--- title: Deploying on Google Cloud Platform slug: ps/help/en_us/ics/25x/vadep/deploying-on-google-cloud-platform createdAt: 2026-09-21T05:29:32.764Z --- - [Supported Platforms Systems](docId\:yDj-9yH-93BD6TQWIqmqO) - [Prerequisites and System Requirements](docId\:yDj-9yH-93BD6TQWIqmqO) - [Downloading the GCP Virtual Machine Image](docId\:yDj-9yH-93BD6TQWIqmqO) - [Uploading the GCP Virtual Machine Image onto the Google Cloud Platform](docId\:yDj-9yH-93BD6TQWIqmqO) - [Creating a GCP Image Using a Script/Template](docId\:yDj-9yH-93BD6TQWIqmqO) - [Creating a VM Instance of the Uploaded GCP Image Manually](docId\:yDj-9yH-93BD6TQWIqmqO) - [Creating a VM Instance of the Uploaded GCP Image Using a Script/Template](docId\:yDj-9yH-93BD6TQWIqmqO) - [Deploying on Google Cloud Platform](docId\:yDj-9yH-93BD6TQWIqmqO) - [Deploying ICS using Terraform Template](docId\:yDj-9yH-93BD6TQWIqmqO) - [Ivanti Connect Secure Provisioning Parameters](docId\:yDj-9yH-93BD6TQWIqmqO) ## Supported Platforms Systems This section helps you in choosing the instance types that should be deployed with Ivanti Connect Secure. - ISA4500-V - ISA6500-V - ISA8500-V For more details, see [ISA VA Supported Platforms](docId:5RAgfN8DstZa5LJ7GbVq4). ## Prerequisites and System Requirements To deploy the Ivanti Connect Secure Virtual Appliance on GCP, you need the following: - Google Cloud Platform account - Access to the GCP portal (https\://cloud.google.com/ )\* - Ivanti Connect Secure Virtual Appliance Image - Ivanti Connect Secure licenses \*\* - Ensure that you have enough IP address in your region - Ensure that you have already created VPC network for each interface, as this is required while you deploy VM instances. ### Before you Begin Before you start, make sure you have the following information and files: - Signature database file : https\://pulsezta.blob.core.windows.net/gateway/nsa/db.der - To create a GCP image : https\://pulsezta.blob.core.windows.net/gateway/nsa/templates/GCP/\/ivanti-ics-image.zip ## Downloading the GCP Virtual Machine Image Download ICS image which is in zip format from Ivanti support site. Unzip the file to a location that is accessible from Google Cloud Platform. ## Uploading the GCP Virtual Machine Image onto the Google Cloud Platform To upload a GCP Gateway virtual machine image into Google Cloud Platform: 1. Access the Google Cloud Platform Management Portal, either from a client or a web browser, and log in using your Google Cloud Platform credentials. 2. In the Google Cloud Platform console, select your required project from the pull-down list on the title bar. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/3TvuuEqLL703D80vKcESx_gcpselectproject325x38.png" position="flex-start" size="33" width="325" height="38" initialPath="img/gcp_select_project_325x38.png" githubPath="img/gcp_select_project_325x38.png" showCaption="false" indent="1"} 3. Click the **Navigation** menu, and then select **Cloud Storage > Browser**. :::Paragraph{indent="1"} A list of GCP storage buckets appears. ::: 4. Select the bucket into which you wish to place the GCP image. :::Paragraph{indent="1"} A page listing the current contents of the bucket appears. ::: 5. (Optional) Navigate to the required folder within the bucket. 6. Click **Upload Files**. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/FpsL_mZQL2bOWx8bEq8tl_gcpuploadfiles749x271.png" position="flex-start" size="75" width="749" height="271" initialPath="img/gcp_upload_files_749x271.png" githubPath="img/gcp_upload_files_749x271.png" showCaption="false" indent="1"} :::Paragraph{indent="1"} An upload dialog appears. ::: 7. Select the ICS Gateway GCP virtual machine image .tar file from your local workstation (see Before you begin), and click **Open**. :::hint{type="info"} If you want to use the provided YAML templates to automate the creation of the GCP image (see [Creating a GCP Image Using a Script/Template](docId\:yDj-9yH-93BD6TQWIqmqO)), select these in addition to the image archive. ::: The image archive and any selected template files are added to the bucket. 8. Wait until the upload completes. This may take several minutes. 9. Start a command line session from the title bar. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/UqzDtk5WiOOBIQh9sfwi9_gcpuploadfiles1359x51.png" position="flex-start" size="36" width="359" height="51" initialPath="img/gcp_upload_files1_359x51.png" githubPath="img/gcp_upload_files1_359x51.png" showCaption="false" indent="1"} A command line session starts. 10. Navigate to the project folder. 11. Copy the db.der file extracted from the ICS image .zip file, to the current project directory. 12. Create an image using the following command using GCP CLI: :::Paragraph{indent="1"} gcloud compute images create \ --source-uri=gs\://\/\/\.tar.gz --signature-database-file=db.der --guest-os-features MULTI\_IP\_SUBNET,UEFI\_COMPATIBLE,GVNIC ::: For example: gcloud compute images create pcs109 --source-uri=gs\://bucket-california/pcs\_images/ICS-25.13R1-25.13R1-145.1.tar.gz --signature-database-file=db.der --guest-os-features MULTI\_IP\_SUBNET,UEFI\_COMPATIBLE,GVNIC 13. You can also create an image using a script/template (see [Creating a GCP Image Using a Script/Template](docId\:yDj-9yH-93BD6TQWIqmqO)) 14. You can now create a VM instance of the uploaded GCP image. To do this, either: - Perform the task manually, see [Creating a VM Instance of the Uploaded GCP Image Manually](docId\:yDj-9yH-93BD6TQWIqmqO). - Perform the task with a script/template, see [Creating a VM Instance of the Uploaded GCP Image Using a Script/Template](docId\:yDj-9yH-93BD6TQWIqmqO). ## Creating a GCP Image Using a Script/Template 1. Download the required template archive file to your local workstation. 2. Unpack the downloaded archive file to a location that is accessible from Google Cloud Platform. Each archive contains three files present in one respective directory, i.e.: - ivanti-ics-image.jinja - ivanti-ics-image.scheme - ivanti-ics-image.yaml 3. Edit the YAML file properties section to reflect your project requirements. :::Paragraph{indent="1"} An example of an existing VPC YAML file is provided here: ::: ```bash imports: - path: ivanti-ics-image.jinja resources: - name: ivanti-custom-secure-image type: ivanti-ics-image.jinja properties: image_name: icsgcp123 bucket_name: bucket-california image_file: ICS-25.13R1-25.13R1-145.1.tar.gz # Paste your Base64 encoded file lines directly here: db_content: ``` 4. Save the YAML file. 5. On the Google Cloud Platform, start a command line session from the title bar. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/UqzDtk5WiOOBIQh9sfwi9_gcpuploadfiles1359x51.png" position="flex-start" size="36" width="359" height="51" initialPath="img/gcp_upload_files1_359x51.png" githubPath="img/gcp_upload_files1_359x51.png" showCaption="false" indent="1"} :::Paragraph{indent="1"} A command line session starts. ::: 6. Within the project folder, change to deploymentmanager folder. 7. Create a new folder and change to the new folder and copy the three script files to this folder. 8. Select the required project: :::Paragraph{indent="1"} gcloud config set project \ ::: 9. Create the GCP image using the following command: :::Paragraph{indent="1"} gcloud deployment-manager deployments create \ --config \ ::: :::Paragraph{indent="1"} For example: ::: :::Paragraph{indent="1"} gcloud deployment-manager deployments create icsgcp123 --config ivanti-ics-image.yaml ::: ## Creating a VM Instance of the Uploaded GCP Image Manually This section describes how to manually create a virtual machine instance of the ICS Gateway image inside Google Cloud Platform. You can also perform this process automatically using a script/template, see [Creating a VM Instance of the Uploaded GCP Image Using a Script/Template](docId\:yDj-9yH-93BD6TQWIqmqO). 1. Click the **Navigation** menu, and then select **Compute Engine > Images**. :::Paragraph{indent="1"} The Images page appears. For example: ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/G3VL43iHkEae9TS6gq8Nr_gcpimagespage601x246.png" position="flex-start" size="60" width="601" height="246" initialPath="img/gcp_images_page_601x246.png" githubPath="img/gcp_images_page_601x246.png" showCaption="false" indent="1"} 2. Locate the new image in the list of images. 3. At the end of the image entry, click the action menu and select **Create Instance**. :::Paragraph{indent="1"} The **Create Instance** page appears. For example: ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/LtU_OW63qx72S1LD5EfHT_gcpcreateinstance654x482.png" position="flex-start" size="65" width="654" height="482" initialPath="img/gcp_create_instance_654x482.png" githubPath="img/gcp_create_instance_654x482.png" showCaption="false" indent="1"} 4. On the **Create Instance** page: For more information, see table below. | General-Purpose | CPUs / Memory | ISA Model | Disk Space | | ------------------------------------------ | ------------------------------- | --------- | ---------- | | N4 (5th Gen Intel Xeon Scalable processor) | n4-standard-4 (4 vCPU, 16 GB) | ISA4500V | 80 GB | | | n4-standard-8 (8 vCPU, 32 GB) | ISA6500V | 80 GB | | | n4-standard-16 (16 vCPU, 64 GB) | ISA8500V | 80 GB | - Enter a **Name** for the new instance. - Select a **Region** and **Zone**. - Under **Machine configuration**: - For **Series**, select **n4-standard-4**. - For **Machine Type**, select a minimum of *n4-standard-4*. - For **Boot Disk**, confirm that the correct image is already selected. - For **Firewall**, select the required HTTP/HTTPS options. - Under **Security → Shielded VM** - Select Turn on Secure Boot - Select Turn on vTPM - Deselect Turn on Integrity Monitoring - Expand the **Management, security, disks, networking, sole tenancy** options. - Select the **Management** tab. - Under **Metadata**: - For **Key**, enter pulse-config. - For **Value**, paste the text of the metadata file.. - Select the **Networking** tab. - Under **Network interfaces**, click the **Edit** icon to change the default network interface selection. The **Network interface** options appear. - Under **Network interface**, *specify a private* (internal) network interface: - For **Network**, select the required private VPC. - For **Subnetwork**, select the required subnetwork. - Click **Done** to confirm the settings for the private network interface. - Under **Network interfaces**, click **Add network interface**. The **Network interface** options appear. - Under **Network interface**, *specify a public* (external) network interface: - For **Network**, select the required public VPC. - For **Subnetwork**, select the required subnetwork. - Click **Done** to confirm the settings for the public network interface. - (Optional) Click **Add network interface** and specify a management network interface. - Click **Create** to confirm the settings and instantiate a VM instance of the image. The **VM Instances** page appears. This page shows the new VM instance of the image. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/ZDZ9-J2FkBxJMSC_qDPJ3_gcpcreateinstance1801x125.png" position="flex-start" size="80" width="801" height="125" initialPath="img/gcp_create_instance1_801x125.png" githubPath="img/gcp_create_instance1_801x125.png" showCaption="false" indent="1"} 5. On the **VM Instances** page, wait until the creation of the VM instance completes. This may take several minutes. 6. After the VM instance is created, click on it in the list of VM instances. The **VM instance details** page appears for the instance. 7. Confirm the details for the VM instance, including the number of network interfaces. 8. Make a note of the public IP address of the EXT interface (typically, this is nic1. This is required inside nSA. 9. Under **Network interfaces**, confirm that the firewall settings from your VPCs are present for your specified network interfaces: - Click *nic0*. A summary page for this network interface appears. :::Paragraph{indent="1"} Under **Firewall and route details**, click the **Firewall Rules** tab and confirm that the following firewall rules are defined. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/f9sDJH6189o40VghA-bM2_nic0fr815x369.png" position="flex-start" size="80" width="815" height="369" initialPath="img/nic0_fr_815x369.png" githubPath="img/nic0_fr_815x369.png" showCaption="false" indent="1"} - Click *nic1*. A summary page for this network interface appears. :::Paragraph{indent="1"} Under **Firewall** and route details, click the **Firewall Rules** tab and confirm that the following firewall rules are defined. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/lLtH8PkTTqCd2wVSm_xII_nic1fr818x312.png" position="flex-start" size="80" width="818" height="312" initialPath="img/nic1_fr_818x312.png" githubPath="img/nic1_fr_818x312.png" showCaption="false" indent="1"} - (Optional) Click nic2. A summary page for this optional network interface appears. :::Paragraph{indent="1"} Under **Firewall and route details**, click the **Firewall Rules** tab and confirm that the following firewall rules are defined. ::: 10. The VM instance details\* page, click **Connect to serial console** :::Paragraph{indent="1"} A console monitor view (in a separate browser tab) shows the ongoing boot-up process for the instance. ::: 11. Wait until the instance boot up is complete, and shows a screen similar to the following: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/3L05WMC4e4i4V5Uj2ojDl_gcpinstanceconsolemonitor583x199.png" position="flex-start" size="58" width="583" height="199" initialPath="img/gcp_instance_console_monitor_583x199.png" githubPath="img/gcp_instance_console_monitor_583x199.png" showCaption="false" indent="1"} You can then complete this process by updating the Gateway details on the nSA Controller, see Completing the Configuration of the nSA Controller. ## Creating a VM Instance of the Uploaded GCP Image Using a Script/Template This section describes how to automatically create a virtual machine instance of the ICS Gateway image inside Google Cloud Platform using a script/template. You can also perform this process manually, see [Creating a VM Instance of the Uploaded GCP Image Manually](docId\:yDj-9yH-93BD6TQWIqmqO). Ivanti provides YAML-based templates to create an instance of the ICS Gateway image in the following configurations: - Two network interfaces in an existing VPC. - Three network interfaces in an existing VPC. Download: https\://pulsezta.blob.core.windows.net/gateway/nsa/templates/GCP/21-12-145/ivanti-ics-2-nics-existing-vpc.zip https\://pulsezta.blob.core.windows.net/gateway/nsa/templates/GCP/21-12-145/ivanti-ics-3-nics-existing-vpc.zip - Two network interfaces in a new VPC. - Three network interfaces in a new VPC. Download: https\://pulsezta.blob.core.windows.net/gateway/nsa/templates/GCP/21-12-145/ivanti-ics-2-nics-new-vpc.zip https\://pulsezta.blob.core.windows.net/gateway/nsa/templates/GCP/21-12-145/ivanti-ics-3-nics-new-vpc.zip To use a template: 1. Download the required template archive file to your local workstation. 2. Unpack the downloaded archive file to a location that is accessible from Google Cloud Platform. Each archive contains three files. These files should be present in one respective directory. For example, for the three-interface (existing VPC) version of the archive: :::Paragraph{indent="1"} ivanti-ics-2-nics-existing-vpc.jinja ::: :::Paragraph{indent="1"} ivanti-ics-2-nics-existing-vpc.scheme ::: :::Paragraph{indent="1"} ivanti-ics-2-nics-existing-vpc.yaml ::: 3. Edit the YAML file properties section to reflect your project and instance requirements, including the user\_data property. :::Paragraph{indent="1"} An example of an existing VPC YAML file is provided here: ::: | imports:
- path: ivanti-ics-3-nics-existing-vpc.jinja
resources:
- name: my-vm
properties:
project: ics-project
email: admin\@example.com
machinetype: n4-standard-4
region: asia-south1
zone: asia-south1-b
image: icsgcp123
int\_network: vpc-network-private-abcdef
ext\_network: vpc-network-public-abcdef
mgmt\_network: vpc-network-mgmt-abcdef
int\_subnetwork: vpc-asia-south1-b-ics-int-port
ext\_subnetwork: vpc-asia-south1-b-ics-ext-port
mgmt\_subnetwork: vpc-asia-south1-b-ics-mgmt-port
user\_data: \\8.8.8.8\<\primary-dns> ...
type: ivanti-ics-3-nics-existing-vpc.jinja
enableSecureBoot: true
enableVtpm: true
enableIntegrityMonitoring: false | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | The following table lists all possible template properties and their meaning: | Property | Description | | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | project | Name of the Project | | email | Registered service account email address | | region | The name of the region in which you want to deploy your VM instance | | zone | The name of the zone in which you want to deploy your VM instance | | image | Virtual machine image name | | machine\_type | N4-standard machine type | | int\_network | VPC network name for internal network | | ext\_network | VPC network name for external network | | mgmt\_network | VPC network name for management network | | int\_subnetwork | Subnet name for internal VPC | | ext\_subnetwork | Subnet name for external VPC | | mgmt\_subnetwork | Subnet name for management VPC | | user\_data | The Gateway config file downloaded.
In User data, \v4\ parameter can be configured as follows:
- v4 : IPv4 addresses are allowed to configured (Default). | 4. Save the YAML file. 5. On the Google Cloud Platform, start a command line session from the title bar. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/qGHQyDyQnGNN4GxlTJvNy_gcpuploadfiles1528x76.png" position="flex-start" size="53" width="528" height="76" initialPath="img/gcp_upload_files1_528x76.png" githubPath="img/gcp_upload_files1_528x76.png" showCaption="false" indent="1"} :::Paragraph{indent="1"} A command line session starts. ::: 6. Within the project folder, change to *deploymentmanager* folder. 7. Create a new folder and change to the new folder and copy the three script files to this folder. 8. Select the required project: :::Paragraph{indent="1"} gcloud config set project \ ::: 9. Deploy the VM using the following command: :::Paragraph{indent="1"} gcloud deployment-manager deployments create \ --config \ ::: For example: :::Paragraph{indent="1"} gcloud deployment-manager deployments create vm-gcp-123 --config ivanti-ics-3-nics-existing-vpc.yaml ::: 10. Wait until the command completes. 11. On the VM Instances page, click on the new VM in the list of VM instances. :::Paragraph{indent="1"} The VM instance details page appears for the instance. ::: ## Deploying ICS using Terraform Template This section describes how to install terraform template and deploy ICS on GCP with 2 NICs and 3 NICs. 1. Copy variables, base\_setup\_tf and ics\_deploy scripts to a linux m/c installed with terraform. Go to the Terraform website to install Terraform on a Linux VM of your choice at usr/local/bin. 2. Create base\_setup directory and copy base\_setup.tf and variables.tf to it. Customize and set the variables in variables.tf file based on the requirement. :::Paragraph{indent="1"} Example: Region, AMI-id, VPC name, subnet IP address details, instance name etc. ::: 3. cd to base\_setup directory and run terraform apply. :::Paragraph{indent="1"} linux# terraform apply ::: 4. Create ics\_deploy directory and copy ics\_deploy and variables.tf to it 5. Run following command: :::Paragraph{indent="1"} terraform apply -input=false -auto-approve -var "instance\_name=gcp-test-instance-1" -var "image\_name=icsgcp386" ::: Before running the script, user has to create an image in the GCP cloud in the name of icsgcp386 (as shown above) ### Downloading Terraform Template File To download Terraform Template zip file: 1. Log in to [https://portal.ivanti.com/customer/product-downloads](https://portal.ivanti.com/customer/product-downloads) 2. Navigate to **Security> Ivanti Connect Secure (ICS, Pulse Connect Secure) > Downloads > Pulse Secure > Pulse Connect Secure > Cloud Templates**. 3. Under **Current and Supported Releases**, select the Template file and Download. For example, *ps-ics-terraform\_templates-9.1Rx\_22.Rx-2.0.zip.* ## Ivanti Connect Secure Provisioning Parameters Provisioning parameters are those parameters which are required during the deployment of a virtual appliance. Ivanti Connect Secure accepts the following parameters as provisioning parameters in the XML format. ```bash 1grkL2Xbr auto.toad.pzt.dev.perfsec.com n external ``` :::Paragraph{indent="1"} The below table depicts the details of the xml file. ::: | # | Parameter Name | Type | Description | | -- | ------------------------ | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 1 | wins-server | IP address | Wins server for Ivanti Connect Secure | | 2 | dns-domain | string | DNS domain of Ivanti Connect Secure | | 3 | cert-common-name | string | Common name for the self-signed certificate generation. This certificate is used as the device certificate of Ivanti Connect Secure
Random text for the self-certificate generation
Organization name for the self-signed certificate generation | | 4 | cert-random-text | string | | | 5 | cert-organization | string | | | 6 | config-download-url | String URL | Http based URL where XML based Ivanti Connect Secure configuration can be found. During provisioning, Ivanti Connect Secure fetches this file and comes up with preloaded configuration. XML based configuration can be present in another VM in AWS cloud or at corporate network which is accessible for Ivanti Connect Secure through site to site VPN between AWS and corporate data center | | 7 | config-data | string | base64 encoded XML based Ivanti Connect Secure configuration | | 8 | auth-code-license | string | Authentication code that needs to be obtained from Ivanti | | 9 | enable-license-server | string | If set to ‘**y**’, ICS will be deployed as a License server.
If set to ‘**n’**, ICS will be deployed as a normal server. | | 10 | accept-license-agreement | string | This value is passed to the instance for configuration at the boot time. By default, this value is set to “n”. **This value must be set to “y”**. | | 11 | enable-rest | string | If set to ‘**y**’, REST API access for the administrator user is enabled. | :::hint{type="info"} - In the above list of parameters, primary dns, dns domain, admin username, admin password, cert-random name, cert-random text, cert-organization and accept-license-agreement are mandatory parameters. The other parameters are optional parameters. - The XML parsing fails if the following characters are used in the strings: - " - ’ - \< - \> - & - Ivanti Connect Secure supports zero touch provisioning. This feature can detect and assign DHCP networking settings automatically at the Ivanti Connect Secure boot up. The Ivanti Connect Secure parameters should be set to null in order to fetch the networking configuration automatically from the DHCP server. ::: The below table describes the new parameters that are added in the XML file and these are applicable for nSA-managed 25.1.x versions. | Parameter | Type | Description | | ------------------------ | ------- | --------------------------------------------------------------------------------------------------------------------- | | registrationCode | string | The registration code, which is generated during the ICS gateway registration on nSA. Example: KyZR6YDL8 | | registrationFQDN | string | The registration FQDN name, which is generated during the ICS gateway registration on nSA. Example: sample.domain.com | | enableproxy | string | Default is set to n. | | proxyHost | string | The proxy server name. | | proxyPort | integer | The port number of the proxy server. Example: 8080 | | proxyUsername | string | The username of the proxy server. Example,\:usr | | proxyPassword | string | The password of the proxy server. Example: pxx124 | | registerNetworkInterface | string | The interface through which the gateway registers with nSA. Example: external |