Set Up a VMware ESXi Environment for SASE Private Location

1. Configure resource pools for SASE private location components.

   Create dedicated resource pools to allocate vCPU and memory resources for SASE components:

   1. Navigate to your cluster or host in the vSphere Client.
   2. Right-click and select New Resource Pool.
   3. Name the resource pool (for example, SASE-Private-Location).
   4. Set vCPU and memory allocation to ensure dedicated resources with no oversubscription.
   5. Click OK to create the resource pool.
2. Create a VM folder structure for organization.

   Organize your SASE components in a dedicated folder structure:

   1. Right-click on your data center in the vSphere Client.
   2. Select New FolderNew VM and Template Folder > .
   3. Name the folder (for example, SASE-Private-Location).
   4. Optionally, create subfolders for different components (for example, Mobile-Users).
3. Configure networking for SASE components.

   Set up the necessary virtual networking components:

   1. Navigate to your host or cluster's Configure tab.
   2. Select NetworkingVirtual switches.
   3. Create or configure a vSwitch with sufficient bandwidth capacity (recommended 10 Gbps or higher).
   4. Create the following port groups:
      • Management network (for component management traffic)
      • Trust network (for internal traffic)
      • Untrust network (for external/internet traffic)
   5. Configure VLAN IDs for each port group as required by your network architecture.

   For optimal performance, configure the vSwitch with VMXNET3 adapters and ensure physical NICs support at least 10 Gbps.
4. Allocate storage resources for SASE private location.

   Prepare storage resources that meet performance requirements:

   1. Navigate to Storage in the vSphere Client.
   2. Ensure datastores have sufficient space for all SASE components (minimum 500GB recommended).
   3. Use datastores with low latency and high IOPS capabilities for optimal performance.
   4. Create a dedicated folder within the datastore for SASE components organization.

   Any datastore type (Local DAS, vSAN, or NAS) is supported as long as it meets the IOPS requirements for SASE components.
5. Create a content library.

   You specify the content library name when you set up the hypervisor resource profile during SASE Private Location setup.

6. Configure access control for Terraform deployment.

   Create a dedicated service account for Terraform to use for deployment:

   1. Navigate to AdministrationSingle Sign OnUsers and Groups in vCenter.
   2. Create a new user (for example, sase-terraform-svc).
   3. Navigate to AdministrationAccess ControlRoles.
   4. Create a custom role with the minimum required permissions:
      • Virtual machine: All
      • Resource: Assign virtual machine to resource pool
      • Datastore: Allocate space, Browse datastore
      • Network: Assign network
      • Global: Enable methods, Disable methods
   5. Assign this role to the service account for the appropriate resources (clusters, hosts, datastores, networks).
7. Configure outbound network connectivity.

   Ensure outbound connectivity from your VMware environment to Prisma Access cloud services:

   1. Verify that your firewall allows outbound connections on TCP ports 443 and 8883 to Prisma Access cloud services.
   2. If your environment uses a proxy for outbound connections, configure the proxy settings to enable communication with Prisma Access services.
   3. Test connectivity to ensure successful communication with the Prisma Access cloud services.
8. Prepare IP address allocation for SASE components.

   Allocate IP addresses for all SASE components in advance:

   1. Reserve IP addresses for management interfaces of all components (load balancers, gateways, PA agents).
   2. Reserve IP addresses for data interfaces (trust and untrust).
   3. If using static IP pools for mobile users, prepare the IP range to be assigned.
   4. If using DHCP, ensure your DHCP server is properly configured to serve the Mobile User IP range.
   5. Document all IP allocations for use during the Terraform deployment.

   Your VMware ESXi environment is now ready to deploy SASE private location. You have created the necessary resource pools, networking components, and storage allocations, and have configured appropriate access controls. This foundation will ensure optimal performance and reliability of your SASE private location components once deployed using Terraform.

   Before proceeding with the Terraform deployment, verify the following:

   • Network connectivity between all configured port groups and external networks is working as expected.
   • The service account created for Terraform has the appropriate permissions to deploy VMs and configure resources.
   • DNS resolution is properly configured in your environment for both internal and external domain names.
   • Time synchronization (NTP) is properly configured on all ESXi hosts to ensure consistent timestamps across the environment.
   • Download the necessary .ova files from the Customer Support Portal (CSP) in preparation for the Terraform deployment.