Explains the ZTP automatic authentication process, outlining device onboarding, cryptographic exchanges, and certificate validation essential for secure connectivity in SD-WAN environments.
Automatic validation and authentication of WAN edge devices during bring-up require that Cisco SD-WAN Validator and Cisco SD-WAN Controller know the serial and chassis numbers of authorized devices.
-
Serial number: Each WAN edge device has a 40-byte serial number included in its certificate. For Cisco SD-WAN Validator and Cisco SD-WAN Controller, certificates are an enterprise root CA. For WAN edge routers, the certificate resides in the hardware’s trusted board ID chip.
-
Chassis number: Only WAN edge routers have chassis numbers, with a one-to-one mapping to their serial numbers.
Cisco SD-WAN Validator and Cisco SD-WAN Controller learn these numbers during initial device configuration:
-
Controller authorized serial numbers: Cisco SD-WAN Manager learns serial numbers for authorized controllers when creating a CSR and installing the signed certificate. You download these serial numbers to Cisco SD-WAN Validator, which pushes them to Cisco SD-WAN Controller during automatic authentication.
-
WAN edge authorized serial number file: This file contains serial and chassis numbers of authorized WAN edge routers. You upload it to Cisco SD-WAN Validators and Cisco SD-WAN Controllers.
All devices must share the same organization name, configured on Cisco SD-WAN Manager and included in device configuration files and certificates. This name is case-sensitive.