---
title: Ivanti Connect Secure Gateway Deployment
slug: ps/help/en_us/nsa/22x/nsa-ics/ag/1002
docTags: 
createdAt: 2026-07-22T09:12:32.312Z
---

The following sections describe the new parameters that are added for the deployment of Ivanti Connect Secure VA on VMware, Amazon Web Services cloud and Microsoft Azure cloud.

- [Deploying on VMware](docId\:Tq3taZSQexa7s9hVvFnM6)
- [Deploying on Hyper-V](docId\:Tq3taZSQexa7s9hVvFnM6)
- [Deploying on KVM](docId\:Tq3taZSQexa7s9hVvFnM6)
- [Deploying on AWS Cloud](docId\:Tq3taZSQexa7s9hVvFnM6)
- [Deploying on Azure Cloud](docId\:Tq3taZSQexa7s9hVvFnM6)
- [Deploying on Google Cloud Platform](docId\:Tq3taZSQexa7s9hVvFnM6)

## Deploying on VMware

For a detailed ICS VA deployment procedure, refer to *Virtual Appliance Deployment Guide* at [https://www.ivanti.com/support/product-documentation](https://www.ivanti.com/support/product-documentation).

This below table describes the new parameters that are added in the script file **create-va.pl**, which is included in your ISA-V package.

| Parameter                | Description                                                                                                                       |
| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------- |
| **New Parameters**       |                                                                                                                                   |
| registrationCode         | The registration code, which is generated during the ICS gateway registration on NSA. Example, KyZR6YDL8                          |
| registrationFQDN         | The registration FQDN name, which is generated during the ICS gateway registration on NSA. Example, auto.lark.pzt.dev.perfsec.com |
| enableproxy              | Default is set to n.                                                                                                              |
| proxyHost                | The proxy server name.                                                                                                            |
| proxyPort                | The port number of the proxy server. Example, 8080                                                                                |
| proxyUsername            | The username of the proxy server. Example, usr                                                                                    |
| proxyPassword            | The password of the proxy server. Example, pxx124                                                                                 |
| registerNetworkInterface | The interface through which the gateway registers with NSA. Example, external                                                     |

## Deploying on Hyper-V

For a detailed ICS on Hyper-V deployment procedure, refer to *ICS Gateway Deployment on Hyper-V Platform* at [https://www.ivanti.com/support/product-documentation](https://www.ivanti.com/support/product-documentation).

## Deploying on KVM

For a detailed ICS on KVM deployment procedure, refer to *ICS Gateway Deployment on KVM Platform* at [https://www.ivanti.com/support/product-documentation](https://www.ivanti.com/support/product-documentation).

## Deploying on AWS Cloud

For a detailed ICS VA on AWS Cloud deployment procedure, refer to *Virtual Appliance on Amazon Web Services Deployment Guide* at [https://www.ivanti.com/support/product-documentation](https://www.ivanti.com/support/product-documentation).

Ivanti Connect Secure accepts the following parameters as provisioning parameters in the XML format.

```javascript
<pulse-config>

		<primary-dns><value></primary-dns>

		<secondary-dns><value></secondary-dns>

		<wins-server><value></wins-server>

		<dns-domain><value></dns-domain>

		<admin-username><value></admin-username>

		<admin-password><value></admin-password>

		<cert-common-name><value></cert-common-name>

		<cert-random-text><value></cert-random-text>

		<cert-organisation><value></cert-organisation>

		<config-download-url><value></config-download-url>

		<config-data><value></config-data>

		<auth-code-license><value></auth-code-license>

		<enable-license-server><value></enable-license-server>

		<accept-license-agreement><value></accept-license-agreement >

		<enable-rest><value></enable-rest>

		<registration-code> 1grkL2Xbr </registration-code>

		<registration-fqdn>auto.toad.pzt.dev.perfsec.com</registration-fqdn>

		<enable-proxy>n</enable-proxy>

		<proxy-host></proxy-host>

		<proxy-port></proxy-port>

		<proxy-username></proxy-username>

		<proxy-password></proxy-password>

		<register-network-interface>external</register-network-interface>

</pulse-config>
```

The below table describes the new parameters that are added in the XML file.

| Parameter                | Type    | Description                                                                                                           |
| ------------------------ | ------- | --------------------------------------------------------------------------------------------------------------------- |
| **New Parameters**       |         |                                                                                                                       |
| registrationCode         | string  | The registration code, which is generated during the ICS gateway registration on NSA. Example, KyZR6YDL8              |
| registrationFQDN         | string  | The registration FQDN name, which is generated during the ICS gateway registration on NSA. Example, sample.domain.com |
| enableproxy              | string  | Default is set to n.                                                                                                  |
| proxyHost                | string  | The proxy server name.                                                                                                |
| proxyPort                | integer | The port number of the proxy server. Example, 8080                                                                    |
| proxyUsername            | string  | The username of the proxy server. Example, usr                                                                        |
| proxyPassword            | string  | The password of the proxy server. Example, pxx124                                                                     |
| registerNetworkInterface | string  | The interface through which the gateway registers with NSA. Example, external                                         |

:::hint{type="info"}
The XML parsing fails if the following characters are used in the strings:
\- """
\- "‘"
\- "\<"
\- ">"
\- "&"
:::

### System Operations

The AWS portal provides Start, Restart Stop and Terminate operations to control the Virtual Appliance connection.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/BGnxMkf86SPaEmgXEbJOQ_awsfig15.png" alt="img/aws_fig_15.png" position="flex-start" size="69" width="694" height="285" initialPath="img/aws_fig_15.png" githubPath="img/aws_fig_15.png" showCaption="false"}

On the AWS portal, select **AWS Services > Launch Instance**. From the Actions menu, select **Instance State**.

- Click **Start** to start a VM
- Click **Stop** to stop the VM
- Click **Restart** to restart the VM
- Click **Terminate** to terminate the VM

### Troubleshooting

Ivanti Connect Secure emits booting logs at a specified storage. You can check the storage details of the boot diagnostic logs as shown below:

1. Select **AWS Services > Instances > Launch Instance**.
2. From the list displayed, select **Instance Settings > Get System Log**.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/tl0LbFfP6l0gf8HAi7m5a_awsfig21776x260.png" alt="img/aws_fig_21.png" position="flex-start" size="78" width="776" height="260" initialPath="img/aws_fig_21_776x260.png" githubPath="img/aws_fig_21_776x260.png" showCaption="false"}

The system logs window is displayed.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/3PFlCxXMf73t1rcZZlQfJ_awsfig22777x491.png" alt="img/aws_fig_22.png" position="flex-start" size="78" width="777" height="491" initialPath="img/aws_fig_22_777x491.png" githubPath="img/aws_fig_22_777x491.png" showCaption="false"}

### Frequently Asked Questions

**FAQ1: Packets transmitted from ICS Internal Interface are getting dropped by AWS Virtual Gateway in L3 traffic.**

**Cause:** The packets are dropped because the source IP and MAC address are not matching and the transit routing is not supported.

**Solution:** Ivanti Connect Secure must be able to SNAT these packets to the Internal interface IP which belongs to a subnet within the VPC.

To NAT endpoint tunnel IP to Internal interface IP, do the following:

1. Log in to Ivanti Connect Secure admin console.
2. Navigate to **System > Network > VPN Tunneling**.
3. Enable **Source NATTING**. By default, Source NATTING is disabled.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/4Gqzz9MxByLYUIfQ_q3r1_awsfig23787x78.png" alt="img/aws_fig_23.png" position="flex-start" size="79" width="787" height="78" initialPath="img/aws_fig_23_787x78.png" githubPath="img/aws_fig_23_787x78.png" showCaption="false"}

## Deploying on Azure Cloud

For a detailed deployment procedure, refer to *Virtual Appliance on Microsoft Azure Deployment Guide* at [https://www.ivanti.com/support/product-documentation](https://www.ivanti.com/support/product-documentation).

Ivanti Connect Secure accepts the following parameters as provisioning parameters in the XML format.

```javascript
"<pulse-config>

	<primary-dns>8.8.8.8</primary-dns>

	<secondary-dns>8.8.8.9</secondary-dns>

	<wins-server>1.1.1.1</wins-server>

	<dns-domain>psecure.net</dns-domain>

	<admin-username>admin</admin-username>

	<admin-password>password</admin-password>

	<cert-common-name>va1.psecure.net</cert-common-name>

	<cert-random-text>fdsfpisonvsfnms</cert-random-text>

	<cert-organisation>Psecure Org</cert-organisation>

	<config-download-url><value></config-download-url>

	<config-data><value></config-data>

	<auth-code-license><value></auth-code-license>

	<enable-license-server>n</enable-license-server>

	<accept-license-agreement>n</accept-license-agreement>

	<enable-rest>n</enable-rest>

	<registration-code> 1grkL2Xbr </registration-code>

	<registration-fqdn>auto.toad.pzt.dev.perfsec.com</registration-fqdn>

	<enable-proxy>n</enable-proxy>

	<proxy-host></proxy-host>

	<proxy-port></proxy-port>

	<proxy-username></proxy-username>

	<proxy-password></proxy-password>

	<register-network-interface>external</register-network-interface>

</pulse-config>"
```

The below table describes the new parameters that are added in the XML file.

| Parameter                | Type    | Description                                                                                                           |
| ------------------------ | ------- | --------------------------------------------------------------------------------------------------------------------- |
| **New Parameters**       |         |                                                                                                                       |
| registrationCode         | string  | The registration code, which is generated during the ICS gateway registration on NSA. Example, KyZR6YDL8              |
| registrationFQDN         | string  | The registration FQDN name, which is generated during the ICS gateway registration on NSA. Example, sample.domain.com |
| enableproxy              | string  | Default is set to n.                                                                                                  |
| proxyHost                | string  | The proxy server name.                                                                                                |
| proxyPort                | integer | The port number of the proxy server. Example, 8080                                                                    |
| proxyUsername            | string  | The username of the proxy server. Example, usr                                                                        |
| proxyPassword            | string  | The password of the proxy server. Example, pxx124                                                                     |
| registerNetworkInterface | string  | The interface through which the gateway registers with NSA. Example, external                                         |

:::hint{type="info" indent="1"}
The XML parsing fails if the following characters are used in the strings:
\- """
\- "‘"
\- "\<"
\- ">"
\- "&"
:::

### System Operations

The Azure VA portal provides Start, Restart and Stop operations to control the Virtual Appliance connection.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/ucxynKfLBGZEh3o38KrJs_azfig9826x230.png" alt="img/az_fig_9.png" position="flex-start" size="80" width="826" height="230" initialPath="img/az_fig_9_826x230.png" githubPath="img/az_fig_9_826x230.png" showCaption="false"}

On the Azure portal top menu bar:

- Click **Start** to start a VM
- Click **Stop** to stop the VM
- Click **Restart** to restart the VM

The corresponding CLI commands are:

- Start a VM

```javascript
az vm start --resource-group myResourceGroup --name myVM
```

- Stop a VM

```javascript
az vm stop --resource-group myResourceGroup --name myVM
```

- Restart a VM

```javascript
az vm restart --resource-group myResourceGroup --name myVM
```

## Deploying on Google Cloud Platform

For a detailed ICS on GCP deployment procedure, refer to *ICS Gateway Deployment on Google Cloud Platform* at [https://www.ivanti.com/support/product-documentation](https://www.ivanti.com/support/product-documentation).