Cisco Catalyst SD-WAN Onboarding Guide, Releases 26.x and Later

PDF

Cisco Catalyst SD-WAN Onboarding Guide, Releases 26.x and Later

Start the enterprise ZTP server

Updated: October 12, 2026

Want to summarize with AI?

Outlines how to configure an enterprise ZTP server to provide WAN edge devices with necessary IP and root CA information, and explains scenarios where a top-level validator is not required when using the hosted service.

If you are hosting the Cisco Catalyst SD-WAN zero-touch-provisioning (ZTP) server in your enterprise, you must configure one SD-WAN Validator to perform this role. This SD-WAN Validator provides the WAN edge devices in the overlay network with the IP address of your enterprise SD-WAN Validator and with the enterprise root CA chain.

If you are using the Cisco Catalyst SD-WAN ZTP hosted service, there is no need to set up a top-level SD-WAN Validator.

Requirements for ZTP

To start the SD-WAN Validator software, you need the following hardware and software components.

Edge device

A WAN edge device on which the SD-WAN Validator software has been installed or the SD-WAN Validator VM instance on the hypervisor.

Power cables

Appropriate power cables. See the packing list for your hardware platform.

DNS server

An enterprise DNS server that has been configured with a record that redirects the URL ztp.cisco.com to your enterprise ZTP server. The recommended URL for this enterprise server is ztp.local-domain.

Certificate

Certificate generated as a result of a Certificate Signing Request (CSR).

Certificate authority

Enterprise root CA chain.

File with device chassis information, from release 20.3.1

For releases beginning with Cisco SD-WAN Release 20.3.1, a JSON file that contains the router chassis information that the SD-WAN Validator that acts as the ZTP server requires. This file is extracted from the PNP portal downloaded zip bundled device file. The JSON file contains the following information for each router:

Organization name as specified in the device certificate
Certificate information
Router chassis number
Router serial number
Validity (either valid or invalid)
SD-WAN Validator IP address
SD-WAN Validator port number (optional)

Note

Before upgrading edge devices, ensure that your on-premises ZTP server is using the same release number (or higher) as the SD-WAN Controller release that you are using for SD-WAN Manager, SD-WAN Controller, and SD-WAN Validator. For example, before upgrading from Cisco vManage Release 20.6.x to Cisco vManage Release 20.9.x, ensure that the ZTP server is using release 20.9 or later.

From Cisco SD-WAN Release 20.4.1, if Multi-Tenancy is enabled in controller profile on the PNP portal, the JSON file also contains the SP Organization Name.

For Cisco SD-WAN Release 20.3.1, download the Chassis ZIP file from the PNP portal and extract the JSON file from it. Use the following command to upload the JSON file to the ZTP server:

validator# request device-upload chassis-file JSON-file-name

Here is an example of a JSON file:

{
              "version": "1.1",
              "organization": "vIPtela Inc Regression",
              "overlay": "vIPtela Inc Regression",
              "root_cert_bundle":"-----BEGIN CERTIFICATE-----
<certificate>
----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----
<certificate>
----END CERTIFICATE-----",
              "controller_details": {
                    "primary_ipv4":"10.0.12.26",
                    "primary_port":"12346"
              },
              "chassis_list": [{
                     "chassis": "JAE214906FZ",
                     "SKU": "ASR1002-HX",
                     "HWPID": "ASR1002-HX",
                     "serial_list": [{
                                     "sudi_subject_serial": "JAE214906FX",
                                     "sudi_cert_serial": "021C0203",
                                     "HWPID": "ASR1002-HX"}]
                                     }
                              ],
               "timestamp": "2019-10-21 23:40:02.248"
}

From Cisco SD-WAN Release 20.3.2, you need not extract the JSON file from the Chassis ZIP file that you download from the PNP portal. Use the request device-upload chassis-file command to upload the serialFile.Viptela file downloaded from the PNP portal to the ZTP server. The ZTP server extracts the JSON file from serialFile.Viptela and loads the chassis entries into the database.

validator# request device-upload chassis-file /home/admin/serialFile.viptela
Uploading chassis numbers via VPN 0
Copying ... /home/admin/serialFile.viptela via VPN 0
file:  /tmp/tmp.DkaQ18u3aM/viptela_serial_file
PnP
Verifying public key received from PnP against production root cert
is_public_key_ok against production root ca:  O = Cisco, CN = MMI Signer STG - DEV error 20 at 0 depth lookup:unable to get local issuer certificate
Verifying public key received from PnP against engineering root cert
is_public_key_ok against engineering root ca:  OK
Signature verified for viptela_serial_file
final file:  /tmp/tmp.DkaQ18u3aM/viptela_serial_file
Removing unsigned file (cisco_cert.cer).
Signature verification Suceeded.
Success: Serial file is /tmp/tmp.DkaQ18u3aM/viptela_serial_file
INFO: Input File specified was '/usr/share/viptela/chassis_numbers.tmp'
INFO: Root Cert File is /home/admin/vIPtela Inc Regression.crt
INFO: # of complete chassis entries written: 19
Json to CSV conversion succeeded!
Successfully loaded the chassis numbers file to the database.

Optionally, you can configure the device information manually using the request device command.

File with device chassis information, through relase 20.1.1

For releases through Cisco SD-WAN Release 20.1.1, a CSV file that contains the WAN edge device chassis information required by the SD-WAN Validator that is acting as the ZTP server. Each row in the CSV file must contain the following information for each device.

Note

The ztp-server should be csr-cert signed from either cisco-pki or symantec (Digicert).

Note
Some operating systems, including Microsoft Windows, may add carriage return special characters (such as ^M) at the end of each line in this file. Use a text editor to remove these characters before you upload the file.

WAN edge device chassis number
WAN edge device serial number
Validity (either valid or invalid)
SD-WAN Validator IP address
SD-WAN Validator port number (entering a value is optional)
Organization name as specified in the device certificate
Path to the enterprise root certification (entering a value is optional)

Configure an SD-WAN Validator to operate as a ZTP server

Procedure

Log in to the SD-WAN Validator using the default username, which is admin , and the default password, which is admin. The CLI prompt is displayed.
Configure the SD-WAN Validator to operate as a ZTP server, assigning an IP address for the ZTP server functionality. Use an IP address that the intended devices can reach.
```
validator(config)# system vbond ip-address local ztp-server
```
The IP address must be a public address so that the SD-WAN Validator is reachable by all SD-WAN Controllers and devices through the transport network. The local option indicates that this device is acting as the SD-WAN Validator. It is this option that starts the SD-WAN Validator software process on the device. The ztp-server option establishes this SD-WAN Validator as the ZTP server.

Configure an IP address for the interface that connects to the transport network:

validator(config)# vpn 0 interface ge slot /port
validator(config-ge)# ip address prefix /length
validator(config-ge)# no shutdown

Commit the configuration:

validator(config)# commit

Exit configuration mode:

validator(config)# exit

Verify that the configuration is correct and complete.

validator# show running-config
  system
   host-name               vm3
   system-ip               172.16.255.2
   admin-tech-on-failure
   route-consistency-check
   organization-name       "Cisco Inc"
   vbond 10.1.15.13 local ztp-server

Generate CSR manually.

validator_ztp# request csr upload home/admin/vbond_ztp.csr

Sign CSR manually and generate certificate via PNP Connect Cisco PKI.

Install certificate.

validator_ztp# request certificate install/home/admin/vbond_ztp.cer

Ensure Cisco IOS XE Catalyst SD-WAN has Cisco root-ca-cert in root-ca chain.
Check clock on validator_ZTP and Cisco IOS XE Catalyst SD-WAN .
Upload the JSON file that contains the router chassis information to the ZTP server:
```
validator# request device-upload chassis-file
                    path
                
```
path is the path to a local file or a file on a remote device that is reachable via FTP, TFTP, HTTP, or SCP.
Verify that the list of Cisco vEdge device chassis numbers are present on the Cisco SD-WAN Validator using one of the following commands:
```
validator# show ztp entries
validator# show orchestrator valid-devices
                
```

Here is an example of the configuration of a top-level SD-WAN Validator :


validator# show running-config vpn 0
interface ge0/0
  ip address 75.1.15.27/24
  !
  no shutdown
!
vBond# 
            show running-config system
system
  vbond 75.1.15.27 local ztp-server
!

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.