Go to the Amazon EC2 console.

On the side menu, go to Network & Security → Security Groups.

Click the Create Security Group button, and configure the following:

Field	Description
Security Group Name	Name the group Zscaler NSS. You will associate this security group with the two Network Interfaces you create in the EC2 Instance Provisioning Wizard.
Description	The required description shouldn’t be longer than 255 characters.
VPC	The VPC to which the security group belongs.

In the Inbound tab, click the Add Rule button, and configure the following connection requirements. To connect to your EC2 instance via SSH, you're required to open port 22 for inbound connections. In production, you should authorize only a specific IP address or range of addresses to access your instance and not use 0.0.0.0. To learn more, see Authorizing Inbound Traffic for Your Linux Instances.

In the Outbound tab, click the Add Rule button, and configure the following connection requirements.

Click Create. The inbound and outbound rules are required to enable the NSS AMI to communicate with the Zscaler cloud and Nanolog and enable remote control of the instance via SSH. You can find more details about the outbound connection requirements on https://ips.<zscaler-cloud-name>/nss. The <zscaler-cloud-name> can be found in the URL you use to log in to the ZIA Admin Portal. For example, if you log in to http://admin.zscaler.net , then go to https://ips.zscaler.net/nss .

EC2 provisioning

Select the instance region

Create a new security group

Launch and complete a new EC2 Instance

Create and associate two Elastic IPs