Cisco Crosswork Network Controller 7.2.x Administration Guide

PDF

Cisco Crosswork Network Controller 7.2.x Administration Guide

Configuration prerequisites for new devices

Updated: August 14, 2026

Want to summarize with AI?

Log in

Details the configuration prerequisites for onboarding devices into the Cisco Crosswork Network Controller. It provides guidance on preparing devices through standard protocol settings, configuring event forwarding to Data Gateways, and utilizing platform-specific configuration samples, including IOS XR, IOS-XE, and Nexus.

A configuration prerequisite is a set of device requirements that

  • ensures a new device can be onboarded and managed by Crosswork Network Controller,

  • covers key protocols and platforms, and

  • prepares a device for streamlined integration into monitoring, telemetry, and orchestration workflows.

Devices need to be properly configured before onboarding to ensure compatibility with Crosswork Network Controller. Configuration details may vary by platform and use case, particularly for protocols such as SNMP, NETCONF, SSH, gNMI, syslog, and TELNET.

For specific protocols like LLDP, CDP, and LAG, see Link states and discovery methods in the Cisco Crosswork Network Controller 7.2.x Administration Guide.

Tip

Planning for link discovery in advance helps complete required configuration upfront and simplifies later management, especially when leveraging configuration templates. You can onboard devices initially with partial configuration, using templates to standardize and complete the configuration later. This approach makes ongoing management and compliance with Crosswork requirements more efficient.

Requirements before onboarding devices

Configure devices for pre-onboarding

Prepare devices with standard protocol settings and rate limits before onboarding into Crosswork Network Controller.

Procedure

1.

Set logging for console and monitoring.
2.

Configure TELNET server limits.
3.

Configure SNMP communities and NTP.
4.

Generate SSH keys and configure session limits.
5.

Set NETCONF and XML agents, if MDT is supported.
6.

For Crosswork Network Controller single-VM deployments, enable IPv6 Path MTU Discovery on IOS XR devices that are managed using IPv6. This configuration prevents SNMP response timeouts during detailed inventory collection when IPv6 SNMP packets exceed the 1400-byte MTU supported by the Embedded Collector interfaces.

configure
ipv6 path-mtu enable
commit

The following commands provide a sample pre-onboarding device configuration that sets the correct SNMPv2 and NETCONF configuration, and SSH and TELNET rate limits.

logging console debugging
logging monitor debugging
telnet vrf default ipv4 server max-servers 100
telnet vrf default ipv6 server max-servers 100
crypto key generate rsa
 exec-timeout 0 0
 width 107
 length 37
 absolute-timeout 0
!
snmp-server community public RO
snmp-server community robot-demo2 RO
snmp-server ifindex persist
ntp
 server NTPServerIPAddress
!
ssh server v2
ssh server vrf default
ssh server netconf vrf default
ssh server logging
ssh server rate-limit 100
ssh server session-limit 100
!         
netconf-yang agent
 ssh
!
netconf agent tty
!
xml agent tty
!
ipv6 path-mtu enable
!

Configure devices to forward events to Crosswork Network Controller

Enable Crosswork Network Controller to receive SNMP traps and syslogs from managed devices for alarm and event management.

For most devices, this means you must configure the devices to forward SNMP traps and syslogs to the Data Gateway using its virtual IP as the receiver IP. If you have a geo high availability deployment, configure devices to forward events to both Data Gateway on the primary and secondary data center.

We recommend using a common configuration file for all your devices to allow Crosswork Network Controller to perform a reachability check and collect trap information.

Note

When you configure a Data Gateway pool with spare Data Gateway, failover is handled without changing the IP address that devices use for forwarding traffic:

  • If a Data Gateway fails, the spare Data Gateway automatically inherits the IP address of the failed Data Gateway.

  • If your configuration uses an FQDN, traffic continues to route without disruption even if a Data Gateway in the pool fails because the FQDN remains unchanged.

Before you begin

  • Confirm the Data Gateway pool virtual IP (cdg_virtualIP) addresses.

  • In high-availability deployments, gather both primary and secondary Data Gateway addresses.

Configure a device to forward events to the Crosswork Network Controller server using the snmp-server host command:

Procedure

1.

Configure the device to send SNMP traps to the Data Gateway virtual IP.

Example:

snmp-server host 192.168.90.135 traps version 2c public udp-port 1062
2.

Set the SNMP community strings.

Example:

snmp-server community public RO
3.

Enable SNMP trap notifications for link status.

Example:

snmp-server traps snmp linkup
      snmp-server traps snmp linkdown
4.

Set the SNMP view group.

Example:

snmp-server view { group name } include
5.

In geo high-availability scenarios:

  1. Add both primary and secondary Data Gateway addresses for redundancy.

  2. If using FQDN, ensure the FQDN points to the Data Gateway pool.

Configuration samples for new devices

Before onboarding devices into Crosswork Network Controller, you must ensure that each device is configured according to the requirements of your platform and protocols.

These sections provide configuration examples for supported protocols and major operating systems. Use these reference samples as starting points and adapt the variable values to match your network environment. Review your platform documentation for version-specific requirements and verify that all configurations meet your organization’s security and operational policies.

Configuration sample for Cisco IOS XR devices

These commands provide a sample pre-onboarding device configuration for IOS-XR devices.

Note that <SystemOwner> is a user-supplied variable.

snmp-server community community_name SystemOwner
snmp-server community community_name RO
snmp-server entityindex persist
snmp-server ifindex persist

logging cdg_virtualIP
logging on
logging buffered 307200-125000000

logging source-interface interface_name

logging trap informational
logging events level informational
logging events link-status
logging events link-status software-interfaces

no cli whitespace completion
domain ipv4 host server_name cdg_virtualIP

Set up VTY options: 

line default
exec-timeout 10 
session-limit 10
session-timeout 100
transport input all
transport output all
vty-pool default 0 99 line-template default
TELNET and SSH Settings: 

telnet ipv4 server max-servers no-limit
telnet vrf default ipv4 server max-servers 100
ssh server v2
ssh server rate-limit 60
cinetd rate-limit 60
Configure the NetConf and XML agents: 
xml agent tty
netconf agent tty
Monitor device with Virtual IP address : 
ipv4 virtual address use-as-src-addr
ipv4 virtual address Virtual_IP_Address/Subnet_Mask
Enable CFM modeling: 
snmp-server view all 1.3.111.2.802.1.1.8 included
For SNMPv2 only, configure the community string: 
snmp-server community ReadonlyCommunityName RO SystemOwner
For SNMPv3 only, configure the following settings: 
snmp-server user User Group v3 auth sha encrypted Password priv des56 encrypted
Password SystemOwner
snmp-server view Group 1.3.6 included	
snmp-server view Group 1.0.8802.1.1.2 included
snmp-server group Group v3 priv notify Group read Group
snmp-server group Group v3 priv read v1default write v1default notify v1default
Configure the following to improve the SNMP interface stats response time: 
snmp-server ifmib stats cache
Configure SNMP traps for physical interfaces to ensure that link-down scenarios are captured: 
snmp-server interface subset 2 regular-expression Forty*
notification linkupdown
!
snmp-server interface subset 3 regular-expression Ten*
notification linkupdown
!
snmp-server interface subset 1 regular-expression Hun*
notification linkupdown
!
snmp-server interface subset 1 regular-expression TwoHun*
notification linkupdown
!
snmp-server interface subset 1 regular-expression FourHun*
notification linkupdown
Enable SNMP entity field replaceable unit (FRU) control traps: 
snmp-server traps fru-ctrl
Syslogs are used by Crosswork Network Controller for alarm and event management. NTP settings ensure that Crosswork Network Controller receives the correct timestamps for events. To configure syslogs on the device, add the following settings: 
clock timezone TimeZone
service timestamps log datetime show-timezone msec year
ntp server NTP_Server
logging facility local7
logging cdg_virtualIP vrf name
For Cisco ASR 9000 Series devices operating as Large Routers (LRs), configure gNMI using these commands: 
GNMI Configuration

grpc
 port <port no>
!

Configuration sample for Cisco IOS-XE devices

These commands provide a sample pre-onboarding device configuration for IOS-XE devices. 

snmp-server host cdg_virtualIP
snmp-server community public-cmty RO
snmp-server community private-cmty RW
snmp-server ifindex persist

logging cdg_virtualIP
logging on
logging buffered 64000 informational

logging source-interface interface_name
logging trap informational
logging event link-status default
Disable domain lookups to avoid delay in TELNET/ SSH command response: 
no ip domain-lookup
Enable SSH 
crypto key generate rsa
ip ssh rsa keypair-name keypair-name
crypto key generate rsa usage-keys label key-label modulus modulus-size
ip ssh version [1 | 2]
Setup VTY options: 
line vty <number of vty>
exec-timeout
session-timeout
transport input all
transport output all
For SNMPv2 only, configure the community string: 
snmp-server community ReadonlyCommunityName RO
For SNMPv3 only, configure the following settings: 
snmp-server user User Group v3 auth sha Password priv des Password
snmp-server view Group 1.3.6 included
snmp-server view Group 1.0.8802.1.1.2 included
snmp-server group Group v3 priv notify Group read Group

snmp-server group Group v3 priv read v1default write v1default notify v1default
snmp-server group Group v3 priv
snmp-server group Group v3 priv notify crosswork read crosswork
Configure the cache settings at a global level to improve the SNMP interface response time using the configuration: 
snmp-server cache
Syslogs are used by the Crosswork Network Controller for alarm and event management. NTP settings ensure that Crosswork Network Controller receives the correct timestamps for events. To configure syslogs on the device, add the following settings: 
clock timezone TimeZone
service timestamps log datetime show-timezone msec year
ntp server NTP_Server
update-calendar
logging facility local7
logging cdg_virtualIP vrf default severity info [port default]

Configuration sample for Cisco NSO devices

These commands provide a sample pre-onboarding configuration for a Cisco NSO device used as provider to configure devices managed by Crosswork Network Controller.

This example shows a Cisco NSO configuration that uses the hostname as the device ID. If you are using a CSV file to import devices, use ROBOT_PROVDEVKEY_HOST_NAME as the enum value for the provider_node_key field. The example hostname RouterFremont used here must match the hostname for the device in the CSV file.


configure
set devices device RouterFremont address 198.18.1.11 port 22

In the following example, we are creating an authgroup called "cisco", with a remote name and password of "cisco". Next, we are setting all the devices that have a name starting with "Router" to a device type of "netconf" using the ned-id "cisco-iosxr-nc-6.6". Finally, we are assigning all of the devices with a name starting with "Router" to the "cisco" authgroup. Edit these settings to match your environment:


set devices authgroups group cisco default-map remote-name cisco remote-password cisco
set devices device Router* device-type netconf ned-id cisco-iosxr-nc-6.6
set devices device Router* authgroup cisco

The following CLI commands unlock and retrieve the SSH keys from all of the devices. Cisco NSO synchronizes itself with the devices by uploading each device's current configuration and then storing the present configuration. It is important to use these commands to ensure that the devices, Cisco NSO, and your Cisco Crosswork applications are starting from a common configuration:


set devices device Router* state admin-state unlocked
request devices device Router* ssh fetch-host-keys
request devices device Router* sync-from
commit

Configuration sample for Nexus devices

These commands provide a sample pre-onboarding device configuration for Nexus devices that sets the correct SNMPv2 and NETCONF configuration, and SSH rate limits. The NETCONF setting is only needed if the device is MDT-capable. 

logging console 7
logging monitor 7
!
ntp server <NTPServerIPAddress>
ntp server <10.10.10.11> use-vrf <management or configured vrf>.   
!
ssh idle-timeout
logging level security
!
feature netconf
feature openconfig
!
snmp-server user <User>  auth md5 <String> priv aes-256 <String>
!
snmp-server enable traps link linkDown
snmp-server enable traps link linkUp

snmp-server community community_name RO
!
logging server <IP>
logging source-interface interface_name
logging event link-status default
logging event link-status enable

  • User privileges can be configured as either network-admin or network-operator

  • In Nexus OS, the ifIndex for an interface is persistent.

  • To retrieve the SNMP interface index (ifmib index), use the following command: 
    show interface snmp-index
  • To configure logging for link status or trunk status changes, use the following command in configuration mode: 
    logging event link-status default
logging event link-status enable

Set up VTY options: 

line vty
exec-timeout 10
session-limit 10
Forward events to the Crosswork Network Controller server using the snmp-server host command: 
snmp-server host <192.168.90.135> traps version 2c public udp-port 1062
snmp-server community public RO
snmp-server community private RW
snmp-server enable traps link linkDown
snmp-server enable traps link linkUp
Configure the following to improve the SNMP interface stats response time: 
snmp-server counter cache enable
snmp-server counter cache timeout <1-3600>
Enable SNMP entity field replaceable unit (FRU) control traps: 
snmp-server enable traps entity
Syslogs are used by Crosswork Network Controller for alarm and event management. NTP settings ensure that Crosswork Network Controller receives the correct timestamps for events. To configure syslogs on the device, add the following settings: 
clock timezone TimeZone
ntp server NTP_Server
logging level ntp 7
logging server <IP> use-vrf <vrf name>
The service timestamps feature is not supported in Nexus OS. To set the logging level for a specific facility (e.g., NTP), use the following command: 
logging level ntp 7

Configuration sample for gNMI and gRPC

These commands provide a sample pre-onboarding configuration for a device to enable telemetry using gNMI and gRPC.

gNMI bundling configuration for ASR 9000 series Large Routers

grpc
vrf mgmt
port 57500
no-tls
max-streams 128
max-streams-per-user 128
address-family dual
max-request-total 256
max-request-per-user 32
!
 
tpa
vrf mgmt
  address-family ipv4
   default-route mgmt
  !
  address-family ipv6
   default-route mgmt
  !
!
!

Enabling gNMI bundling is recommended for Cisco ASR 9000 Series devices configured as Large Routers. For inventory collection, gNMI bundling is mandatory to meet requirements. Bundling groups multiple gNMI updates into a single update, which is crucial for inventory collection on high-scale devices.

Sample configuration for gNMI bundling: 
telemetry model-driven
 gnmi
  bundling
   size 65536
  !
 !
!

Configuration sample for IGP protocol router ID

These commands provide a sample pre-onboarding device configuration for ISIS and OSPF.
ISIS router ID: 
router isis 1
 net 49.0010.0100.0004.00
 distribute link-state instance-id 100
 log adjacency changes
 affinity-map top bit-position 101
 affinity-map bottom bit-position 102
 address-family ipv4 unicast
  metric-style wide
  mpls traffic-eng level-2-only
  mpls traffic-eng router-id Loopback0
  router-id 198.19.1.4
  segment-routing mpls 
#show mpls traffic-eng igp-areas
Fri Oct  4 03:53:16.117 UTC

MPLS-TE IGP Areas

Global router-id:         198.19.1.4
Global optical router-id: Not available

IS-IS 1

    IGP ID:                      0010.0100.0004
    TE router ID configured:     198.19.1.4
                 in use:         198.19.1.4
    Connection:                  up

OSPF router ID:

router ospf
 distribute link-state instance-id 6
 router-id 1.1.1.20
 segment-routing global-block 16000 17999
 segment-routing forwarding mpls
 segment-routing sr-prefer  
#show mpls traffic-eng igp-areas
Fri Oct  4 03:53:28.091 UTC

MPLS-TE IGP Areas

Global router-id:         1.1.1.20
Global optical router-id: Not available

OSPF

    IGP ID:                      1.1.1.20
    TE router ID configured:     1.1.1.20
                 in use:         1.1.1.20
    Connection:                  up

Configuration sample for MDT sensor group

These commands provide a sample pre-onboarding configuration for a device to stream telemetry data. 
telemetry model-driven
!
destination-group Crosswork
  vrf mgmt
  address-family ipv4 x.x.x.x port 9010
   encoding self-describing-gpb
   protocol tcp
  !
sensor-group Crosswork
  sensor-path Cisco-IOS-XR-infra-tc-oper:traffic-collector/afs/af/counters/tunnels/tunnel
!
subscription Crosswork
  sensor-group-id Crosswork
  destination-id Crosswork
!
!

Configuration sample for SNMPv2 and SNMPv3 traps

These commands provide a sample configuration for a device to send SNMP traps.

For SNMP v2 traps:

snmp-server trap link ietf
snmp-server host cdg_virtualIP traps version 2c Community String udp-port 1062
snmp-server community Community String
snmp-server traps snmp linkup
snmp-server traps snmp linkdown

For SNMP v3 traps: 

snmp-server trap link ietf
snmp-server host cdg_virtualIP traps version 3 Community String udp-port 1062
snmp-server community Community String
snmp-server traps snmp linkup
snmp-server traps snmp linkdown

Configuration sample for SNMPv3 data collection

These commands provide a sample configuration for SNMPv3 data collection. These commands must be added in addition to the SNMPv2 commands referenced in the section, Configuration sample for SNMPv2 and SNMPv3 traps. 
snmp-server group grpauthpriv v3 priv notify v1default
snmp-server user <user-ID> grpauthpriv v3 auth md5 password priv aes 128 password