Provision Cisco NCS 1010 using DHCP-based ZTP fresh boot

Based on the business need, you can use a configuration or script file to initiate the ZTP process.

• The configuration file content starts with !! IOS XR.

• The following is the sample configuration file. You can automate all the configurations. For more information on creating ZTP configuration file, refer ZTP Configuration Files Creation.

• Tue May 4 18:08:59.544 UTC
  Building configuration...
  !! IOS XR Configuration 192.0.2.254I
  !! Last configuration change at Tue May 4 17:12:47 2021 by cisco
  !
  line console
  exec-timeout 0 0
  !
  line default
  exec-timeout 0 0
  session-timeout 0
  !
  vty-pool default 0 20
  alias alarms show alarms brief system active
  interface MgmtEth0/RP0/CPU0/0
  ipv4 address dhcp
  no shut
  !
  interface MgmtEth0/RP0/CPU0/1
  description noshut-interface-ztp
  ipv4 address 192.0.2.255 255.255.255.0
  no shut
  !
  interface MgmtEth0/RP0/CPU0/2
  description noshut-interface-ztp
  no shut
  !
  interface PTP0/RP0/CPU0/0
  description noshut-interface-ztp
  no shut
  Cisco NCS 1010 System Setup and Software Installation Guide, IOS XR Release 7.7.x
  19
  Bring-up Cisco NCS 1010
  Build your Configuration File
  !
  telnet vrf default ipv4 server max-servers 100a
  ssh server v2
  ssh server netconf vrf default
  netconf-yang agent
  ssh
  !
  netconf agent tty
  grpc
  ncs1010 static
  address-family ipv4 unicast
  0.0.0.0/0 192.0.2.255
  end

The following information supports authenticate data ports:

• On fresh boot, ZTP process is initiated from management ports and may switch to data ports. To validate the connection with DHCP server, authentication is performed on data ports through DHCP option 43 for IPv4 and option 17 for IPv6. These DHCP options are defined in option space and are included within dhcpd.conf and dhcpd6.conf configuration files. You must provide following parameters for authentication while defining option space:

  • Authentication code—The authentication code is either 0 or 1; where 0 indicates that authentication is not required, and 1 indicates that MD5 checksum is required.

    Note

    If the option 43 for IPv4, and option 17 for IPv6 is disabled, the authentication fails.

  • Client identifier—The client identifier must be 'exr-config'.

  • MD5 checksum—This is chassis serial number. It can be obtained using echo -n $SERIALNUMBER | md5sum | awk '{print $1}' .

  Here is the sample dhcpd.conf configuration. In the example below, the option space called VendorInfo is defined with three parameters for authentication:

  class "vendor-classes" {
     match option vendor-class-identifier;
  }
  
  option space VendorInfo;
  option VendorInfo.clientId code 1 = string;
  option VendorInfo.authCode code 2 = unsigned integer 8;
  option VendorInfo.md5sum code 3 = string
  option vendor-specific code 43 = encapsulate VendorInfo;
  subnet 10.65.2.0 netmask 255.255.255.0 {
    option subnet-mask 255.255.255.0;
    option ncs 1010 10.65.2.1;
    range 10.65.2.1 10.65.2.200;
  }
  host cisco-mgmt {
     hardware ethernet 00:50:60:45:67:01;
     fixed-address 10.65.2.39;
     vendor-option-space VendorInfo;
     option VendorInfo.clientId "exr-config";
     option VendorInfo.authCode 1;
     option VendorInfo.md5sum "aedf5c457c36390c664f5942ac1ae3829";
     option bootfile-name "http://10.65.2.1:8800/admin-cmd.sh";
  }
  

  Here is the sample dhcpd6.conf configuration file. In the example below, the option space called VendorInfo is defined that has code width 2 and length width 2 (as per dhcp standard for IPv6) with three parameters for authentication:

  
  log-facility local7;
  option dhcp6.name-servers 2001:1451:c632:1::1;
  option dhcp6.domain-search "cisco.com";
  dhcpv6-lease-file-name "/var/lib/dhcpd/dhcpd6.leases";
  option dhcp6.info-refresh-time 21600;
  option dhcp6.bootfile-url code 59 = string;
  option dhcp6.user-class code 15 = string;
  option space CISCO-EXR-CONFIG code width 2 length width 2;
  option CISCO-EXR-CONFIG.client-identifier code 1 = string;
  option CISCO-EXR-CONFIG.authCode code 2 = integer 8;
  option CISCO-EXR-CONFIG.md5sum code 3 = string;
  option vsio.CISCO-EXR-CONFIG code 9 = encapsulate CISCO-EXR-CONFIG;
  subnet6 2001:1451:c632:1::/64{
   range6 2001:1451:c632:1::2 2001:1451:c632:1::9;        
   option CISCO-EXR-CONFIG.client-identifier "exr-config";
   option CISCO-EXR-CONFIG.authCode 1;
   #valid md5
   option CISCO-EXR-CONFIG.md5sum "90fd845ac82c77f834d57a034658d0f0";
   if option dhcp6.user-class = 00:04:69:50:58:45 {
    option dhcp6.bootfile-url "http://[2001:1851:c632:1::1]/cisco-2/image.iso";
   }
   else {
     #option dhcp6.bootfile-url "http://[2001:1851:c632:1::1]/cisco-2/cisco-mini-x.iso.sh";
     option dhcp6.bootfile-url "http://[2001:1851:c632:1::1]/cisco-2/ztp.cfg";
    }
  }

For ZTP to operate a valid IPv4 or IPv6 address is required and the DHCP server must send a pointer to the configuration script.

• The DHCP request from the NCS 1010 has the following DHCP options to identify itself:

  • Option 60: “vendor-class-identifier” : Used to Identify the following four elements:

    • The type of client: For example, PXEClient

    • The architecture of The system (Arch): For example: 00009 Identify an EFI system using a x86-64 CPU

    • The Universal Network Driver Interface (UNDI):

    • For example 003010 (first 3 octets identify the major version and last 3 octets identify the minor version)

    • The Product Identifier (PID):

  • Option 61: “dhcp-client-identifier” : Used to identify the Serial Number of the device.

  • Option 66 : Used to request the TFTP server name.

  • Option 67: Used request the TFTP filename.

  • Option 97: “uuid” : Used to identify the Universally Unique Identifier a 128-bit value (not usable at this time)

• Example

• The following DHCP request sample provides a fixed IP address and a configuration file with the mac address of the management interface.

• host cisco-rp0 {
     hardware ethernet e4:c7:22:be:10:ba;
     fixed-address 172.30.12.54;
     filename "http://172.30.0.22/configs/cisco-1.config";
  }
  

• The following DHCP request sample provides a fixed IP address and a configuration file with the mac address of the management interface along with capability to re-image the system using iPXE (exr-config "xr-config" option):

• host cisco-rp0 {
     hardware ethernet e4:c7:22:be:10:ba;
     fixed-address 172.30.12.54;
     if exists user-class and option user-class = "iPXE" {
        filename = "http://172.30.0.22/boot.ipxe";
     } elsif exists user-class and option user-class = "exr-config"  {
        filename = "http://172.30.0.22/scripts/cisco-rp0_ztp.sh";
     }
  }
  

• DHCP server identifies the device and responds with either an IOS-XR configuration file or a ZTP script as the filename option.

  The DHCP server responds with the following DHCP options:

  • DHCPv4 using BOOTP filename to supply script/config location.

  • DHCPv4 using Option 67 (bootfile-name) to supply script/config location.

  • DHCPv6 using Option 59 (OPT_BOOTFILE_URL) to supply script/config location

• The following sample shows the DHCP response with bootfile-name (option 67):

• option space cisco-vendor-id-vendor-class code width 1 length width 1;
  option vendor-class.cisco-vendor-id-vendor-class code 9 = {string};
  
  ######### Network 11.11.11.0/24 ################
  shared-network 11-11-11-0 {
  
  ####### Pools ##############
    subnet 11.11.11.0 netmask 255.255.255.0 {
      option subnet-mask 255.255.255.0;
  	option broadcast-address 192.0.2.255;
  	option ncs 1010 198.51.100.254;
  	option domain-name-servers 198.51.100.254;
  	option domain-name "cisco.local";
  	# DDNS statements
    	ddns-domainname "cisco.local.";
  	# use this domain name to update A RR (forward map)
    	ddns-rev-domainname "in-addr.arpa.";
    	# use this domain name to update PTR RR (reverse map)
  
      }
  
  ######## Matching Classes ##########
  
    class "cisco" {
         match if (substring(option dhcp-client-identifier,0,11) = "FGE194714QS");
    }
  
  
    pool {
        allow members of "cisco";
        range 203.0.113.1 203.0.113.4;
        next-server 198.51.100.254;
  
        if exists user-class and option user-class = "iPXE" {
           filename="http://198.51.100.254:9090/cisco-mini-x-6.2.25.10I.iso";
        }
  
    
        if exists user-class and option user-class = "exr-config"
         {
            if (substring(option vendor-class.cisco-vendor-id-vendor-class,19,99)="cisco")
            {           
              option bootfile-name "http://198.51.100.254:9090/scripts/exhaustive_ztp_script.py";
            }
          }
        
  
        ddns-hostname "cisco-local";
        option ncs 1010 198.51.100.254;
    }
  }
  

You can customize the following ZTP configurable options in the ztp.ini file:

• ZTP: You can enable or disable ZTP at boot using CLI or by editing the ztp.ini file.

• Retry: Set the ZTP DHCP retry mechanism: The available values are infinite and once.

• Fetcher Priority: Fetcher defines which port ZTP should use to get the provisioning details. By default, each port has a fetcher priority defined in the ztp.ini file. You can modify the default priority of the fetcher. Allowed range is from 0 to 9.

  Note

  Lower the number higher the priority. The value 0 has the highest priority and 9 has the lowest priority.

  By default, the USB port has the higher priority.

  In the following example, the Mgmt4 port has the highest priority:

  [Fetcher Priority]
  Mgmt4: 0
  Mgmt6: 1
  DPort4: 2
  DPort6: 3

• progress_bar: Enable progress bar on the console. By default, the progress bar is disabled. To enable the progress bar, add the following entry in the ztp.ini file.

  [Options]
  progress_bar: True

• config_check: Saves ZTP configuration hashes in the /disk0:/ztp/ location on the NCS 1010. By default, the config check is disabled. To enable the config check, add the following entry in theztp.ini file.

  [Startup]
  start:         True
  retry_forever: True
  config_check: True
                

  You can view the ZTP hashes by using the show ztp log command as seen below:

  RP/0/RP0/CPU0:ios# show ztp log 
  
  ============================== /var/log/ztp.log ==============================
  
  2023-03-14 12:51:29,251 53612 [Configuration] INF: Provisioning via config replace
  2023-03-14 12:51:43,131 53612 [Configuration] INF: Configuration has been applied
  2023-03-14 12:51:43,131 53612 [Env ] DEB: cfg::createRefOnConfigCommit: called
  2023-03-14 12:51:44,218 53612 [Env ] DEB: cfg:: Generating hash for File name: /disk0:/ztp/customer/config.inithash_tmp
  2023-03-14 12:51:44,218 53612 [Env ] DEB: cfg::_generateCfgAndSaveHash:: HASH : c7980cfc23a401bbbf296e3d49c76bf9, type : 1
  2023-03-14 12:51:59,715 53612 [Env ] DEB: cfg:: Generating hash for File name: /disk0:/ztp/customer/config.successhash_tmp
  ..........
  2023-03-14 12:51:59,715 53612 [Env ] DEB: cfg::_generateCfgAndSaveHash:: HASH : c7980cfc23a401bbbf296e3d49c76bf9, type : 2
  2023-03-14 12:52:04,901 53612 [Env ] DEB: cfg::getRefOnSuccess :: called
  ..........
  2023-03-14 12:52:05,403 53612 [Engine ] INF: ZAdmin, current state:active, exit code:success
  2023-03-14 12:52:05,403 53612 [Engine ] INF: ZAdmin, current state:final, exit code:success: state changed to final

• By default, the ztp.ini file is located in the /pkg/etc/ location. To modify the ZTP configurable options, make a copy of the file in the /disk0:/ztp/ directory and then edit the ztp.ini file.

• To reset to the default options, delete the ztp.ini file in the /disk0:/ztp/ directory.

• Note

  Do not edit or delete the ztp.ini file in the /pkg/etc/ location to avoid issues during installation.

• The following example shows the sample of the ztp.ini file:

• [Startup]
  start: True
  retry_forever: True
  
  [Fetcher Priority]
  USB: 0 
  
  Mgmt4:  1 
  Mgmt6:  2 
  DPort4: 3 
  DPort6: 4 

• Enable ZTP Using CLI

• If you want to enable ZTP using CLI, use the ztp enable command.

• Configuration example

• RP/0/RP0/CPU0:ios#ztp enable
  Fri Jul 12 16:09:02.154 UTC
  Enable ZTP? [confirm] [y/n] :y
  ZTP Enabled.
  

• Disable ZTP Using CLI

• If you want to disable ZTP using CLI, use the ztp disable command.

• Configuration example

• RP/0/RP0/CPU0:ios#ztp disable
  Fri Jul 12 16:07:18.491 UTC
  Disable ZTP? [confirm] [y/n] :y
  ZTP Disabled.
  Run ZTP enable to run ZTP again.