Device Onboarding for Catalyst SD-WAN

Hello everyone. Good morning, good afternoon, good evening, wherever you are joining from. Thanks for joining us today on site series Catalyst SD.00:09So these are series that we've been doing for some time now. So today we we have we are looking at the topic that is very interesting. Of course, there's a device onboarding for Catalyst SD one. So before we dive into.00:21What we are going to be looking at, today we have our presenters today. 1st is saying and then 2nd person that will be working on through the device onboarding is Anna Stasia.00:37So we've seen our 20 years flows of industry experience based in dar, Saudi Arabia. He has a CCD and then three CCI certified, so with that you can see very very capable hands. So.00:53Whatever questions you have concerns you have as regarding onboarding device, not sure that we are going to help you out here on this session. Now, our second presenter Istasia, he's also a customer success specialist.01:11His last three years closed experience with Cisco CSS team focused on SD one. And design and also a Cisco live speaker. So as you can see, our prodentials are.01:29A very very expect in the future, so we'll start the session and so over to Youssain. Thank you. Sorry. Yeah. Good morning, everyone. Thank you for being here and we pass it to.01:45A bit in a hurry but just to wait like a couple minutes more until the rest of the people join. We started a little Slido, you can find the Slido at the bottom of your Webex screen or you can scan the QR from your phone.02:05And join, we just have some introductory questions to get to know how you're feeling about the topic that we are going to discuss today. So we'll be very appreciative of your feedback, of your answers, and let's just wait 2 min for people to.02:22To have the time to join.02:42In the meantime, let me go through the agenda for today. 1st of all, we are going to start with some revision from the 1st session that we did in this expert insight series that was about what is.02:56Is a smart account, what is a virtual account? How do these things all connect with the PNP portal, the plug and play portal, and how you can see your devices from there, set up your account, set up your inventory, and everything that is necessary for you to operate your SD WAN network.03:12In peace, basically. Then we are going to go through how to onboard your devices there, how to prepare the portal itself to get SD WAN devices and to build your SD WAN fabric. Then how to update the device list while, inside the SD WAN manner.03:31User which is something you need to do in order for devices to be able to find, the SD one. Then we're going to talk about the security and authentication that the devices in SD WAN use, which is certificates.03:51Certificate based trust that we have between all of the devices in our fabric, and then we're going to go through the different kinds of onboarding processes that we can do and some tips on monitoring and troubleshooting during the bring up process.04:05So with that, let's start with the basics, which is what is device ownership? How does it work at Cisco? So devices nowadays are not just the hardware, are not just the router or the switch that you're buying, but as you know very well, we have different.04:22Current licenses that you are buying?04:43Through Cisco Commerce workspace. It's here. It's a site that you go to your accounting also works on what kinds of licenses you're going to get and for you to have your software, your licenses, you always have a smart account and or every.04:46Virtual account. But how do these things work? The smart account is basically what allows you to join Cisco from the software side. It gives you your credentials to authenticate yourself in all of the software that you're going to buy.05:05Anytime at Cisco. So you have one smart account for your company, but because you buy different products that have different licenses, if you just put them inside a folder called your smart account, then it would be a huge mess because you might have like thousands of licenses there. So you can set up the.05:21Different.05:41Subfolders in this smart account where you call them virtual accounts. Those virtual accounts help you segment your licenses and your software because you can have the security team inside their own virtual account working on the security products so the security licenses only to have control.05:42And visibility over them instead of everything else in your network. The netops team, you might have them in another virtual account where they work only on the networking licenses. It could be also not about the technology but about the regions. So e.g., you might have different licenses that you have bought in the.06:02Americas region in the APJC, in the EMEA.06:22So you can segregate them also the geographically so that you have better control, you have smaller repositories to keep up with and each team has the right control for what they are doing. So what is happening inside every virtual account is that you have all of your devices and the different devices.06:26Is in Cisco like the SD one e.g. that we are speaking about today. They have different controllers that control the software side.06:46Okay, so inside your smart account and inside your virtual account, you can find all the information that is necessary to bring up all of your SD WAN devices, all of your ICE devices, all of your catalyst center devices, the different different the different kinds of devices that point to different controllers and the.06:56Need to be connected. They are all part of your smart account and inside their own virtual accounts that you can have the different technologies so that you have better control and better visibility over everything that you do. All of the authentication that you need to have, 1st of all passes through your virtual account.07:15So it's very important that you set them up right and then you, you don't have any headache when you're dealing with them and maintaining them and keeping up with them.07:36So what do virtual accounts do? The virtual accounts help you set up the different teams, group them together as they should, and in your virtual account or if you, even if you don't have virtual accounts in your smart account.07:45Then you can see in a centralized way, what are your licenses that you have? What is the balance you can review, so when it's time to renew, you know how to better plan it. So e.g., you might have bought 50 licenses, but in the end you had only 40 branches, 40 devices. So you see that you have.08:04Then extra that you didn't need, so next time you might want to plan accordingly. And it gives you it helps you inside your virtual account to keep track of all the changes, all the purchases that you're doing over the years, all the logs that your devices are, are leaving. And the good thing about.08:24Not setting up the virtual accounts is that you have the different teams being focused only on the technologies that they need to. So they don't have to lose themselves in everything. And inside each of the virtual accounts, again, you can segmentize this more. You can set.08:44Add virtual accounts anytime from inside your smart account and you can move the licenses from one virtual account to the other. So the admin has to only do this one time and then you're set up and you can straight away add your your new licenses at any time inside the virtual accounts that you have set up.09:04So it's easy to organize. Now, what is happening inside the PMP portal? 1st of all, when you log in into the software.com.cisco.com, you can see, a lot of options for what you can do with your account. You can set.09:23Up in your account, you can set up new users in your account with different levels of access like virtual account administrators instead of smart account administrators. You can manage your licenses, you can buy more licenses from there.09:43For the devices that need them and you can in general do your day to day work. There is one option that points to the plug and play portal, which is this one, the automate device discovery and activation on prem from the cloud. If you, if you click on that, on the managed devices.09:58The the managed devices option gets you to a view of a list. And this list has all of the devices that you have bought that are Cisco devices and they are pointed to your account. You might have routers, switches, endpoints.10:17For your data center, for your security, everything can pass through the PMP portal that you have purchased with a license from Cisco. And you again can segmentize. If you are more organized, you can choose the virtual account that you want to see.10:36And the user as well, instead of watching the whole list with all of the devices there. So we are in the 1st tab that has all of the devices and all of these devices have a lot of information for them that have to do 1st of all their serial number, their model.10:54What kind of device it is, of course, and then we have a thing called the controller here. As you are well aware, I can imagine if you watched any of the previous sessions, you know, that most of the Cisco products, including SD WAN work with a centralized management model, which.11:14Help you simplify your operations and really accelerate what you do with your network.11:34Having a centralized management means that you need to have some kind of controller. And in the SD one case, we have the controller that we need to set up 1st so that all of the devices can find it.11:41The controller, which is the V Bond or the value in the SD WAN case in order to be able to see the the SD one fabric in the 1st place when they are trying to join. So we need to set up the controller. The controller profiles can be found inside 2nd tab, which is controller profiles.11:56And in there, you can see, you can add different kinds of controllers. For SD WAN, you need to set up a controller type of, which is for your SD WAN routers to find when they are trying to join the SD WAN fabric. Other kinds of controllers might be a local PAP server if you.12:16You want to set it up or a wireless LAN controller, e.g., if you have catalyst center with your wire, for your wireless network, you know that all of the access points, when they are trying to find the centralized management, they point to and connect to the WLC, the wireless LAN controller. The same thing is happening for SD one.12:36When all the routers connect to the V bond. The important information that you need to have inside the V Bond, your controller for the routers to be able to connect to it is the deployment type, which is something you always need to decide beforehand, NO matter what, then the V Bond needs to have a.12:56But an IP before address because that is the address that the devices are looking up to when you turn on to controller mode, and they also need to have the organization name.13:16The organization name is a very important identifier for your SD one fabric to separate your devices from other devices, just like when you have the Cisco employees, they are all belong, we all belong to a specific organization, and that's why we have specific.13:26Authentication that passes for all of us.13:47Now, when you're trying to add devices, you can do it in a manual way. It's not very complicated. It's just one by one. And we have hardware devices and software devices because you might have ordered a physical router which is a hardware device or you might have.13:50Ordered a virtual device, which means that it will be just a software that you need to install.14:10And we're going to show you both later. So after you click the add devices, let's say in the, in the hardware device mode, then, you have two kinds of sources. Either you enter the device manually.14:16Or you can import using the CSV file. But let's see the manual import 1st. All of the devices that you are buying from Cisco are bought with already some basic configuration in them. And part of this configuration is the identification of the device.14:34You have already the devices certificate that makes it a Cisco device that you, you can be sure that it's a Cisco device after you bought it for if you have. Based on that.14:54This thing on the left that you see is what opens up in the PMP portal. So when you are trying to add a new device, there are specific fields that are added like the certificate serial number, the serial number of the device again here and the device.15:07Is the the controller profile that the device is pointing at?15:26That all of them need to match because if this here is not a V bomb controller, then the device is not an SD one device basically that's how it works. If you this this happens if you are doing one by one. If on the other hand, I want to import.15:30A dozen devices that I've ordered at the same time, I can do it in bulk instead of going one by one. And the the way to do this is by making a CSV file with all of this information from all of the devices that I put in a list. So I can have, you can download the sample C CSV that will have in.15:50Instructions in it and then you need to put in the missing information like the sudy number and the certificate serial number.16:10You put it in a CSV file and then you upload the file and basically that's it. It's pretty easy again and saves you a lot of time when you have ten or a hundred devices to bring up in your, into your network.16:19So, how do you connect the devices to your controller? The controller that you have set up, the V Bond type of controller in SD WAN.16:35It has a specific file that is the provisioning file. You can download that and then add it to your devices if you need to, then turn them into an SD one mode. Now.16:50Let's go to, to how the devices authenticate each other and how we can establish secure trust between all of the endpoints in our SD one network, the controllers, the, the routers, the data centers, everything that we have in the SD WAN fabric.17:05The SD one devices use a cryptographic mechanism called the certificates. These are encrypted keys that the devices exchange with each other and with the controllers in order to pass a validation test, let's say, and be sure that it's the.17:28Device you wanted to have. There are different certificate authority options that you can have in SD WAN. You might use the Cisco keys or you might have your own enterprise key.17:48Key infrastructure to to to create the randomized keys that will do the encryption for all the traffic that passes through the devices. Until a few versions before until.18:03The end of life was last year, I think. We, Cisco also had Simontech and DigiCert certificates, but now we have our own Cisco mechanism for that. So all of the new devices can come with the Cisco authentication and encryption for the keys. Now.18:19For the Cisco I you have two different methods. You have the completely automatic way to generate your certificates, which is the simplest one of course, and for that you use your smart account credentials to connect to the devices. That's why it's very important to have all of your devices in.18:38The PFP portal.18:58And the PMP portal, ask acts, sorry, as the certificate authority. You can do that in the automatic way or if you don't have straight access from the SD WAN manager to the PMP portal, you can set it up also manually.18:59Which is a little bit more work. The same way that you do with the manual method, but with a few extra steps that we're going to describe in a bit, you can also set up your own certificate authority.19:19Or a 3rd party certificate authority, but you just need to do some extra things for the root of the certificates that you're generated in that case. So let's go each to each of them one by one. 1st of all, where do you find what where to generate the certificates?19:33Where to find them and all of that stuff. You go to administration and you go to the settings and you find the certificates.19:53And you are going to see the controller certificate authorization. This is the 1st one that you need to, to find. The certificate authorization means that you have the manager act also as the authority that will generate your CSR.20:01After you go to the controller certificate authorization, then you can choose the three different ways that we described before, like the Cisco automated one, manual using again the Cisco PKI or the enterprise route certificate way.20:21So with the automated way, the manager needs to be able to connect to the, to the server of the PMP. If not possible, then the process is very simple because the man the the administrator initiates the CSR, so you're clicking e.g..20:38Example the recommended you say and when you trigger that, what happens is that the manager reaches out with the request for the certificate that goes to the Cisco server, then.20:58The server, which is the certificate authority, approves and signs the CSR, it sends it back to the manager. So the manager, the SD WAN manager, will get whatever certificate you asked for straight from the server and it will be signed and authenticated already. That.21:14The manager will push it to the validators and to the controllers and so you can authenticate all of your controllers in your network.21:34This is the simplest way if the manager already has access to the server. This is the only prerequisite for it. If the manager, the SD WAN manager doesn't have connection to the PMP portal.21:43Then you need to go with the manual way. And in the manual.22:03Set up of the, of the, of the certificates, you again initiate the request as an admin, you send it to the manager. The manager generates the CSR, which is like a big.22:08For humans unreadable more or less file. Then you download that because you need to take it somewhere local, where afterwards you upload it, you submit the CSR yourself as the admin to the server, to the authority. And then the things are going to be, things are going to work out the.22:24Same way but with you instead of the direct connection as the intermediate, so you are going to get the signed CSR and the signed certificates that are generated from that CSR, and then you need to upload the certificates to the SD WAN manager and then the.22:44Manager again will automatically post to the validator and the controller.23:04The manager will always be connected to the validator and the controller, so you don't need to go locally to every controller. You just need to do the things between the manager and the server. So you act as the intermediate if there is NO connection to the PMP portal.23:09Now, there is also the 3rd way to do it. Ah, but 1st let's see where it is. So if you go to configuration and control components, if you need to generate yourself the CSR, what you can find that here.23:251st of all, you're going to go to the controller that you want to get the certificate for to the actions, and in this case, you're going to generate the CSR, which is the request you need to make to the certificate authority. So these are the 1st steps that you need to take. After you generate.23:41Create the CSR.24:01It's a file like this, and this is for the validator. Another one will be for the manager. Another one will be for the controller. Each controller has their own CSR that you need to, to, to generate. You need to download the file or copy paste it, and then you're going to send that to the certificate.24:04Authority to generate the certificate. So for each of the files, for each of the controller components, you have a different CSR.24:23After that, if you're doing the manual way, then you go to the plug and play portal as the administrator and a few tabs to the right from where we were before to the certificates, you can generate a new certificate. If you, if you generate the certificate, you need.24:32To put the CSR here, the certificate signing request, you need, you can name it.24:52You can, you need to put the validity period, which is very important for the certificates, and then if you click next, it will generate the certificate. Then you will have a list of all the certificates that you have generated inside the PMP portal that you need to download.24:59And then go back to the manager configuration and control components just like we had before. And instead of generating a CSR, then we install the certificate. So you have to, you have, you can like paste the text that you get from the certificate.25:17And then it will be validated.25:37The validity of the certificates in something very important that you need to choose here. I'm going a bit backwards, but the validity is very important because it ends at some point. The certificates cannot go on forever because you need to have them expire and generate new ones. As the.25:40This one gives you warnings for when the certificates are go are about to expire six months before. You can see it in the banner of your SD one and it gives you a warning for six months. So during those six months, you can go through this process step by step and generate new certificates for when you need to.26:00Then, the 3rd way that we are going to create certificates to request certificates and generate them is if you don't go with the PMP as the certificate authority, which is for the automated and the manual Cisco process, you can have a 3rd party enterprise rule certificate.26:21If you do that, you need to do one extra set of functions.26:41Because you need, inside the manager the root certificate for all the certificates that are going to be generated so that they can authenticate themselves. If you're using Cisco as a certificate authority, then this is already there because of the certificates pre installed in your devices that validate that it's a.26:46Cisco device. If you go with a 3rd party, you need extra authentication for that. So what you 1st need to do is set up the enterprise certificate authority server.27:06Wherever you get it from, either if it's your own home server or if you get it from a 3rd party, the 1st thing you need to receive a root certificate. And at the admin you upload the root certificate to the SD WAN manager.27:18The SD WAN manager pushes them the root certificate to the controllers so that they can all use the same kind of authentication. And then the process is more or less the same as we were doing in the manual, so you as the admin initiate the certificate signing request, the CSR, to the manager the way we were doing before.27:33You download the CSR, you send it to the CA server, and then you get the signed certificates from that server. And then you get that as the admin, you get them locally, you upload them just like we were doing before to the SD WAN manager and the SD WAN manager automatically pushes that to the rest of the controller.27:531st.28:13And now all of your controllers are validating. So the next stage after you have set up your controllers is to set up the devices. And to set up the devices, you need to 1st have the device list, which is very important.28:14So there are a few steps that we are following while you are that you need to follow when you're setting up your SD WAN fabric. 1st of all, you decide whether you're going to go with Cisco hosted controllers, which we use the Cisco Cloud uses AWS infrastructure and Azure. Or if you're going to have your controllers log.28:34Locally in your own data center, where you need to set up the right hardware for and the hardware hypervisors, and the containers for all your controllers. Then you're going to.28:54Deploy the controllers and authenticate them as we were doing before, and then is to configure everything and add the device list before you start adding routers. After you have added the desired device list, then the routers can be added to the SD WAN fabric.29:08Right.29:28And why is that? Because the SD WAN manager is the only source of truth, the single source of truth from for your SD WAN inventory. All of your devices and controllers and backup, everything that you want or might want to have in SD WAN passes to.29:29Through the manager. And this is very important because it means that if you don't keep the file of the device list in the manager updated, then you might have problems with devices finding the SD one fabric when you have a new device that you want to join. So it's very important that this provisioning file of all of the devices you want to.29:49You have in your network is in the SD WAN manager. And the SD WAN manager will share this file with the device list with the validator in the controller, which as you see especially when you send it to the validator is very important because this is the 1st.30:09Door that the, that the device needs to open in order to get visibility and access into the SD WAN fabric. So the validator needs to have an updated device list all the time so that it can accept the new validated devices that are going to join. So the all of the controller.30:29Have a list like this that has the information for all the devices that might join. It has the chassis number, the serial number, the organization name of these devices, and then some more information about, e.g., where they are valued or not now. And at any point you can go to this.30:49Device list if a device has been compromised, has been broken or anything has happened to it, at any point you can go through the SD WAN manager and invalidate this device and automatically the manager very soon will send a update.31:08Of the device list where this compromise device is not there anymore. It's invalid, so it will stop having access to the controllers and to the rest of the SD one fabric of course. So it's very important to keep your device list updated and if any time any security breach or any even hardware failure happens.31:23Then you can update your devices accordingly. Now, how do you find that? If you want to add the device, you go to configuration to one edges and inside the manager you're going to have at 1st nothing.31:43But you can do two things. If you already have your devices synced inside the PMP portal, then you can just click on syncing the smart account and then it will retrieve the information from the PMP portal straight away. Or you can manual.32:00We upload the one its list, which is your inventory.32:19In either case, whether which one you choose, you're going to have a workflow opening and explaining to you what is going to happen. So you can either log into your smart account or upload a file manually with the one it's listed and, and move forward. What is happening.32:24When you're adding the device. If I'm going to log into my smart account, e.g., I'm going to put my credentials here, then the manager, the SD one manager, will make a request to the PMP portal and from the PMP portal you can get the information straight away with whatever was last there from the provision devices.32:43If on the other hand, I choose to upload manually a serial a file with all the serial numbers of my devices and all the information that I get him to do, I just have the CSV or, and I drag and drop it into this box.33:03Again, it's very simple, and 1st you can download the sample CSV and then fill in the information and upload the field file. After you click next.33:20Then I'm going to have the list of all the devices and I can choose or not choose some of the devices that in the end I want to add from my inventory. So even if you have a big file that NO, not all of the devices are going in the end to pass into the SD.33:36Manager, you can still choose from those devices which ones you want to move forward with. And then there is like an optional step that you need to fill in before you have the devices working and you onboard them fully. If you remember also from the last session about templates, sometimes in the templates.33:56If you don't put all of the information for the device in the template, but we leave some variables. The variables are the information that we need to put in manually. Manually or in bulk with again another CSV files, so you can export the list of the devices you have, you have.34:16Filter that you want to add. And so you get the CSV, you put in all the missing information for all the devices, and then you import the fielding list with all the information. And then if you click apply, of course, then it passes and you have your list of edge devices.34:36Onboarded into your manager. This is, you don't onboard the devices yet. This is the way you onboard the device list into the manager. Sorry.34:57Now, there are some optional fields that you can still choose after you have your other devices, like adding a tag, if you're going to make the data center devices, you can tag them as such. If they're going to be in a region, you can tag them as such. This is not a mandatory variable, of course, you, you might have.35:13All your devices and but it helps if you have a lot to group them together because then you can filter with the tags that you want to see like oh the the devices in Lisbonne or the devices in London or the devices in in Germany instead. So you can.35:33Put tags on your devices to label them and group them better. And after you click next, then the device list is updated and you are ready to go through to onboarding the devices. So when you have a lot of devices, they still now.35:51Now you have just a list of the devices, it's ready to start getting the actual requests of devices to join.36:11And now I'm going to give it over to Hussain, to my colleague, to show us a demo of this process. So can you see my screen? Yes.36:20Okay, very good. So, so what we will do right now, we'll go to our configuration, and then we'll go to devices and then when edges. So this is the list of devices that currently exists on the catalyst manager. So we have 14 devices.36:36Is as you can see here.36:56So these 14 devices, these 14 devices, these are the number of devices that we currently have. So what we will do, as we mentioned before, if we click on, on.36:59Sync smart account or upload Both of them will give us the same workflow. So you can see it will give us the quick connect workflow, and from this workflow, you still have options. You still have options to log into the smart account or upload using the provisioning file.37:17That we got from the PMP portal.37:38So in, in our demo, we can just use like a username and password or the virtual account that this we manage is is part of. So you need to be, so this should be.37:41Your CCO.38:01Account and you should be a user or an admin of the virtual account that has the controller profile that has the organization name that is configured for this particular deployment. So just put the.38:03Password and hit next.38:22So right now, we manage is trying to communicate with the, with the PMP portal. And you can see that there are some duplicate devices because they are all from the same organization, so we have 14 devices on the.38:28On on the manager, I added them manually out of 25 devices. So there is there is new eleven devices that can be added, and you can see they are on they're on this list. So we can choose all of them.38:43Or or part of them depends on on your requirements or the, the devices that you want to to add to this to this white list. As you can see, my lab has only virtual devices, so that's what we are working with right now. So.39:01We will hit next.39:20So here, this is an optional, so these should be like the serial number of different devices. You should know where these devices will will end up in most of the cases. So these could be serial numbers for different sites in different regions. So what you.39:23You can do is you can either double click here to to edit these devices or you can do this in in bulk. If I export this, this will be exported as a CSV file.39:42And this CSV file, you can simply I cannot drag my but my sharing is a little bit missed up, so it's a CSV file that I can also.39:58Fill. So I will fill all of this data and then I I will import the file. So this is the CSV file and I filled all of this information. So I can open and it will fill the data for me and then I will hit apply. So this will apply, so you just, you you give it the.40:19Initial information that you want to mark these serial numbers. So later on when you get the full list, you will be able to identify the device.40:39A quicker using maybe the system ID or or the host name. Then you hit next. You you can add a tag if you want and Ascea mentioned you can have group of devices that are going to different countries or different cities, so you can group them with tags that will help you.40:50Later on to identify the devices quickly or select them in bulk.41:10So you hit next and then this is the last step is to onboard, the devices. So when you hit import, now all these serial numbers has been whitelisted and they are ready to be onboarded into the environment.41:16So as we mentioned, once we do this step, the V manage will will send a device list update to all of the controllers. So if we go back to conf configuration and one edge devices again, so we used to have 14 devices, now we have 25 devices.41:35So some of the devices that we have added are these ones as we as we did.41:55So this is how, you integrate your smart account with your V manage. I think we manage every 30 min they query the smart account to make sure that they have the updated list of of the devices. So if you're doing an RMA for.42:01Example you will invalidate the device from.42:21From the managed and you will need to make sure that the new serial number of the the new hardware is added to yours to your PMP portal and make sure that the serial number has been synced successfully over here. If there's a problem that you cannot sync this information, you still.42:26And go to the PMP portal, download the.42:45The provisioning file and upload it here. It's also mentioning worth mentioning that you can add multiple types of of of files. So before we had only the serial file that the file that you download from.42:49From the the PMP portal, but with the later versions you can have a text file or a CSV file, of course with a specific format that you can upload here and get get the information and if you want to see the format.43:09Of the CSV file you can simply click on sample CSV and this will give you the type of information that you need to fill.43:29So this is for adding the devices or or to or the update the device list on vmanage. So now vmanage and the controllers know all the serial numbers of the devices that need to join the SD WAN fabric.43:37So, so the next step is to start onboarding the devices. So we will start talking about the device onboarding the device onboarding process. So, so we have multiple ways to add a router to an SD WAN fabric. Of course we have the.43:55And the manual method is basically we prepare the.44:16The configuration for the device. Optionally we can attach a device to a template if we want this device to be managed by, by the manager. But this is optional this is recommended to always use templates or configuration groups.44:21And then on the device manually, we will, on the CLI of the device we will paste this configuration. It could be the full device configuration or it could be a minimum amount of configuration just to stage the device to get access to the controllers, and then.44:41If we have, a template or a device or a configuration group already deployed for the serial number, the the router will download the full config. So so this is the manual method, the bootstrap method, we call it also the one touch provisioning. So basically.44:59This is as you can see the manual method requires hands on, requires someone who has a knowledge to manage a Cisco router and be able to do the proper configuration. The bootstrap method has a lighter touch to the device, so you can take the device out.45:19Out of the box or just put it on a controller mode and boot it. But you will generate the full configuration of the router on on on the manager. You download it on a USB stack and when you reload the router will boot the router for the 1st time, you need to make sure that this USB.45:39Mistake is connected to the router and the router will come up with the full configuration. The last method is the zero touch provisioning, and this is basically relies on an internet connectivity where the router communicate with the Cisco global ZTP server. It will identify itself based.45:59On its serial number and then the global ZTP will direct the router to.46:19To the right, validator of of its own organization and we will talk in the next slides in details about about these methods. So for for any onboarding option.46:25There are some prerequisites and it is it is very simple. We that the device serial number need to be already whitelisted on the managers and the devices need to have reachability to to the controllers. So this is very very obvious.46:40So the 1st method is the manual onboarding, and for the manual onboarding there is a minimum amount of mandatory configuration that need to be that need to need to be configured. So the 1st step here, this is an optional step to stop the PMP agent. So the PMP.47:00P agent will be running by default on the router. So this is an optional step you can do it or or not. So the 1st one is to just stop the PMP agent from running.47:20And then the 1st set of configuration that you need to configure is the system configuration. So you need to configure a system IP for the device and this has to be a unique, it's in an IBV four format and it has to be unique across the entire fabric. If you configure.47:33There are a system IP that is already existing this device will not come up. You will also need to configure the site ID.47:53The organization name, the organization name, this is the same name that has been configured in the controller profile in the BMP portal and all the devices in the fabric must share the same organization name. This is basically the overlay or the fabric identifier that the.48:01Organization name.48:21You will need also to configure the validator IP address or DNS name. So these are the, the system configuration that need to be on the device to be able to get access to the controller and have the right, organization name config.48:22You got it. If you have any of these information wrong, the device will not will not come up.48:42So the next set of configuration is any configuration that will allow the device to reach or have IP reachability to the controllers. So here we configure an interface, we give it an IP address, and we do all necessary routing that will allow this device to reach.48:49Under controllers. So this is from IP reachability app point of view. In order for the device to be able to build.49:09An overlay tunnels. So this is the set the the next set of configuration that we need to do, which is to configure is to configure the tunnels. So we will configure if we are configuring.49:18Gig one we better keep this mapping and configure tunnel one. And when we configure tunnel one, the IP address of the tunnel will be a numbered from the gig interface, so it will have the same IP address. The the tunnel source will be the interface and the tunnel mode will be is.49:34And under the SD WAN configuration mode.49:54This is when we define the tunnel interface and we define the encapsulation and color for this to be able to build an overlay tunnel. And then in in Cisco, if a router is running in controller mode, you need to do, you need to do commit to.49:58Commit the configuration.50:18So let's do a quick demo for the manual configuration. So here I have, I have a router, so this router.50:22Is.50:42Has been right erased, it doesn't have any configuration. So this is a virtual device that I pre activated just to simulate because I don't have a hardware device, but from this point it's exactly like if you have physical router and you want to to configure it, if I do show SD WAN.50:44And.51:03Control our local properties, you can see that we don't have anything configured, NO organization name, nothing. It's just absolutely clean. So what we will do is we'll take the device.51:06Serial number, we will go back to the catalyst manager, and we will attach a template to the device. So once we.51:24We understand this device is is part of which site and what is the site design and based on the site design we build the templates or the configuration groups. So we will choose the template and we will attach a device to the template. So we'll paste the serial number.51:33We will attach the device to, to this template, and now we will we will do the full configuration of of the device. So the template will have some variables and based on these variables we will configure the device.51:53So now we have all of the configuration, we will hit next, and then we will configure devices. And of course, this template or this configuration will be on vmanage. The vmanage will not be able to push it to the device to the because the device is still.52:08Unreachable. So once the device communicate to vmanage, V manage will will will will trigger the router to download the config. As you can see here, the status is scheduled. So we will go back to the device.52:29And now we can configure the minimum configuration for for the router. So let me get the config. So I prepared the config, so 1st we will go to the configuration mode and we don't use conf configure term terminal anymore, but we.52:45Use a config transaction to get to the configuration mode.53:04And from here, let me just copy my config so again the 1st section is the system configuration. We configure a system IP.53:09Site ID and the organization name and the view bond in this in this lab is a DNS name. So this DNS name need to be resolvable by the DNS.53:29The DNS server or you need to configure a static DNS entry as I did here. So the V bond reachability is is mandatory for this process because V bond is the gatekeeper of the fabric and this is the 1st device the device will communicate with.53:42So this is the 1st section. 2nd section is to configure or to choose the interface that we will configure, and for this configuration I just configured DHCP. This is the configuration for the tunnel interface. So the IP is a numbered from this interface and it's also.54:04Resource.54:22In the SD WAN is the tunnel mode. And finally we configure under the SD WAN config mode, we configure that for this interface we configure under the tunnel interface the encapsulation and the color. So the last step is to commit the configuration, and once we commit the configuration.54:24The device will start communicating with, with V bond. And once V Bond authenticate the device, V Bond will send the V manage and or the the manager and.54:43The controller or vsmart information. So before we do that, let's just quickly prepare and just need to prepare to show you the steps or to monitor how the device is coming up.55:00So we go to certificates just to show you, what is happening. So you can see we went to configuration and then certificates and then when edges, and I just put the serial number of the device and you can see this is the status.55:18Of the certificate. And if you.55:38If you cursor over it, it will show you the status of of this device. So, so now the device is ready to just commit the configuration, so that's what we will do. So we will commit.55:43So we're connected to the console of the device, so you can see all of the all of the logs. And as you can see the OMB demon has come up it got a DHCP on the interface and it is it has.56:01Communicated with one of the V bonds and what else yeah and V bond give the V manage information to the device and the device communicated with V manage and V managed communicated back successfully. So you can see and and this is the.56:21The certificate or being started to the the CSR has been generated. So if you go to vmanage, if we refresh over here, you can see the CSR has been generated. So Cisco.56:38Has generated CSR for the router and copied the CSR and the the the manager will sign the certificate on behalf of the CA and then it will push the the new signed certificate to the router. If you refresh here again so that we still here on this step.56:55I I I I find it very exciting to see this happening in in action and, and, and follow everything. So you can see here there's an installed certificate happened. So if you go back here and we do refresh.57:15So you can see that certificate has been installed. So once the certificate is is installed, now the router can it will reset all of the control connection and it will start communicating again to the to the V bond.57:33And then it will communicate with vmanage. It will download all of the config. You can see the prompt here is still still router, but once it starts to get the config from from vmanage, the prompt will change to the, to the real host name of of the device. It will also.57:51To build a control connection to the controller and within this control connection the.58:10OEMP overlay management protocol will be working, so the router will receive all the routing updates. So you can see all of this is happening. So the router should If we go to like from here if we go to configuration and devices.58:18And, let me put the device serial serial number here. You can also monitor the the different stages of the device. If we go here, if you go to configuration.58:36When each devices under devices, you put the serial number of the device and then on these three dots over here, if you click on device bring up, this will show you the different steps the device is is going through. So once it is authorized by V bond.58:53You will get this green tick otherwise you will get like a red, a red cross or a red X over here. So we can see over here that the device authorized with.59:12With V bond. It received the configuration and it established connectivity to the controller, so now it's received all of the routing and also the data plane connectivity has been established. This means the overlay tunnels has been established. So if you go back to the device.59:24I will not go through the like all of the logs, but you can see the com communication was with or the controller is up and from here you can see that the, the, the device host name changed and.59:43From here, and this is for all the onboarding methods, the verification that you would do after that is to make sure that the device control connections are up, so you can do show SD WAN.01:00:01Controlled connections and you can see that control connections with the controllers are up and also you can do show is the BFT sessions to make sure that the overlay tunnels is being established with other with other sites.01:00:18You can see all this information also in, in the managed or in the manager. So if you go to monitor devices, you choose the device. So this will give you.01:00:38That this is the monitoring page of this router and it will give you the all of the information of the device. This is this page is for hardware health, but you can go down to our control connections, and this will show you.01:00:56The control connections that has been established. So this is for the manual method for the bootstrap config, so basically, as we said, the bootstrap config is.01:01:13When you can when when the device is maybe you want to onboard a device on an air gapped environment or the router will be connected only to MPLS, there is NO internet, the router cannot reach to the controllers over the internet, but in the same time you cannot stage the device and.01:01:33Like in your in your location and you want someone to be able to remotely like from like someone who doesn't have the knowledge to configure a router, but in the same time you need to be able to get this router to to communicate with the, with the.01:01:52Controllers. So what we will do is we can generate a bootstrap config and this bootstrap config can be put on a file and this file can be put on a USB stack.01:02:12And someone with a minimum knowledge of of IT they can use the USB stick to connect it to the router and boot the router. And once the router is, is booted it will get all of the configuration loaded on the router.01:02:23And then, the router will be able to reach to the controllers and and join the fabric. The router could be like a whole new like a new router or if it is an existing router, then, we can.01:02:42Put it in SD WAN in in in SD WAN controller mode. So we put it in controller mode and if you put it in controller mode, you need to, so if the router is running autonomous mode, there's just a regular router and you want to.01:03:01Converted to an SD WAN router, so you will issue the command on on the privilege mode, control mode enabled and this will reload will reset the router and reload it. If the router has previous SD WAN config and you want to reset it you will use you will use this command.01:03:18So this command is in if the device is in already in controller mode and has previous configuration.01:03:37So how we generate the bootstrap config as 1st we go to configuration, and then we choose the router that we want to generate the config. And of course we need to have the template.01:03:50The template assigned to the device 1st because based on the templates and the configuration on the template all of this will be generated in in the config. So we click on the three dots on the right and then we choo.01:04:06Use a generate bootstrap config and then we will choose the bootstrap configuration method, so we usually use that cloud in it for.01:04:25A KVM deployment and for deploying hardware devices and then we hit ok and then as you can see, the config will be generated. So from here we download.01:04:38The file and when we download the file, the file format will be the serial number of the device and it will be the serial number of the device.and the extension of this file will be CUG or config.01:04:55Up.01:05:14So once we get, once we get, when we as we said, when we download, when we download the device, it will be in this or when we download the file, it will be in this format. The chassis number or the serial number of the device.CFG. So what we need.01:05:16Need to do is in order to get this bootstrap to work, we need to rename the file to this name, Cisco SD WAN to CFG and this file need to be on the root of the.01:05:35The the storage device that will be connected to the router. So it has to be on the route. So the router will will look for this file on the on the route of the, of the attached storage or the USB file.01:05:52And it will use the config inside this router to configure the router. There is also a way that you can configure or you can copy this configuration to the boot flash and maybe to the startup config as well and then you reload the router.01:06:08So let's do a quick demo. So the demos from here are very easy and so that nothing is is complicated about it. So what I will do is I'll choose any.01:06:26Any device let me check on my list ok so so 1st I'll go to my, to the templates, so I will choose the template that I will use for my device. So in this case I'll use for this this template.01:06:42So I'll go here and say attach devices. So let me just give that just bear with me a second.01:07:02So this is the serial number of.01:07:23Of the device that I will be adding, so I'll add the device to the template. So I will fill this configuration either manually or I can.01:07:26Uploaded using the CSV file.01:07:46Oh, and then I will just push the configuration. And of course the configuration will not be it will be scheduled until the device boots up but we will have, we will have to wait for this to complete.01:07:49Because after this step, we will have to go and generate the bootstrap configuration. So this is done, so let me put this. Then I will go to configuration devices.01:08:07I will search for this serial number and I will go here and I will do generate bootstrap configuration. So, so over here it will give you it will give you the host name.01:08:23That is in the template, the device model and the site ID, so if I hit ok, I will get all of this So this is all of the configuration on on the device. I can I can download it from here.01:08:42And when I download it, it will, when I download it it will give me a file that has the serial number of the device.cfg. So we will.01:08:58Rename it, put it on a USB stick and didn't be connected to a device. So from here I can just just simulate this so this is again, this is not a hardware device, this is a virtual device. So in my lab I can just.01:09:15This is just a simulation of configuring a device. So this is typically is like putting this on a USB stick and connected to the device. So this file actually will be copied to the router, and you can see it has this name.01:09:33But this is just for the the KVM deployment. So if I start this router, so let me just get to the console of this one. So this will take a very long time to do boot, but we.01:09:51Can come back to it. So.01:10:11So this is the bootstrap method. So next we will talk about the zero touch provisioning, so this is the most seamless way to onboard a device. So the key here is the router will be able to reach the the BMP portal using the internet.01:10:14So, and, and once the device reaches the BNP portal, the B the BNP portal or the global ZTP will inform the router, here is the information for your own validator.01:10:34And here is the information for should so the router will terminate that this connection with BMV and then we'll communicate with the organization we bond. So the prerequisites, of course, the device need to be able to.01:10:48Like reach the internet it it needs to be able to resolve this this DNS name, device helper.cisco.com. So excuse me. So each Cisco router.01:11:07Is shipped with some configuration and it is configured if the device is in control mode, it will try to communicate to devicehelmer.com as the V bond or the validator or the default validator for.01:11:24For the for the device. So if it can resolve this name, it will be connected to the BMP portal. And as we mentioned before, that's why the serial number of the device need to be in the BMP portal, need to be in the right virtual account, and it has to be part of the.01:11:43The correct controller profile because in the controller profile if you paid attention to the slides that went through, the the DNS name of the.01:12:02Of the con of the controller of the V Bond or the validator is configured and also the organization name. So this is how everything is tied together. So when the router comes up, it will communicate with devicehelper.cisco.com, and based on the device serial number.01:12:16And there is there is a white list for the global ZTP that shows that this serial number is part of this control profile, and in the control profile there will be the the information of the organization validator and then the PMP portal will send this information to the router and then the router will start to.01:12:36Communicate with the validator of its own organization.01:12:56So there is one step also that we can we can do, which is if you have a deployment of SD WAN, you could have this deployment like a while ago, like a year ago, and the new routers that get shipped might be shipped with.01:13:03A newer versions or even an older version of of code, so you can enforce.01:13:23When the devices comes up, what kind or what version of of iOS the router will come up with. So if you go to administration, and then enforce software.01:13:30So from here you can you will get a list of, the different model groups. So it's not all the models, it's model groups, and based on the model groups, you will be able to, you will be able to define where is the image, so the image can be on.01:13:47Local server which is this V manage or if you have other V managers that you're using them for image repository, then you can define them on this list and and and then you define the.01:14:07The software version that you need, that this group of devices need to come up when they come up they need to be on this on this image. So what happens is when the router communicates with the organization validator and the device get authenticated, the router will.01:14:22Will communicate with the manager and then the manager will start doing an ICE upgrade 1st and then do and then push the configuration to to the router.01:14:42So this is, this is this is an optional step if you want to have a specific version running on on the router. And it is a good way to do a nice upgrade or downgrade before the router becomes operation.01:14:53So the steps basically the router will come up so you turn on the router and if the router, so the assumption is that the router will have access to the router will have access to the internet.01:15:12So the router need to be connected to the internet on the transport side and this internet connection is able to resolve the device health.cisco.com. So the router will communicate to the device.cisco.com.01:15:30And based on that serial number of the device, the global ZTP or the PMP portal will inform the router with the correct IP address of the organization validator.01:15:45Then the device will communicate with the validator, the validator will will validate the device and its certificate and it will send the information for, the manager and the controller to the device so and we need to make sure that the device.01:16:01For for for this device serial number, we need to make sure that there is a template already attached because when the device communicates with the manager the device need to download some configuration. So if there is NO template or configuration group deployed for this particular serial number.01:16:18This will, this communication will fail or we will it will actually stop and will give you some some error un until you update or attach a template for this device serial number. So, so once the device communicates with the manager, the manager will.01:16:36Check multiple things. One of them is the the software version on the router. If there is an enforcement list configured, then the, the, the manager will enforce an ICE upgrade or downgrade with the right with the right image. And then the device will reboot and and communicate again with the manager and then receive the.01:16:55Configuration from from the manager. Once it gets the.01:17:15The configuration from the manager, it will start building or communicating or completing the establishment of control connections with the controller receive all of the routing information and then starts to build the overlay, the overlay tunnels.01:17:19So there are some logs that you can watch for, when the device is booting up. So these are just for we we will share this content with you but you can see that you need to make sure that the device has booted in.01:17:42Has booted in, sorry, has booted in controller mode, you need to make sure that there is this interface has came up which is the one interface that is connected to the to the internet. You can see that the device helper.cisco.com.01:17:59Has been resolved and it have given you the like the show you the the IP address. It is trying to communicate or connect or connect to connect to the PMP portal, it is connected you can see it is sending the serial.01:18:20Number and the PID or the product ID.01:18:39And you can see it has received the organization name, and it's a host IP from the right validator. So you can see these are the different logs.01:18:43And it the device communicated with the the manager that received there is a signing request, a routine certificate installed and then once the CSR is signed, a new certificate has been.01:19:02Installed and then this is the tunnels with the controller is up and this pretty much the end of the the booting process on on ZTP. So these are some of the important logs that you need to watch out while the device is is booting.01:19:22So let's just go back to the lab quickly and see this router. So this is the router that we did, the bootstrap configuration for, and it looks like the device is up, so let's check and see how you I mean from here is.01:19:49Yeah, the router is is configured and if we do show SD WAN control connections so this is not this is not up.01:20:08I know why, but basically if I try if I do show is the and this is a little bit of troubleshooting but that's not part of this session we we will do this in the next in the next set of sessions that we do, but it's good just to show you what could be a problem that you might face. So if I do show SD where.01:20:26And, control local properties. So this is the DNS name of the V bond. And if I try to ping, this name, it will fail, so I know this I know this.01:20:46This this issue and this is the reason why it didn't it didn't come up so I'll just wait until this so it's trying it's basically trying to resolve it but it will not so that's why it is if it doesn't have access to.01:21:02To the V bond or the validator, the device will not be able to to communicate. So, so the last, the last section that we have is to onboard a virtual device and onboarding a virtual device requires an extra step.01:21:22Because all of the hardware devices are shipped with a hardware chip that is on the motherboard of the router itself and we call it the act two chip or the outer anti counterfeit trust chip.01:21:40And within this chip, there is a Cisco there is a certificate signed by Cisco CA and this chip, this particular module on the motherboard of the router is tamper proof. So if anyone tried to.01:21:58Tamper with this chip, the the chip will self destruct and the router will be rendered unusable. So this is just to make sure that this particular hardware is actually manufactured by Cisco and it's not manufactured by one yet, but by anyone else that might like steal your information. But with.01:22:19The virtual routers, this level of trust cannot be established to this particular device unless there's a piece of information.01:22:38That you need to create it from a higher authority like the V manage. So this is one we the piece of of information is the token or a one time password. So we will generate a one time password on a higher authority device, which is the V manage.01:22:50And then we share it with the virtual device to authenticate this device. So this is the only extra step that we will, we will do to onboard a virtual device. The rest of the configuration is, is exactly the same. We attach a template or a configuration group to the device and then.01:23:10We configure the device with the minimum configuration to reach the controllers and then the device once it reaches the controllers, it will receive the configuration and join the fabric. So we basically go to configuration certificate when each devices. We choose the device and then.01:23:30I, as you can see here, the device has a a chassis number and a token. So we basically take this token, and configure it on on the device itself.01:23:50So, so we can do a quick demo for this for this part I'm sorry we don't have time for that. We need to, we need to accelerate a bit.01:24:09Sorry. Oh, ok. So it's basically use this command request platform on the on the VH cloud device you put the the chassis number and and the token. And once you configure it, then the device will start communicating with with the manager and do the the exact same process.01:24:25So you can see here we generate the bootstrap config, and then from here you can just get the OTP and configure it on on the device.01:24:45So, in terms of troubleshooting, we we already covered this part. So if you click on device bring up, this will show you this chart that will show you at which stage the router is in. So this is one one way of of checking it to.01:24:56To monitor the device certificate, you would have multiple.01:25:16Statuses, as you can see here, this one shows that the certificate is installed. This will show the CSR is generated this is if the token is already generated for the for the virtual devices and bootstrap config has been generated.01:25:22You can also, once you finish onboarding the devices, you can go to monitor devices and then control connection to make sure that the control connections are up. These are some of the show commands that will help you.01:25:43Identify the state of of the device or the the the status of the control collection of of the device. There are some onboarding issues if you have the wrong organization name, the wrong side, the wrong system IP, you will get different error met.01:25:59And you can use this command to show these errors. So this is basically everything we have for you today. I'll give it back to you I'm not sure Anesthesia or or betater.01:26:19Yeah, I can like keep sharing. Thank you everyone for joining. We have like your feedback, another slider that has been open for some time, some some people have already answered, so we would really appreciate if you could give us your thoughts about this webinar. If you go to the next.01:26:37Slide.01:26:57Something very important is that this expert inside series, as you know, this is already the 4th session that we're doing, but we have more planned until the end of the year. We have three more for November and December that will delve into deeper.01:26:59Deeper configuration issues of the SD one, not for this kind of setup that were the 1st group of sessions, but more about actually using it for policy creation, which is what makes your your network smarter and more agile, more flexible, more about monitoring and for troubleshooting as well.01:27:17So you can scan the QR and start registering for the sessions. You can also find it in the community.cisco.com website. So you can just go there and see the descriptions and sign up for whatever sessions that you want.01:27:37Next slide. This is all from our side. We hope you enjoyed this webinar with, with the topic of device onboarding and the prerequisites for it. If you have any more questions or if you would like to follow up, when you close this.01:27:56Window, you're going to pop up to a webpage where you can give us your email and the CSS team are our team, we are going to reach out to you for any follow UPS and you can ask us your questions. And, I think we have answered all of the questions we had in the Q and A.01:28:15So with that, thank you Hussein, thank you also Peter and Roger for being panelists and answering all the questions throughout the session. And we hope to see you next time in November for the policy creation session that we're going to do. Have a great day everyone, and thank you for being here.01:28:36Okay.01:28:55