Plug and Play onboarding workflow

Updated: July 7, 2026

Want to summarize with AI?

Steps for onboarding devices to Cisco Catalyst SD-WAN using Plug and Play.

Note these considerations regarding Plug and Play:

If you created and scheduled a device template on Cisco vManage Release 20.3.x and upgraded Cisco SD-WAN Manager to Cisco vManage Release 20.4.1 or later before onboarding the target device, when you onboard the device using PNP or ZTP, the template push fails. To avoid this failure, reschedule the template after upgrading the Cisco SD-WAN Manager software and then onboard the device.
If the ZTP process for a device is interrupted because the device reloads or power cycles, the ZTP process does not restart and the device comes online with the Cisco SD-WAN Manager image that was in its original configuration. In this situation, upgrade the device to the desired Cisco SD-WAN Manager release manually.

For more information, refer to the Plug and Play Support Guide.

Procedure

	1.	Place an order for the device in Cisco Commerce with Smart Account and Virtual Account details of the customer.
	2.	The device information from Cisco Commerce like Device serial number, Smart Account, and Virtual Account are added to the Plug and Play portal.
	3.	Add a Cisco SD-WAN Validator controller profile into the Plug and Play (PnP) portal for the same Smart Account and Virtual Accounts.
	4.	Associate the new device to the Cisco SD-WAN Validator controller profile manually.
	5.	PnP sends all relevant information including Cisco SD-WAN Validator details, device serial number, organization name, and network ID to Zero Touch Provisioning (ZTP).
	6.	Download the device serial number file (provisioning file) from PnP and upload it to Cisco SD-WAN Manager. The devices are now available on Cisco SD-WAN Manager. You can also use the Sync Smart Account option on Cisco SD-WAN Manager to sync the device with your virtual account and populate the device in Cisco SD-WAN Manager.

Mode discovery with Plug and Play onboarding

Describes how the Plug and Play (PnP)-based discovery process determines the mode and changes it if necessary.

The PnP-based discovery process determines the mode in which the device operates, based on the controller discovery and initiates a mode change if necessary. The mode change causes the device to reboot. After the reboot, the device performs the appropriate discovery process.

When you upgrade to Cisco IOS XE Catalyst SD-WAN Release 17.2.1r or later, on a Cisco device running an earlier verion of Cisco IOS XE or a Cisco Catalyst SD-WAN image, the device starts in Autonomous mode or Controller mode depending on the configured controller.

Deployment using Plug and Play (PnP) may include any of these discovery process scenarios:

Table 1. PnP discovery process scenarios
Bootup mode	Deployment mode	On-boarding agent	Cisco SD-WAN Validator	Discovery process	Mode change
Autonomous	Cisco Digital Network Architecture (DNA)	Plug and Play	No	Plug and Play Connect Discovery or on-premise plug and play server discovery	No Mode change
Autonomous	Cisco SD-WAN Manager	Plug and Play	Yes	Plug and Play Connect Discovery	Mode change to controller mode
Controller	Cisco DNA	Plug and Play	No	Plug and Play Connect Discovery or on-premise plug and play server discovery	Mode change to autonomous mode
Controller	Cisco SD-WAN Manager	Plug and Play	Yes	Plug and Play Connect Discovery	No mode change

Automatic IP address detection

Describes how a device can automatically learn about the available IP addresses and default gateway information by using Address Resolution Protocol (ARP) packets.

How a device receives IP address and gateway server information during PnP onboarding

Typically, the WAN interface on a Cisco IOS XE Catalyst SD-WAN device or Cisco vEdge device is configured as a DHCP client, and this interface receives an IP address and gateway server information from the DHCP server during the plug-and-play (PnP) onboarding process.

If the DHCP server is not available, the device automatically learns about the available IP addresses and default gateway information by using Address Resolution Protocol (ARP) packets. If an IP address that the device learns allows a successful connection to the PnP server, the device continues with the PnP onboarding process.

Automatic IP address detection applies only to day zero deployments and is enabled by default.

For automatic IP address detection, a device uses 8.8.8.8 or 8.8.4.4 as the DNS server to resolve devicehelper.cisco.com or ztp.cisco.com. The PnP process then attempts to reach devicehelper.cisco.com or ztp.cisco.com to continue onboarding.

IP address not preserved after reboot

An IP address that a device automatically detects is not preserved during reboots of the device that occur before the PnP onboarding completes. In such cases, an IP address is assigned automatically when the PE router ARP cache expires.

Prerequisites for automatic IP address detection

To trigger ARP, configure the IP address of the device as the BGP neighbor on the provider edge (PE) router.

This PE router is the first point of contact for the device in the WAN transport network. The PE router then sends ARP packets with this IP address to the device. The device receives the ARP packets, and then the Automatic IP Address Detection feature defines the ARP destination IP address as the device's WAN interface IP address.
For Cisco IOS XE Catalyst SD-WAN devices, the network mask of this IP address must be 30 bits.
For automatic IP address detection and redirection through an on-premises ZTP server, the A record of the ZTP server on the DNS server must be set to ztp.cisco.com. In addition, the DNS server must have an ip name-server value of 8.8.8.8 or 8.8.4.4.

Restrictions for automatic IP address detection

Automatic IP address detection is supported only on Cisco 1000 Series Integrated Service Routers, Cisco 4000 Series Integrated Service Router, and Cisco Catalyst 8200 and 8300 Series Edge Platforms. On these devices, this features is supported only for Gigabit Ethernet Interface 0/0/0.
Automatic IP address detection is supported only on devices that are in Controller mode, for configuration by Cisco Catalyst SD-WAN.
Automatic IP address detection is supported only in a simple 30-bit network mask Layer 2 network in which one PE router and one customer edge router are in the same VLAN.
Automatic IP address detection does not support VRRP, HSRP, or GLBP on the PE router.
An ARP destination IP address is used as the WAN interface IP address on a device only after the device receives the same ARP request eight times within an interval of 150 seconds.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.