Start the enterprise ZTP server

Updated: July 7, 2026

Want to summarize with AI?

Outlines how to configure an enterprise ZTP server to provide WAN edge devices with necessary IP and root CA information, and explains scenarios where a top-level validator is not required when using the hosted service.

If you are hosting the Cisco Catalyst SD-WAN zero-touch-provisioning (ZTP) server in your enterprise, you must configure one SD-WAN Validator to perform this role. This SD-WAN Validator provides the WAN edge devices in the overlay network with the IP address of your enterprise SD-WAN Validator and with the enterprise root CA chain.

If you are using the Cisco Catalyst SD-WAN ZTP hosted service, there is no need to set up a top-level SD-WAN Validator.

Requirements for ZTP

To start the SD-WAN Validator software, you need the following hardware and software components:

A WAN edge device on which the SD-WAN Validator software has been installed or the SD-WAN Validator VM instance on the hypervisor.
Appropriate power cables. See the packing list for your hardware platform.
An enterprise DNS server that has been configured with a record that redirects the URL ztp.cisco.com to your enterprise ZTP server. The recommended URL for this enterprise server is ztp.local-domain.
Certificate generated as a result of a Certificate Signing Request (CSR).
Enterprise root CA chain.
For releases through Cisco SD-WAN Release 20.1.1, a CSV file that contains the WAN edge device chassis information required by the SD-WAN Validator that is acting as the ZTP server. Each row in the CSV file must contain the following information for each device.

Note

The ztp-server should be csr-cert signed from either cisco-pki or symantec (Digicert).

Note
Some operating systems, including Microsoft Windows, may add carriage return special characters (such as ^M) at the end of each line in this file. Use a text editor to remove these characters before you upload the file.
- WAN edge device chassis number
- WAN edge device serial number
- Validity (either valid or invalid)
- SD-WAN Validator IP address
- SD-WAN Validator port number (entering a value is optional)
- Organization name as specified in the device certificate
- Path to the enterprise root certification (entering a value is optional)

For releases beginning with Cisco SD-WAN Release 20.3.1, a JSON file that contains the router chassis information that the SD-WAN Validator that acts as the ZTP server requires. This file is extracted from the PNP portal downloaded zip bundled device file. The JSON file contains the following information for each router:

Organization name as specified in the device certificate
Certificate information
Router chassis number
Router serial number
Validity (either valid or invalid)
SD-WAN Validator IP address
SD-WAN Validator port number (optional)

Note

Before upgrading edge devices, ensure that your on-premises ZTP server is using the same release number (or higher) as the SD-WAN Controller release that you are using for SD-WAN Manager, SD-WAN Controller, and SD-WAN Validator. For example, before upgrading from Cisco vManage Release 20.6.x to Cisco vManage Release 20.9.x, ensure that the ZTP server is using release 20.9 or later.

From Cisco SD-WAN Release 20.4.1, if Multi-Tenancy is enabled in controller profile on the PNP portal, the JSON file also contains the SP Organization Name.

For Cisco SD-WAN Release 20.3.1, download the Chassis ZIP file from the PNP portal and extract the JSON file from it. Use the following command to upload the JSON file to the ZTP server:

validator# request device-upload chassis-file JSON-file-name

Here is an example of a JSON file:

{
              "version": "1.1",
              "organization": "vIPtela Inc Regression",
              "overlay": "vIPtela Inc Regression",
              "root_cert_bundle":"-----BEGIN CERTIFICATE-----
<certificate>
----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----
<certificate>
----END CERTIFICATE-----",
              "controller_details": {
                    "primary_ipv4":"10.0.12.26",
                    "primary_port":"12346"
              },
              "chassis_list": [{
                     "chassis": "JAE214906FZ",
                     "SKU": "ASR1002-HX",
                     "HWPID": "ASR1002-HX",
                     "serial_list": [{
                                     "sudi_subject_serial": "JAE214906FX",
                                     "sudi_cert_serial": "021C0203",
                                     "HWPID": "ASR1002-HX"}]
                                     }
                              ],
               "timestamp": "2019-10-21 23:40:02.248"
}

From Cisco SD-WAN Release 20.3.2, you need not extract the JSON file from the Chassis ZIP file that you download from the PNP portal. Use the request device-upload chassis-file command to upload the serialFile.Viptela file downloaded from the PNP portal to the ZTP server. The ZTP server extracts the JSON file from serialFile.Viptela and loads the chassis entries into the database.

validator# request device-upload chassis-file /home/admin/serialFile.viptela
Uploading chassis numbers via VPN 0
Copying ... /home/admin/serialFile.viptela via VPN 0
file:  /tmp/tmp.DkaQ18u3aM/viptela_serial_file
PnP
Verifying public key received from PnP against production root cert
is_public_key_ok against production root ca:  O = Cisco, CN = MMI Signer STG - DEV error 20 at 0 depth lookup:unable to get local issuer certificate
Verifying public key received from PnP against engineering root cert
is_public_key_ok against engineering root ca:  OK
Signature verified for viptela_serial_file
final file:  /tmp/tmp.DkaQ18u3aM/viptela_serial_file
Removing unsigned file (cisco_cert.cer).
Signature verification Suceeded.
Success: Serial file is /tmp/tmp.DkaQ18u3aM/viptela_serial_file
INFO: Input File specified was '/usr/share/viptela/chassis_numbers.tmp'
INFO: Root Cert File is /home/admin/vIPtela Inc Regression.crt
INFO: # of complete chassis entries written: 19
Json to CSV conversion succeeded!
Successfully loaded the chassis numbers file to the database.

Optionally, you can configure the device information manually using the request device command.

Configure a Router to be a ZTP Server

Procedure

	1.	Boot the WAN edge device.
	2.	Use a console cable to connect a PC to the device.
	3.	Log in to the device using the default username, which is admin , and the default password, which is admin. The CLI prompt is displayed.
	4.	Configure the device to be a top-level SD-WAN Validator : `Validator# config Validator(config)# system vbond ip-address local ztp-server` The IP address must be a public address so that the SD-WAN Validator is reachable by all SD-WAN Controllers and devices through the transport network. The local option indicates that this device is acting as the SD-WAN Validator. It is this option that starts the SD-WAN Validator software process on the device. The ztp-server option establishes this SD-WAN Validator as the ZTP server.
	5.	Configure an IP address for the interface that connects to the transport network: `Validator(config)# vpn 0 interface ge slot /port validator(config-ge)# ip address prefix /length validator(config-ge)# no shutdown`
	6.	Commit the configuration: `validator(config)# commit`
	7.	Exit configuration mode: `validator(config)# exit`
	8.	Verify that the configuration is correct and complete. `validator# show running-config system host-name vm3 system-ip 172.16.255.2 admin-tech-on-failure route-consistency-check organization-name "Cisco Inc" vbond 10.1.15.13 local ztp-server`
	9.	Generate CSR manually. `Validator_ztp# request csr upload home/admin/vbond_ztp.csr`
	10.	Sign CSR manually and generate certificate via PNP Connect Cisco PKI.
	11.	Install certificate. `validator_ztp# request certificate install/home/admin/vbond_ztp.cer`
	12.	Ensure Cisco IOS XE Catalyst SD-WAN has Cisco root-ca-cert in root-ca chain.
	13.	Check clock on validator_ZTP and Cisco IOS XE Catalyst SD-WAN .
	14.	Upload the JSON file that contains the router chassis information to the ZTP server: `Validator# request device-upload chassis-file path` path is the path to a local file or a file on a remote device that is reachable via FTP, TFTP, HTTP, or SCP.
	15.	Verify that the list of Cisco vEdge device chassis numbers are present on the Cisco SD-WAN Validator using one of the following commands: `Validator# show ztp entries Validator# show orchestrator valid-devices`

Here is an example of the configuration of a top-level SD-WAN Validator :


validtaor# show running-config vpn 0
interface ge0/0
  ip address 75.1.15.27/24
  !
  no shutdown
!
vBond# 
            show running-config system
system
  vbond 75.1.15.27 local ztp-server
!

What to do next

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.