Demystifying ZTP/PNP trough USB

Cisco Catalyst SD-WAN provides several methods to onboard both virtual and physical SD-WAN routers (cEdges) into the SD-WAN Manager and the SD-WAN fabric. In most deployments, Zero-Touch Provisioning (ZTP) is performed through Cisco’s Plug and Play (PnP) Connect service. This solution enables a cEdge with internet connectivity to automatically discover and connect to its assigned SD-WAN Validator as part of the onboarding process.

When a cEdge does not have direct internet-facing transport connectivity, the ZTP workflow falls back to alternative discovery mechanisms. In this process, the device attempts several methods, primarily through DHCP options, to locate its SD-WAN Validator and continue the onboarding procedure.

In the less common scenario where a cEdge has no internet-facing transport and DHCP is either unavailable or cannot be configured to provide the required options, a USB drive containing a bootstrap file can be used instead. In this article, I will explain how to bootstrap a cEdge running IOS-XE using this method and discuss the key considerations and intricacies involved.

Starting point

To start, you need some things.

• A working (on-premises) Cisco Catalyst SD-WAN cluster. I’ve tested this using version 20.15.5.
• A Cisco Catalyst SD-WAN router (cEdge) running IOS-XE. I’ve tested this with IOS-XE version 17.8.2.
• A USB-drive, with a single partition formatted in the FAT32-format.

The bare minimum

Depending on your use case, you may not need extensive bootstrap configuration. Let’s start with a simple example and build from there.

First, create a file named ciscosdwan.cfg and place it in the root directory of a USB drive. Then add the following configuration:

#cloud-config
vinitparam:
 - org : rubenvankomen-org
 - vbond : 192.168.1.2
 - wanif : Cellular0/1/0

In this example, we define the organization name, the SD-WAN validator (vBond) that the device should connect to, and the interface that should be used for that connection. Want to use multiple SD-WAN validators? No worries, configure a DNS-record/FQDN instead of an IP-address.

When the SD-WAN router boots with the USB drive containing the ciscosdwan.cfg file inserted, it bypasses the standard Plug and Play (PnP) discovery process and attempts to establish a connection directly to the specified SD-WAN validator (vBond) using the configured interface.

During boot, on the console of the router you can see this process happening by looking for the following loglines;

Now you’re cooking with gas!

Troubleshooting

*Aug 12 13:50:42.005: %PNP-6-PNP_DISCOVERY_STOPPED: PnP Discovery stopped (Startup Config Present)
*Aug 12 13:50:47.657: %SDWAN_BOOTSTRAP-5-PROGRESS: R0/0: vip-confd-startup: Status: Loading day-0 user bootstrap config
*Aug 12 13:50:53.823: %SDWAN_BOOTSTRAP-5-BOOTSTRAP_CFG_LOAD_SUCCESS: R0/0: vip-confd-startup: Successfully extracted and committed config from /usbflash0/ciscosdwan.cfg
*Aug 12 13:53:00.234: %VDAEMON-5-CONTROL_CONN_STATE_CHANGE: R0/0: vdaemon: Control connection to vBond :: (TLOC: 192.168.1.2/12346/lte via lte) is UP