Step 1

Create SR-PCE credentials

1. Navigate to Administration > Credentials Management.

2. Click Add Credential Profile.

3. Enter the required values:

   • Profile Name: Enter a descriptive name.

   • Username: SR-PCE admin username.

   • Password: SR-PCE admin password.

4. Click Save.

Step 2

Add SR-PCE provider and verify connectivity.

1. Navigate to Administration > Manage Provider Access, and then click .

2. Enter the required values for the SR-PCE provider fields. For information about the fields, see the Add Cisco SR-PCE Providers.

3. Click Save to add the SR-PCE provider.

4. Confirm that the SR-PCE provider shows a green Reachability status without any errors. You can also view the Events window (Administration > Events) to see if the provider has been configured correctly.

5. Repeat this process for each SR-PCE provider.

Step 1

Generate certificates using OpenSSL.

1. On your Linux server, create a file named extension.cnf.

2. Copy this content into the file and replace the parameters based on your environment.

   [ req ]
   distinguished_name = req_distinguished_name
   req_extensions = req_ext
   extensions = req_ext
   
   [ req_distinguished_name ]
   countryName = Country Name (2 letter code)
   countryName_min = 2
   countryName_max = 2
   stateOrProvinceName = State or Province Name (full name)
   localityName = Locality Name (eg, city)
   organizationName = Organization Name (eg, company)
   organizationalUnitName = Organizational Unit Name (eg, section)
   commonName = Common Name (eg, fully qualified host name)
   commonName_max = 64
   emailAddress = Email Address
   emailAddress_max = 64
   
   [ req_attributes ]
   challengePassword = A challenge password
   challengePassword_min = 4
   challengePassword_max = 20
   
   [ req_ext ]
   basicConstraints = critical,CA:true
   subjectAltName = IP:<IP-address, IP-address...>
   
   [ v3_ca ]
   subjectKeyIdentifier = hash
   authorityKeyIdentifier = keyid:always,issuer
   basicConstraints = critical, CA:true
   keyUsage = critical, digitalSignature, cRLSign, keyCertSign

3. Replace the IP addresses in the subjectAltName line with your actual device and SR-PCE management IPs.

Step 2

Generate the root CA key, device key, device Certificate Signing Request (CSR), sign the device certificate, and encrypt the device key.

1. On your Linux server, run the command.

   openssl genrsa -out rootCA.key 2048
   
   openssl req -config extension.cnf -extensions v3_ca \
   -subj /C=/ST=/L=/O=/CN=RootCA \
   -x509 -days 365 -new -nodes -key rootCA.key -sha256 -out rootCA.pem
   
   openssl genrsa -out device.key 2048
   
   openssl req -subj /C=/ST=/L=/O=/CN=Device \
   -new -config extension.cnf -key device.key -out device.csr
   
   openssl x509 -extfile extension.cnf -extensions req_ext \
   -req -days 365 -in device.csr \
   -CA rootCA.pem -CAkey rootCA.key -CAcreateserial \
   -out device.crt -sha256
   
   openssl rsa -des3 -in device.key -out device.des3.key -passout pass:password1
   

   These are files are generated:

   • rootCA.key

   • rootCA.pem

   • device.key

   • device.csr

   • device.crt

   • device.des3.key

2. In your working directory, rename and prepare certificates for distribution.

   mv device.crt ems.pem
   mv device.key ems.key
   mv rootCA.pem ca.cert

3. Using SCP, copy the three files (ems.pem, ems.key, ca.cert) to each device and SR-PCE disk0: location.

   scp ems.pem admin@<device-ip>:/disk0:/
   scp ems.key admin@<device-ip>:/disk0:/
   scp ca.cert admin@<device-ip>:/disk0:/
   

   Repeat this step for all devices and SR-PCE.

Step 3

Install certificates on all devices and SR-PCE. For each device and SR-PCE:

1. Log in via SSH or console.

2. Back up any existing certificates.

3. Enable TLS in the gRPC configuration and disable mutual authentication to allow only server authentication.

4. Remove existing ems.pem, ems.key, and ca.cert files from /misc/config/grpc/ (if present).

5. Enter the run mode and navigate to the gRPC directory:

   run
   cd /misc/config/grpc/

   Example:

   -rw-r--r--.  ems.pem
   -rw-------.  ems.key
   -rw-r--r--.  ca.cert
   

6. Copy the certificate files from disk0:

   cp /disk0:/ems.pem .
   cp /disk0:/ems.key .
   cp /disk0:/ca.cert .

7. Verify file permissions and exit the run mode:

   ls -lart
   exit

8. Restart the EMS daemon:

   process restart emsd
   

Step 4

Enable secure gRPC on devices and SR-PCE. For each device and SR-PCE

1. Log in via SSH or console.

2. View the current gRPC configuration:

   show running-config grpc

3. Enter global configuration mode and remove the no-tls directive.

   Example:

   grpc
    port 57400
    no-tls          <-- Remove this line
    address-family ipv4
    service-layer
    !
   

   Allow 1–2 minutes for the EMS daemon to restart and apply the changes.

   Secure gRPC is now enabled on the device or SR-PCE.

Step 5

Create certificate profiles in Cisco Crosswork.

1. Log in to Crosswork Network Controller.

2. Navigate to Administration > Certificate Management.

3. Click Create Certificate and enter:

   • Certificate name: Enter the certificate name as PCE-SecureGRPC.

   • Role: Select Provider gRPC communication.

   • Provider gRPC CA certificate trustchain: Upload rootCA.pem.

   

4. Click Save.

5. Click Create Certificate again and enter:

   • Certificate name: Enter the certificate name as Device-SecureGRPC.

   • Role: Select Device gNMI/gRPC communication.

   • Provider gRPC CA certificate trustchain: Upload rootCA.pem.

6. Click Save.

   

Step 6

Associate SR-PCE certificate and enable secure gRPC.

1. Log in to Crosswork Network Controller UI.

2. Navigate to Administration > Manage Provider Access.

3. Select the SR-PCE provider.

4. Set gRPC Mode to GRPC_SECURE.

5. Select the PCE-SecureGRPC certificate profile created in Step 5.

6. Click Save.

   Crosswork will apply the certificate profile to the SR-PCE connection.

Step 7

Associate the certificate with SR-PCE.

1. Navigate to Administration > Manage Provider Access.

2. Select the SR-PCE provider.

3. Select the Family as SR-PCE.

4. Set the gRPC Mode to GRPC_SECURE.

5. Select the certificate profile created earlier. For example, PCE-SecureGRPC.

6. Click Save.

   Repeat these actions for all devices. Crosswork updates the connection settings for each device.

   

Step 8

Verify secure gRPC configuration and connectivity.

1. On each device and SR-PCE, verify the gRPC configuration:

   show running-config grpc

   Confirm that no-tls is absent and port 57400 is present.

2. In Crosswork Network Controller:

   • Navigate to Administration > Manage Provider Access and verify SR-PCE status shows "Connected" or "Active"

   • Navigate to Device Management > Network Devices and verify all devices show a "Connected" or "Active" status.

3. (Optional) Review Crosswork application logs for successful gRPC TLS connections.