Core: Automation

Zero-touch provisioning

Miro Kosut

Miro Kosut

— 2 min read
Share

Requirement / business driver

Bring devices online at scale without a technician on the CLI - Day-0 onboarding that's fast, consistent, and secure.

How ZTP works

A factory-default device boots, gets an address (DHCP), and is pointed at a config/image source - then pulls and applies its Day-0 config automatically. Common mechanisms:

  • DHCP options (e.g., option 67 bootfile / option 150) directing to a TFTP/HTTP server or script.
  • Plug-and-Play (PnP) / controller onboarding - the device "calls home" to a controller (or cloud) that pushes image + config + certificates.
  • SD-WAN / cloud onboarding - the orchestration plane validates identity (certs) and provisions the edge (SD-WAN design); cloud-managed wireless onboards APs the same way (WLAN architectures).

Secure onboarding

ZTP must establish trust: image integrity, certificate-based device identity, and a controlled bootstrap source - otherwise auto-provisioning is an attack vector.

Recommendation / justification

Use controller/PnP or cloud onboarding for scale and security over bare DHCP-bootfile scripts; tie identity to certificates. Justify by deployment scale (branches, APs, SD-WAN edges) and the cost/error of manual staging. ZTP is the Day-0 front end to the IaC/CI-CD lifecycle (Infrastructure as Code - declarative, idempotent, source of truth).

What would change this (mid-scenario twist)

  • Large branch/edge rollout -> controller/cloud ZTP with cert-based trust.
  • Security-sensitive -> strict image integrity + certificate onboarding (no open TFTP).

Validation checks

  • Is onboarding secured (cert identity, image integrity, controlled source)?
  • Does ZTP scale to the rollout (no per-device manual touch)?

IPv6 / dual-stack note

ZTP can run over v6 (DHCPv6 options / PnP over v6); ensure the bootstrap path exists in whichever family the management network uses.

Spaced repetition

What does zero-touch provisioning accomplish, and via what common mechanisms?

Day-0 onboarding with no CLI - the device pulls config/image automatically via DHCP options, PnP/controller call-home, or cloud/SD-WAN onboarding.

The non-negotiable design concern for ZTP is [...] - otherwise it's an attack vector.

The non-negotiable design concern for ZTP is secure onboarding (certificate-based identity + image integrity + controlled source) - otherwise it's an attack vector.

ZTP is the [...] front end that feeds the ongoing IaC / CI-CD lifecycle.

ZTP is the Day-0 front end that feeds the ongoing IaC / CI-CD lifecycle.

Sources

  • Cisco Press, Network Programmability and Automation; Cisco PnP / SD-WAN onboarding guides.

domain: Core · blueprint-ref: Core 8.1 Zero-touch provisioning · type: design-decision · status: complete · tags: [core, core/automation, tradeoff/operability, tradeoff/scale]

Read more