The API Key

The API key authenticates your local Connector instance with the Cloud console. To pull your Connector configuration from the console into your actual Connector instance, you need to use an API key. Every org comes pre-provisioned with a default key called install-connector. If you don’t want to create individual keys, you can reuse this default key across multiple Connector installations.

Note: As a security best practice, we recommend using one API key per Connector to limit cross-device exposure.

SonicWall Firewall Exception: If a Connector is enabled natively inside a physical SonicWall firewall, it bypasses this manual key choice and automatically generates a unique key locked directly to the firewall’s physical Serial Number.

The chosen API key is embedded into the generated installation command line; If a key is revoked or expires, the Connector will lose its connection to the cloud control plane.

Public IPs & Increased Connector Limit Toggle

By default, Cloud Secure Edge only routes traffic destined for private corporate subnets (i.e., RFC 1918 addresses). Enabling the Public IP toggle changes this behavior and supports routing traffic destined for public internet addresses through your corporate network first. It also scales your Connector capacity to more than 100 per org.

Enabling this toggle is only necessary if you plan to force traffic bound for public internet sites/SaaS apps through your corporate infrastructure, or if your enterprise architecture scales past 100 total Connectors.

Note: Requires Windows Connector v2.0.3+, Linux Connector v1.18.4+, or Virtual Appliance v1.18.4-5000-R97+.

Note: Enabling this toggle results in a slightly lower network throughput due to the lower MTU packet size; however, it is a required setting if you need to route non-private internet endpoints through the Connector.

Defining Network Access and Routing

When you’re defining a network in your Connector configuration, you’re explicitly listing which subnets are physically accessible behind your Connector. The configuration allows anything from a massive network range (/8) to a single device host (/32). This is a necessary step to restrict the scope of network access.

If your Connector is later attached to a Service Tunnel, its defined network ranges are pushed automatically to all active end user devices on that Service Tunnel. The CSE app then will intercept end users’ traffic destined for those specific IP addresses and route it securely to the Connector, at which point the Connector hands off the traffic to your local corporate default gateway to reach the destination resource.

Private Domains

This part of the configuration is optional but it allows you to list out internal domains (FQDNs) used within the target network. This input is required if your internal corporate resources use local names (e.g., inventory.local or git.internal) instead of raw IP addresses.

Note: If you add your Connector to a Service Tunnel, the CSE app will intercept all DNS requests matching these domain entries and beam them to the Connector for resolution. The host machine running the Connector must be capable of resolving these domains using its local DNS settings. To ensure hostname resolution functions properly, you must also add these exact domains to the Service Tunnel’s DNS suffix resolution settings.

The Standard On-Premises Office Subnet Scenario:

Scenario

A business has an internal file server (NAS) on their local office network sitting at 10.0.4.50, and developers connect to local staging databases on the 10.0.10.0/24 subnet.

Configuration

Public IPs Toggle: Keep disabled.

What network would you like to make available?: Enter 10.0.4.50/32 (for just the NAS) and 10.0.10.0/24 (for the database subnet).

Private Domains: Enter nas.internal so workers don’t have to memorize IP addresses.

Outcome

End users can reach internal corporate resources through the Connector.

The Whitelisted Public Cloud SaaS Tool Scenario:

Scenario

The company uses a critical third-party accounting web tool hosted publicly on the internet. For security, the third-party vendor has locked the company’s account down so that it only accepts logins coming from the main corporate headquarters’ fixed public IP address. Remote employees working from home are blocked by default.

Configuration

Public IPs Toggle: Enable.

What network would you like to make available?: Enter the public IP address range of the third-party cloud accounting tool.

Outcome

When home users try to navigate to the public accounting tool, the CSE app intercepts the public traffic, tunnels it down to your office Connector, and egresses it out your office firewall—making the remote worker look exactly like they are sitting at their desk in HQ.

There are four potential Connector statuses, defined below.

Reporting: The Connector has reported to the Command Center within the past 7 minutes and it has a connection established with each POP.

Partially Reporting: The Connector has reported to the Command Center in the past 7 minutes, but it is disconnected from at least one POP.

Terminated: The Connector has not reported to the Command Center within the past 7 minutes.

Pending: The Connector was created but has not reported into the Command Center to receive its configuration.