Describes how Cisco, the customer, the ZTP server, and the device exchange ownership artifacts during secure router provisioning.
The workflow provisions a Cisco IOS XR router by using an ownership voucher obtained through the customer and Cisco MASA service.
Summary
The workflow includes these actors:
-
Cisco: Provides the SUDIs associated with the customer’s purchase order.
-
Customer: Owns and prepares the trust anchors and ownership artifacts.
-
MASA: Issues ownership vouchers for the requested devices.
-
ZTP server: Stores and exchanges ownership vouchers and bootstrapping data.
-
Device: Validates the ownership artifacts and bootstrapping data before provisioning.
Workflow
These stages describe the provisioning flow:
-
Cisco completes the purchase order and provides SUDIs for all devices in the purchase order.
-
The customer generates a private key, creates a PDC with that key, creates an OC using the PDC, and securely hands off the PDC and serial number through secure email, personal USB handoff, the MASA API, or the MASA web GUI.
-
MASA generates ownership vouchers for every requested device and hands off the OV to the customer.
-
The ZTP server stores the OVs in a system accessible to the ZTP server and the device initiates its bootstrap sequence.
-
The device requests bootstrapping data. The ZTP server gets the device OV and provides it to the device, then generates and provides bootstrapping data.
-
The device verifies the received OV: the OV validates the OC and the OC validates the signature of the signed bootstrapping data.
-
After successful validation, the device is provisioned.
Result
The device is provisioned only after it validates ownership and signed bootstrapping data.