Provisioning new sites as part of a wide area network can be a pretty big
challenge.
If we think about an organization that has hundreds or potentially even
thousands of remote
sites and they're all part of a wide area network, then we can really start to
see some
of the issues here.
But even if we're not this large, think about the challenges of provisioning a
new network.
So let's say we've got a new site that we're spinning up and this site could be
somewhere WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
somewhere
pretty remote.
Maybe it's a few hours away, maybe it's an airplane right away, maybe it's in a
completely
different country.
And so we and IT tend to live over here and I could bring a router in and
configure it
and then ship it out to this location.
And that's typically what we expect to do with a traditional network.
And so hopefully somebody here can be our smart hands and they can install this
router,
plug it in, hopefully get us connected to the right WAN circuit provider WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
plug it in, hopefully get us connected to the right WAN circuit provider
connection,
maybe they provide a copper handoff, something like that.
And then we have to hope that this connectivity into the WAN space comes online
.
And what happens if it doesn't come online?
What happens if there is an issue with the configuration?
Maybe I put the wrong IP address on the interface.
Maybe I just had a circuit settings wrong.
Maybe the IP address I was given changes by the time it arrives to the site and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Maybe the IP address I was given changes by the time it arrives to the site and
the service
provider says, you know what, don't do that IP address to this IP address
instead.
And now we're relying on our smart hands here to be really, really smart.
In fact, usually we don't even need smart hands, we just need hands to get this
thing installed
and connected in.
But now we're asking this person to log into this router and change an IP
address.
Maybe I can do a WebEx with them or screen share.
We can tell that this is going to be very painful. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can tell that this is going to be very painful.
And the larger our organization is the more often we have to worry about this
particular
situation.
And so we want to not have to rely on our managers or our staff at this
location wherever
it is.
And we don't want to have to do that, but we also don't want to have to travel
to get there
ourselves.
Yeah, if it's a few hours away, maybe even if it's a days travel away, it
wouldn't be the
worst thing in the world.
Maybe we could ship it back. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Maybe we could ship it back.
We've got options there.
But as soon as it's a plane ride or again in another country on another
continent, then
this travel becomes very restrictive.
And so yeah, we might just have to ship it back so that we can try to fix the
configuration
and hope this all doesn't happen again.
So we want to solve this problem of provisioning.
And we have a more sophisticated white area network architecture now.
So can we do that?
And the answer is, well, yes, if the answer was no, I'm not sure why we'd be WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the answer is, well, yes, if the answer was no, I'm not sure why we'd be
having this
session.
But we can address this with zero touch provisioning.
Sometimes abbreviated as ZTP.
So zero touch provisioning.
The idea here is that we want to automate bringing up a new location.
So these new, when edge devices that were shipping out and we still are going
to have to ship
this, we need to make sure that it gets there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this, we need to make sure that it gets there.
Now, it doesn't necessarily have to come from me.
It could actually come from, sure, from me, or it could come from the original
manufacturer.
In our case, we'll just say it's Cisco.
I order a router from Cisco and I have them ship it to the site directly.
And say, well, wait a second.
I haven't added my configuration on there.
If we're going to ship it directly to the site, it's not going to have any
configuration
and that's correct.
Because we're going to automate these new edges coming online or onboarding to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Because we're going to automate these new edges coming online or onboarding to
the SD-WAN
environment.
So here's how this comes together.
I as the admin now log into V-manage and I create a template that I'm going to
use for
this edge device.
I also add this particular edge device into my white list.
This is important from a security perspective because if we're going to
automate onboarding
new WAN edges, we would not want a thread actor, a bad guy, somebody like that, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
new WAN edges, we would not want a thread actor, a bad guy, somebody like that,
to be able
to add their own router into our environment.
So I'm going to white list this new router.
I understand that this new router is going to be coming online and so we need
to allow
it and we need to have a template that includes all of the key configuration
points.
So this is step one.
I as the admin have to do this.
Then step two over here is that we just need an installer to perform the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Then step two over here is that we just need an installer to perform the
installation
for us.
What does the installation look like?
Well, it's putting the router into a rack and providing power as well as
hopefully some
amount of connectivity.
So I need to connect the router into the WAN circuit and possibly not just the
WAN circuit
on this side but also the Ethernet connector to the rest of my network on the
other side. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
other side.
But that's it. This is back to not needing smart hands.
This installer can be anybody.
It could be a local manager or some other staff person and I can just over the
phone, ideally,
walk them through getting the router into the rack and power it on and connect
it.
So here's how this works.
There's a little bit of glue in the middle to connect this new WAN edge to the
rest of
our environment.
And so it can't just go out directly to V-manage for example and download its WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so it can't just go out directly to V-manage for example and download its
configuration.
That's not going to work because this WAN edge device does not know which
customer it
belongs to.
We are setting it potentially directly from Cisco.
So this is just a blank WAN edge no configuration included device that's being
shipped to this
location.
So it's going to be configured to reach out to a ZTP cloud server that Cisco
manages. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
manages.
And this ZTP cloud server is going to connect the device to the V-bond in our
organization.
The V-bond is ultimately the glue that holds everything together as we've said.
And so it's going to push the configuration info down to this device and tell
it how to
connect in and start to download its configuration which at that point it's
going to be able to
do thanks to the V-bond getting it connected into our environment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
do thanks to the V-bond getting it connected into our environment.
So that's the gist of zero touch provisioning.
Now there are a few requirements that we need to consider and it really has to
do with
making sure that this connection can happen here.
It needs to be able to reach out to the ZTP cloud server.
So what does it need for that?
Well first and foremost it's going to need an IP address and it's going to need
to go through
the internet for this so it's going to need a default gateway and it's going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the internet for this so it's going to need a default gateway and it's going to
need to
be able to perform name resolution to find this ZTP cloud server.
So we need DNS servers configured.
Well ideally all of this just comes from DHCP.
If I connect into my service provider and I'm given DHCP then I should have an
IP address
to default gateway and DNS servers.
Unfortunately if I don't have DHCP from the service provider and I have no WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Unfortunately if I don't have DHCP from the service provider and I have no
other network
connectivity that I can use to go out to the internet and find out all this
information
then I can actually also ship out a USB boot disk, some kind of USB key that
can have
a bootstrap configuration loaded up.
So it will require a little bit more information from the admin because then I
would also have
to ship out this USB potentially.
But again this is in a perfect world not going to be required because we can WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But again this is in a perfect world not going to be required because we can
just rely on
our DHCP.
Now a very important component in all of this as we already mentioned is
security.
As if I have a staff member on my IT team maybe leave the company and they bear
some amount
of ill will towards the company or maybe just somebody who has intimate working
knowledge
of how our company operates.
There's no reason in theory why a threat actor couldn't spin up their own SD- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There's no reason in theory why a threat actor couldn't spin up their own SD-
WAN router
and attempt to take advantage of this process.
We would want to prevent this at all costs because as soon as their router is
part of our SD-WAN
environment they can do all kinds of attacks.
They can look at our route information.
They can do man in the middle attacks by advertising routes and doing all kinds
of bad behavior
and mischief and mayhem.
Ultimately it would be detrimental to my organization if this was remotely a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Ultimately it would be detrimental to my organization if this was remotely a
possibility.
Now fortunately we already mentioned one of the techniques we have to avoid
this and that
would be to white list any edge devices that are coming online.
So as these devices get shipped out I can manage them through my Cisco portal
to make sure
that I can provision only the routers that I know are part of my network.
But the other aspect to security which is so important with all of this is
going to be
the use of certificates. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the use of certificates.
All of our WAN edge devices are going to come with certificates.
And this certificate is going to be used in a couple of different ways.
First of all it allows the WAN edge device to authenticate itself to the rest
of the network.
So to my SD-WAN environment I know that you are an authentic WAN edge device
and not just
some software designed to emulate it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
some software designed to emulate it.
The other thing it allows me to do is it allows me to ensure that the other
devices in the
network such as my V-Bond and V-Smart, my controllers they can also authent
icate to the
WAN edge.
And so this allows me to make sure that I am not talking to a controller that
isn't a valid
controller because they also have certificates.
And so now we can make sure that I am not only running an authentic SD-WAN WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so now we can make sure that I am not only running an authentic SD-WAN
device but again
I could deploy this authentic device and it connects to the threat actor who
spun up
their own V-Manage or V-Bond or whatever the situation is.
And so the security level is very, very important for us in managing and
maintaining our SD-WAN
environment.