Introduction

The Cisco Network Plug and Play solution provides a simple, secure, unified, and integrated offering for enterprise network customers to ease new branch or campus device deployments or for provisioning updates to an existing network. The solution provides a unified approach to provision enterprise networks comprised of Cisco routers, switches, and wireless access point devices with a near zero touch deployment experience.

What’s New in Release 1.6

This software release provides the following new features and functions:

■Support for the Cisco 1100 Series Integrated Services Routers

■Support for the Cisco 800 Series Industrial Integrated Services Routers

■Support for new NFVIS platforms: Cisco ENCS 5104, UCS-E180D-M3, and UCS-E1120D-M3

Supported Platforms and Software Requirements

The following tables list Cisco routers, switches, wireless access points, NFVIS platforms, and software releases that support the Cisco Plug and Play IOS Agent and the Cisco Network Plug and Play Solution.

In the case where there is a rebuild for a particular release, it is recommended to use the latest rebuild release.

 

1.The non-VLAN 1 feature is not supported on release 15.2.4E. 2.Limited feature support: Trustpool support for devices with smaller NVRAM space is only by using the DHCP options T and Z.

Table 2 lists software releases that have limited feature support. For software releases not listed, all features are supported.

 

1. The following caveats apply: CSCuv42560, CSCuw63034, CSCuy16820, CSCvb56482.

2. The following caveat applies: CSCux54515.

3. The following caveat applies: CSCux52544.

 

3.The ASR 1000 Series routers support Plug and Play discovery on the management interface beginning with Release 16.3.2. 4.The ASR 1000 Series routers support Plug and Play discovery on the non-management interfaces beginning with Release 16.4.1. 5.The CSR 1000v router supports Plug and Play discovery only on an ISO deployment, not when deployed with an OVA.

 

6.The Flexgroup feature for the Cisco Aironet 700 Series, 1600 Series, 1700 Series, 2600 Series, 2700 Series, 3600 Series, and 3700 Series APs is available with the AireOS 8.3 release.

 

 

Note: Only official software releases obtained from the Cisco.com software download website are supported for image deployment. Engineering builds are not supported.

Cisco Network Plug and Play supports the following features, depending on the Cisco IOS software release on the device:

■IPv6 is supported in the Cisco Plug and Play IOS agent beginning with software release IOS XE 16.4.

■AAA device credential support. The AAA credentials are passed to the device securely and the password is not logged. This feature allows provisioning a device with a configuration that contains aaa authorization commands. This feature requires software release IOS 15.2(6)E1, IOS 15.6(3)M1, IOS XE 16.3.2, or IOS XE 16.4 or later on the device.

■Image install and upgrade for Cisco 3650 and 3850 Series switches is supported only when the switch is booted in Install mode. (Image install and upgrade is not supported for switches booted in Bundle mode.)

Upgrade and Downgrade Support

Limitations

Cisco Network Plug and Play has the following limitations:

■The bulk import function is similar to adding new provisioning rules that can set a device to the pending state. When you export the project and device database, the application displays the correct device state. If you then import the saved database, the devices must contact the APIC-EM controller again to return to the provisioned state because the bulk import feature restores only the device provisioning rules and does not restore the state of devices.

■Bulk import does not support uploading template configurations.

■Virtual Switching System (VSS) is not supported.

■Configuration templates are based on the Velocity templating engine version 1.7, with the following limitations:

–The #parse and #include directives are not supported.

–Structured objects are not supported.

–The #foreach element works only with lists, not maps or enumerations, and #foreach attributes like "foreach.count" are not supported.

■For stack switch functionality in Projects in the Cisco Network Plug and Play application for APIC-EM, only the Cisco Catalyst Switches 3850/3650/2960X/2960XR/2960S Series are supported. For the Cisco Catalyst 2960X/2960XR/2960S Series switches, only image upgrade with tar file and configuration upgrade are supported; license upgrade or LAN-Lite license level is not supported.

■Stack switch functionality is not supported with Cisco Catalyst 9300 Series Switches.

■Cisco switches do not support bootstrap configurations using USB drives.

Sizing Guidelines

The Cisco Network Plug and Play application on APIC-EM can support the following:

■A maximum of 10000 devices pre-provisioned in the Cisco Network Plug and Play application for APIC-EM, of which a maximum of 4000 can be router and switch devices and the remainder can be wireless access point devices

■A maximum of 50 devices of all types simultaneously contacting the server and being provisioned

■A maximum of 200 unclaimed devices of all types in the Cisco Network Plug and Play application for APIC-EM

See the Release Notes for Cisco Application Policy Infrastructure Controller Enterprise Module for APIC-EM device support guidelines.

Configuring Server Identity

To ensure successful controller discovery by Cisco devices running newer IOS releases, the server SSL certificate offered by the controller during the SSL handshake must contain an appropriate Subject Alternate Name (SAN) value, so that the Cisco Plug and Play IOS Agent can verify the server identity. This may require the controller administrator to upload a new server SSL certificate, which has the appropriate SAN values, to the controller. This requirement applies to all controllers that implement the Plug and Play server.

This requirement applies to devices running the following Cisco IOS releases:

■Cisco IOS Release 15.2(6)E2 and later

■Cisco IOS Release 15.6(3)M4 and later

■Cisco IOS Release 15.7(3)M2 and later

■Cisco IOS XE Denali 16.3.6 and later

■Cisco IOS XE Everest 16.5.3 and later

■Cisco IOS Everest 16.6.3 and later

■All Cisco IOS releases from 16.7.1 and later

The value of the SAN field in the controller certificate must be set according to the type of discovery being used by devices, as follows:

■For DHCP option-43/option-17 discovery using an explicit IPv4 or IPv6 address, set the SAN field to the specific IPv4/IPv6 address of the controller.

■For DHCP option-43/option-17 discovery using a hostname, set the SAN field to the controller hostname.

■For DNS discovery, set the SAN field to the hostname of the controller, in the form of pnpserver.domain.

■For Cisco Plug and Play Connect cloud portal discovery, set the SAN field to the controller IP address, if the IP address is used in the Plug and Play Connect profile. If the profile uses the controller hostname, then the SAN field must be set to the fully qualified domain name (FQDN) of the controller.

If the controller IP address that is used in the Plug and Play profile is a public IP address that is assigned by a NAT router, then this public IP address must be included in the SAN field of the server certificate.

If an HTTP proxy server is used between the devices and the controller, ensure that the proxy certificate has the same SAN fields with the appropriate IP address or hostname.

It is recommended to include multiple SAN values in the certificate, in case discovery methods vary. For example, you can include both the controller FQDN and IP address (or NAT IP address) in the SAN field. If you do include both, set the FQDN as the first SAN value, followed by the IP address.

If the SAN field in the controller certificate does not contain the appropriate value, the device will not be able to successfully complete the plug and play process.

Note: The Cisco Plug and Play IOS Agent checks only the certificate SAN field for the server identity. It does not check the common name (CN) field.

Upgrading a Cisco Catalyst 3650 or 3850 Series Switch to Cisco IOS XE Denali 16.1.1 While Provisioning

This section applies if you have a Cisco Catalyst 3650 or 3850 Series switch with a software release of Cisco IOS XE 3.6.3, 3.7.2, or earlier, it is in a factory default state (unprovisioned in the network), and at the same time as provisioning you want to upgrade it to Cisco IOS XE Denali 16.1.1E.

Such devices with older software releases fail the normal upgrade process to release 16.1.1E, however, you can use the Cisco Network Plug and Play application to do the upgrade while provisioning the device, by using the following steps:

Prerequisite: The Cisco network device to be provisioned is in a factory default state and can be auto-booted with the 16.1.1E image. If you are using a network device that was previously configured or is in an unknown state, see the reset details in the Solution Guide for Cisco Network Plug and Play.

1. Put the Cisco IOS XE Denali 16.1.1E image on a TFTP server that is accessible to the device you are upgrading.

2. Create a configuration file for the device and add the following lines to the end of the file, which will upgrade the software and reload the switch:

The tftp URL must include the IP address of the TFTP server ( ip-address), the directory in which the image resides ( dir), and image filename ( filename).

3. Upload the configuration file in the Cisco Network Plug and Play application, by using the Upload button in the Configurations tab.

4. Add the configuration file to the device information, either in the Projects tab (for a new device that you are preprovisioning) or in the Unplanned Devices tab (for an unclaimed device that is already installed but not yet provisioned).

5. If the device is unclaimed, click Claim to provision it, or if you are preprovisioning a device that is not yet installed, it is automatically provisioned when it is installed. Note that it takes about 25 minutes for the upgrade to complete and there is minimal console output from the device during the process.

6. Verify that device status is Provisioned in the Cisco Network Plug and Play GUI.

7. Verify that the device is successfully deployed by checking the log messages by clicking on the device serial number. Look for the message, “Device was successfully deployed!!”

8. Verify that the installed software release is Denali 16.1.1E by using the show version command on the device.

Caveats

■Release 1.6.3 Resolved Caveats

■Release 1.6.2 Resolved Caveats

■Release 1.6.1 Resolved Caveats

■Release 1.6 Resolved Caveats

■Release 1.6 Open Caveats

Related Documentation

■ Solution Guide for Cisco Network Plug and Play —Solution Guide for the Cisco Network Plug and Play solution.

■ Configuration Guide for Cisco Network Plug and Play on Cisco APIC-EM —Describes how to use the Network Plug and Play application in the APIC-EM to configure Cisco network devices.

■ Cisco Open Plug-n-Play Agent Configuration Guide —Describes how to configure the Cisco Open Plug-n-Play Agent software application that runs on a Cisco IOS or IOS-XE device.

■ Mobile Application User Guide for Cisco Network Plug and Play —Describes how to use the Cisco Network Plug and Play mobile application.

■ Plug and Play Connect website —Release Notes and documentation for the Cisco Plug and Play Connect cloud service.

■ Cisco Application Policy Infrastructure Controller Enterprise Module Deployment Guide —Describes how to deploy and troubleshoot the Cisco APIC-EM.

■ Cisco Application Policy Infrastructure Controller Enterprise Module Configuration Guide —Describes how to configure settings for the Cisco APIC-EM.

■ Release Notes for the Cisco Application Policy Infrastructure Controller Enterprise Module —Release Notes for the Cisco APIC-EM.

■ Release Notes for Cisco Intelligent Wide Area Network Application (Cisco IWAN App) —Release Notes for Cisco IWAN.

■ Software Configuration Guide for Cisco IWAN on APIC-EM —Configuration Guide for Cisco IWAN.

■ Cisco APIC-EM Quick Start Guide —Guide to getting started with the APIC-EM and including a list of related documentation (available in the APIC-EM GUI).

■ Open Source Used In Cisco APIC-EM —List of open source code used in the Cisco APIC-EM.

■ Open Source Used In Cisco Network Plug and Play —List of open source code used in the Cisco Network Plug and Play application for APIC-EM.

Obtain Documentation and Submit a Service Request

For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information, see What’s New in Cisco Product Documentation.

To receive new and revised Cisco technical content directly to your desktop, you can subscribe to the  What’s New in Cisco Product Documentation RSS feed. The RSS feeds are a free service.

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

All printed copies and duplicate soft copies are considered un-Controlled copies and the original on-line version should be referred to for latest version.

Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on the Cisco website at www.cisco.com/go/offices.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)

© 2017-2018 Cisco Systems, Inc. All rights reserved.