP|Loopback|MFR|Multilink|Port-channel|SM|Serial|Service-Engine|TenGigabitEthernet|Tunnel|TwentyFiveGigE|TwentyFiveGigabitEthernet|TwoGigabitEthernet|TwoHundredGigE|Vif|Virtual-PPP|Virtual-Template|VirtualPortGroup|Vlan|Wlan-GigabitEthernet|nat64|nat66|ntp|nve|ospfv3|overlay|pseudowire|ucse|vasileft|vasiright|vmi)([0-9]*(. ?[1-9][0-9]*)*|[0-9/]+|[0-9]+/[0-9]+/[0-9]+:[0-9]+|[0-9]+/[0-9]+/[0-9]+|[0-9]+/[0-9]+|[0-9]+)	No
tunnel_source_interface_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
unnumbered	Boolean	true, false	No

sub_locations (sdwan.feature_profiles.sse_profiles.zscaler)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[^&<>! "]{1,128}$	Yes
name_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
aup_enabled	Boolean	true, false	No
aup_enabled_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
aup_timeout	Integer	min: 1, max: 180	No
aup_timeout_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
auth_required	Boolean	true, false	No
auth_required_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
block_internet_until_accepted	Boolean	true, false	No
block_internet_until_accepted_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
caution_enabled	Boolean	true, false	No
caution_enabled_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
display_time_unit	Choice	MINUTE, HOUR, DAY	No
display_time_unit_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
download_bandwidth	Number	min: 0.1, max: 99999	No
download_bandwidth_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
enforce_bandwidth_control	Choice	location-bandwidth, override, disabled	No
enforce_bandwidth_control_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
firewall_enabled	Boolean	true, false	No
firewall_enabled_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
force_ssl_inspection	Boolean	true, false	No
force_ssl_inspection_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
idle_time	Integer	min: 1, max: 99999	No
idle_time_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
internal_ips	List	[internal_ips]	No
ip_enforced_for_known_browsers	Boolean	true, false	No
ip_enforced_for_known_browsers_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
refresh_time	Integer	min: 1, max: 99999	No
refresh_time_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
refresh_time_unit	Choice	MINUTE, HOUR, DAY	No
refresh_time_unit_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
service_vpn	List	String	No
service_vpn_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
surrogate_ip	Boolean	true, false	No
surrogate_ip_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
upload_bandwidth	Number	min: 0.1, max: 99999	No
upload_bandwidth_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No

trackers (sdwan.feature_profiles.sse_profiles.zscaler)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[^&<>! "]{1,128}$	Yes
endpoint_api_url	String	Regex: ^https?://[^\s/$.?#].[^\s]*$	No
endpoint_api_url_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
interval	Integer	min: 20, max: 600	No
interval_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
multiplier	Integer	min: 1, max: 10	No
multiplier_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
threshold	Integer	min: 100, max: 1000	No
threshold_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No

internal_ips (sdwan.feature_profiles.sse_profiles.zscaler.sub_locations)

Name	Type	Constraint	Mandatory	Default Value
ip_address	IP		No
ip_address_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No

Examples

Example-1: The example below demonstrates how to configure a basic SSE Zscaler feature.

sdwan:
  feature_profiles:
    sse_profiles:
      - name: sse_profile_1
        zscaler:
          name: sse_profile_1
          description: basic zscaler
          interfaces:
            - interface_name: ipsec1
              interface_description: ipsec1
              tunnel_source_interface: GigabitEthernet1
          interface_pairs:
            - active_interface: ipsec1
              active_interface_weight: 1
              backup_interface: None
              backup_interface_weight: 1
          tracker_source_ip: 10.0.0.1