Configure Field Network Director to use Plug and Play on IR800

Introduction

This document describes how to get started with Field Network Director (FND) and Plug and Play (PNP) with the use of minimum set of components.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

• Experience with Linux and knowledge in order to edit run configuration files on a Linux machine
• At least one of the supported routers to be managed by FND. For example IR809 or IR829.
  • Console access
  • Minimum IOS® version 15.7(3)M1
• OVA file deployed to a hypervisor (For example: VMWare ESXi). The OVA file, if entitled, can be downloaded from: https://software.cisco.com/download/home/286287993/type/286320249

Components Used

The information in this document is based on these software and hardware versions:

• OVA file for FND version 4.5.0-122 (CISCO-IOTFND-V-K9-4.5.0-122.zip)
• VMWare ESX
• IR809 with IOS® version 15.8(3)M2

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

Since FND has many different deployment options, the goal is to be able to set up a minimal but working, installation for FND. This setup can then serve as the start point for further customization and in order to add more features. The setup explained here is with the use of the Open Virtual Appliance (OVA)-packaged FND installation as the start point and it uses the easy mode in order to avoid the need for Public Key Infrastructure (PKI) and tunnel provisioning. Use PNP, in order to simplify and to add devices to the installation.

The result of this guide is not intended to be used in production as there might be some security risks due to plan-text password and the absence of tunnels and PKI.

  

Configure

Deploy and Configure the FND OVA

Step 1. download and deploy the FND OVA file to your hypervisor. For example for VMWare, this will be through File > Deploy OVF Template as shown in the image.

Step 2. Once it gets deployed, you can start the VM and is presented with a login screen, shown in the image.

The default passwords for the OVA file are:

• username: root password: cisco123
• username: cisco password: C_sco123

Step 3. Login with the cisco user and password and navigate to Applications > System Tools > Settings > Network. Add a wired profile and in hte IPv4 tab, set the desired IP address or DHCP as shown in the image.

Step 4. Click Apply and toggle the connection off/on in order to ensure that the new settings get applied.

At this point, you should be able to navigate to the FND GUI with your browser and the IP-address configured as shown in the image.

Step 5. Login to the GUI with the use of the default username and password: root / root123

You are prompted to change your password right away and then redirected to the login once more.

If all goes well, you should be able to login with your new password and be able to navigate through the FND GUI.

Further, PNP and demo mode are described followed by the configuration of FND.

About PNP

PNP is the most current Cisco method to do Zero Touch Deployment (ZTD). With the use of PNP, a device can be fully configured and the need to touch the configuration manually will not arise.

For FND, with the use of PNP, the need to first bootstrap the router is avoided. In fact, all that PNP does, redirect it to the FND, in a secure way, and fetches the bootstrap configuration.

Once the bootstrap configuration is present in the device, the rest of the process is continued as with a classic bootstrapped device.

There are different ways to use PNP:

• Through the Cisco PNP service (devicehelper.cisco.com), with the use of a Smart Account. Enabled by default out of the factory on certain devices
• With the use of DHCP option 43 in order to supply the IP or hostname to connect to for bootstrapping
• By manually setting the PNP-server in the configuration

For this configuration, PNP-server IP is manually set, which is the FND-server's IP, and port on the device. In case you would like to do this with DHCP, you should supply the information as follows:

For Cisco IOS®, the DHCP-server should be configured as follows:

ip dhcp pool pnp_pool
network 192.168.10.0 255.255.255.248
default-router 192.168.10.1
dns-server 8.8.8.8
option 43 ascii "5A;K4;B2;I10.48.43.231;J9125"
!

For DHCPd on Linux: 

[jedepuyd@KJK-SRVIOT-10 ~]$ cat /etc/dhcp/dhcpd.conf
subnet 192.168.100.0 netmask 255.255.255.0 {

option routers 192.168.100.1;
range 192.168.100.100 192.168.100.199;
option domain-name-servers 192.168.100.1;
option domain-name "test.dom";
option vendor-encapsulated-options "5A;K4;B2;I10.48.43.231;J9125";
}

In this configuration for option 43 or vendor-encapsulated-options, you need to specify these ASCII strings:

"5A;K4;B2;I10.50.215.252;J9125"

It can be tailored as follows:

• 5 – DHCP type code 5
• A – Active feature operation code
• K4 – HTTP transport protocol
• B2 – PnP server/TPS/FND server IP address type is IPv4
• I10.48.43.231 – FND server IP address
• J9125 – Port number 9125 (port for PNP on FND server)

More information with regards to PNP with DHCP can be found here: https://www.cisco.com/c/en/us/td/docs/routers/connectedgrid/iot_fnd/guide/4_3/iot_fnd_ug4_3/sys_mgmt.html#31568 in the section: Configure DHCP Option 43 on Cisco IOS® DHCP Server

About EasyMode

Easy mode has been introduced since FND 4.1, although it was called demo mode at the time, and allows you to run FND in a less secure way. Although this is not recommended for production, it is a good way to get started.

With the use of easy mode, you can focus on the PNP-process, bootstrapping and configuring of the router. In case something does not work, you do not need to suspect the tunnel build-up or certificates.

Changes that occur when you configure FND to run in easy mode:

• No need for a Head End Router (HER) or a tunnel to the FND server.
• No need for a Public Key Infrastructure (PKI) setup and Simple Certificate Enrollment Protocol (SCEP).
• No need for router certificates, trustpoint, and SSL certificates.
• All communication is taking place over HTTP instead of HTTPS.

More information regarding easy mode can be found over here:

https://www.cisco.com/c/en/us/td/docs/routers/connectedgrid/iot_fnd/guide/4_1_B/iot_fnd_ug4_1_b/device_mgmt.html#85516

Configure FND for PNP and Easy Mode

Now, you know what demo mode/PNP is and why it is used in this context. Let's change the FND configuration in order to enable it:

On the FND VM, which originated from the OVA file, connect with SSH and edit the cgms.properties as follows:

[root@iot-fnd ~]# cat /opt/fnd/data/cgms.properties
cgms-keystore-password-hidden=dD5KmzJHa64Oyvpqdu8SCg==
use-router-ip-from-db=true
rabbit-broker-ip=
rabbit-broker-port=
rabbit-broker-username=
rabbit-broker-password=
fogd-ip=192.68.5.3
enable-reverse-dns-lookup=false
enableApiAuth=false
fnd-router-mgmt-mode=1
enable-bootstrap-service=true
proxy-bootstrap-ip=10.48.43.231

The last three lines changed in the configuration file.

• Line 10: enables easy mode
• Line 11: enables PNP
• Line 12: sets the IP of the FND-server to contact

After you change the file, restart the FND container in order to adapt the changes made:

[root@iot-fnd ~]# /opt/fnd/scripts/fnd-container.sh restart
Stopping FND container...
fnd-container
[root@iot-fnd ~]# Starting FND container...
fnd-container

Once restarted, the rest of the configuration can be done with the use of the GUI.

Prepare the CSV and Add the Router to FND

It might sound a bit illogical to add the device at this point of the configuration process but unfortunately, parts of the configuration are not available until certain device types have been added.

This is done in order to avoid the GUI to be too overwhelming as different devices introduce different options.

Here, let's try to add an IR809 to FND.

The CSV looks as follows:

deviceType,eid,adminUsername,adminPassword,ip
ir800,IR809G-LTE-GA-K9+JMX2022X04S,fndadmin,C1sc0123!,10.48.43.250

The fields in the CSV are:

• deviceType: ir800
• eid: PID and serial together with +
• adminUsername: this username will be added to the router config and later will be used to complete the registration process
• adminPassword: password for adminUsername
• ip: the IP address to substitue in the configuration of the device after deployment

In order to add this device, connect to the GUI and navigate to Devices > Field Devices > Inventory > Add Devices as shown in the image.

In the dialog, specify the location of your CSV file and click Add to add it to FND as shown in the image.

If all goes well, you should see the history item to list "COMPLETED". After you close the dialog, the device should appear in the inventory as shown in the image.

Since the device of deviceType ir800 was added, the applicable templates and groups will become available in the GUI at this point.

Prepare the Provisioning Settings, Bootstrap Template and the Configuration Template

Since FND is configured for demo mode, it is needed to change the provisioning URL to use HTTP instead. Navigate to Admin > Provisioning Settings in order to do so:

Change the IoT-FND URL to http://<FND IP>:9121

Next, configure two minimal templates for bootstrapping and configuration.

The first one, called Router Bootstrap Configuration template, is the configuration that is pushed to the router once it is able to successfully contact FND with the use of PNP.

If PNP is not in use, it would be the configuration that is put on the router manually or in the factory at the time of the bootstrap process. This configuration contains just enough information for the router to start the registration process in FND.

The second one, called the Configuration template, will be the configuration that is added to the currently running configuration of the device. In fact, it can be seen as an increment on the existing configuration.

In most cases, this leads to an odd situation, so it is recommended to first erase all configurations on the router before you add it to FND.

In order to set the Router Factory Reprovision template, navigate to Configure > Tunnel Provisioning > Router Bootstrap Configuration and replace it with the following template:

<#if isBootstrapping = true>
<#assign mgmtintf = "GigabitEthernet0">
<#assign fndserver = "10.48.43.231">
<#assign sublist=far.eid?split("+")[0..1]>
<#assign pid=sublist[0]>
<#assign sn=sublist[1]>
 
<#-- General parameters  --> 
hostname ${sn}BS
ip domain-name ${sn}
ip host fndserver.fnd.iot ${fndserver}
service timestamps debug datetime msec localtime show-timezone 
service timestamps log datetime msec localtime show-timezone
!
<#-- Users  --> 
username backup privilege 15 password C1sc0123!
username ${far.adminUsername} privilege 15 password ${far.adminPassword}
!
<#-- Interfaces  -->
interface ${mgmtintf}
  ip address ${far.ip} 255.255.255.192
exit
!
<#-- Clock  -->
clock timezone UTC +2
!
<#-- Archive  -->
file prompt quiet
do mkdir flash:archive
archive
  path flash:/archive
  maximum 8
exit
!
<#-- HTTP -->
ip http server
ip http client connection retry 5
ip http client connection timeout 5
ip http client source-interface ${mgmtintf}
ip http authentication local
ip http timeout-policy idle 600 life 86400 requests 3
ip http max-connections 2
!
<#-- WSMA -->
wsma profile listener exec 
  transport http path /wsma/exec
exit 
!
wsma profile listener config 
  transport http path /wsma/config 
exit
! 
wsma agent exec
  profile exec
exit 
!
wsma agent config 
  profile config 
exit
!
<#-- CGNA -->
cgna gzip
!
cgna profile cg-nms-register 
  add-command show hosts | format flash:/managed/odm/cg-nms.odm
  add-command show interfaces | format flash:/managed/odm/cg-nms.odm
  add-command show ipv6 dhcp | format flash:/managed/odm/cg-nms.odm
  add-command show ipv6 interface | format flash:/managed/odm/cg-nms.odm
  add-command show platform hypervisor | format flash:/managed/odm/cg-nms.odm
  add-command show snmp mib ifmib ifindex | format flash:/managed/odm/cg-nms.odm
  add-command show iox host list detail | format flash:/managed/odm/cg-nms.odm
  add-command show version | format flash:/managed/odm/cg-nms.odm
  interval 10
  url http://fndserver.fnd.iot:9121/cgna/ios/registration
  gzip
  active
exit
!
<#-- Script to generate RSA for SSH -->
event manager applet genkeys
  event timer watchdog name genkeys time 30 maxrun 60
    action 10 cli command "enable"
    action 20 cli command "configure terminal"
    action 30 cli command "crypto key generate rsa modulus 2048"
    action 80 cli command "no event manager applet genkeys"
    action 90 cli command "exit"
    action 99 cli command "end"
exit

end
</#if>

In order to set the configuration template. Navigate to Config > Device Configuration > Edit Configuration Template and add this template:

<#-- Enable periodic inventory notification every 1 hour to report metrics. -->
    cgna profile cg-nms-periodic
      interval 60
    exit
<#-- Enable periodic configuration (heartbeat) notification every 15 min. -->
   cgna heart-beat interval 15

<#-- Enable SSH access -->
line vty 0 4
  transport input ssh
  login local
exit

This template will be the resulting router's running configuration. So any specific configuration for this configuration group should be added here.

The easiest is to start with this minimal template. Once successful, update and tailor the template according to your needs.

At this point, the configuration/preparation of FND is done and you can start with preparing the router.

Prepare the IR800 for Provisioning/PNP

If the device which you want to provision already contains a configuration or has been used before, it is better to completely erase the configuration of the router before you add it to FND with PNP.

Obviously, if this is a new device, this step can be skipped.

The easiest way to do this is with the use of the command write erase and reload the router with the use of the console.

ir809kjk#write erase
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]
[OK]
Erase of nvram: complete
*Oct 18 11:42:54.367 UTC: %SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram
ir809kjk#reload

System configuration has been modified. Save? [yes/no]: no
Proceed with reload? [confirm]

Starting File System integrity check
NOTE: File System will be deinited and later rebuilt

After some time, the IR800 should come back with the prompt to run the initial configuration dialog:

         --- System Configuration Dialog ---

Would you like to enter the initial configuration dialog? [yes/no]: no


Press RETURN to get started!

Ensure there are no more remains of a previous PNP/ZTD attempt, it is best to recreate the archive and directory and to remove the before-registration-config on the router as well:

IR800#delete /f before-*
IR800#delete /f /r archive*
IR800#mkdir archive
Create directory filename [archive]?
Created dir flash:/archive
IR800#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
IR800(config)#archive
IR800(config-archive)#path flash:/archive
IR800(config-archive)#maximum 8
IR800(config-archive)#end

Right now, you either have a new device or a device with an empty configuration, so, if needed, this is the moment where a minimal configuration in order for the router to reach FND can be applied.

In case you have a DHCP-server, most of this should go automatically. 

The follow manual configuration is selected on the device:

IR800>enable
IR800#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
IR800(config)#int gi0
IR800(config-if)#ip addr dhcp
IR800(config-if)#no shut
IR800(config-if)#end
*Aug 1 12:02:02.887: %SYS-5-CONFIG_I: Configured from console by console

IR800#ping 10.48.43.231
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.48.43.231, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
IR800#

As you see, a quick ping was performed in order to test if the router was able to reach FND with the applied IP configuration.

Provision the IR800 Router

At this point, all prerequisites are complete and you can initiate the PNP process. It is done manually in this instance.

In a production environment, most likely, PNP will be used with DHCP option 43. It means that once the router is started, it receives an IP and the PNP configuration and you can skip this step and the next.

In order to manually configure PNP on the IR800 without DHCP, you need to specify the destination for the requests, which will be the FND-server.

This can be done as follows:

IR800(config)#pnp profile pnp-zero-touch
IR800(config-pnp-init)#transport http ipv4 10.48.43.231 port 9125
IR800(config-pnp-init)#end

As soon as you enter the line starting with "transport", the router starts the PNP process and will try to contact FND on the given IP and port.

If all goes well, the device passes through these:

• [UPDATING_ODM]: update the ODM (Operational Data Model) files on the device to match with the ones valid for the current FND version
• [UPDATING_ODM_VERIFY_HASH]: check if the updated files are correct
• [UPDATED_ODM]
• [COLLECTING_INVENTORY]: collect the current configuration and device info
• [COLLECTED_INVENTORY]
• [VALIDATING_CONFIGURATION]: try to apply the configuration from the bootstrap config (substituted Router Factory Reprovision template)
• [VALIDATED_CONFIGURATION]
• [PUSHING_BOOTSTRAP_CONFIG_FILE]: apply the validated configuration
• [PUSHING_BOOTSTRAP_CONFIG_VERIFY_HASH]: check if the applied configuration is correct
• [PUSHED_BOOTSTRAP_CONFIG_FILE]
• [CONFIGURING_STARTUP_CONFIG]:write the configuration as startup config
• [CONFIGURED_STARTUP_CONFIG]
• [APPLYING_CONFIG]: apply the startup config
• [APPLIED_CONFIG]
• [TERMINATING_BS_PROFILE]: stop bootstrapping.

You can track the process in the FND server.log.

In the GUI, you will see the device move when you navigate to Unheard > Boostrapping > Bootstrapped

After the bootstrapping is completed, the router has the substituted Router Factory Reprovision template and behaves like a regular bootstrapped device without PNP.

In other words, a CGNA profile on the IR800 tries to register with the FND server.

Check the status of the CGNA profile:

JMX2022X04SBS#sh cgna profile-state all
Profile 1:
Profile Name: cg-nms-register
Activated at: Thu Aug  1 15:31:14 2019
URL: http://fndserver.fnd.iot:9121/cgna/ios/registration
Payload content type: xml
Interval: 10 minutes
gzip: activated
Profile command:
    show hosts | format flash:/managed/odm/cg-nms.odm
    show interfaces | format flash:/managed/odm/cg-nms.odm
    show ipv6 dhcp | format flash:/managed/odm/cg-nms.odm
    show ipv6 interface | format flash:/managed/odm/cg-nms.odm
    show platform hypervisor | format flash:/managed/odm/cg-nms.odm
    show snmp mib ifmib ifindex | format flash:/managed/odm/cg-nms.odm
    show iox host list detail | format flash:/managed/odm/cg-nms.odm
    show version | format flash:/managed/odm/cg-nms.odm
State: Wait for timer for next action
Timer started at Thu Aug  1 15:31:14 2019
Next update will be sent in 9 minutes 30 seconds
Last successful response not found
Last failed response not found

With the provided configuration, the device will try to register with FND after ten minutes. You can see that in this output, nine minutes and thirty seconds remain before the router starts the registration process.

You can either wait for the timer to finish or manually execute the cg-nms-register profile immediately:

IR800-Bootstrap#cgna exec profile cg-nms-register

Verify

Use this section in order to confirm that your configuration works properly.

The device should move to the UP status in FND as shown in the image.

Troubleshoot

This section provides information you can use in order to troubleshoot your configuration.

In order to troubleshoot the bootstrapping process, check these:

• FND server log in: /opt/fnd/logs/server.log
• Increase the verbosity of the log in: Admin > Logging > Log Level Settings > Router Bootstrapping > Debug
• From the IR800 console: show pnp ? or debug pnp ?
• In the FND GUI: Devices > Inventory > Select Device > Events
• Most of the issues in this stage are related to (syntax) errors in the Router Factory Reprovision template

In order to troubleshoot the registration process, check these:

• FND server log in: /opt/fnd/logs/server.log
• From the IR800 console:
  
  
  • show cgna profile-state all
  • debug cgna logging ?
  • debug wsma agent
• In the FND GUI: Devices > Inventory > Select Device > Events
• Check WSMA connectivity over HTTP to the IR800 from the FND VM
  
  • URI used by FND: http://10.48.43.231:80/wsma/exec
  • Method: POST
  • Security: basic auth