All right, we have this SD-WAN template deployed.
Again, at this point, we have full IP connectivity.
If you've worked through your way through the previous skill,
we should have all these controllers online.
They should all be able to ping each other.
And importantly, they should be able to ping out
to the internet using DNS.
Because again, if we're going to use the Cisco cloud,
there's going to be some URLs that will need to be resolved.
But this is where this Ubuntu machine is going to come
into play here.
Over on the left, we see an Ubuntu machine
just sitting off on its own.
It doesn't need to be network connected, at least at this point.
If we're just going to generate a root certificate,
that's something we can easily generate,
and then just copy and paste it out.
And so what we need to do is we need to connect to it.
Now keep in mind that, at least from my perspective,
I'm using the breakout tool.
This breakout tool allows me to connect using my favorite SSH
client in order to connect to all of these controller devices.
Well, look at that.
Ubuntu also was given one of those connections on port 9003.
So let's go ahead and flip over to my terminal session here.
I'm going to open up port 9003 and enter.
And there we go.
So again, we can always check CML's default configuration.
I happen to know that the login that it configures it with
is Cisco with a password of Cisco.
So I'm just going to log in here and get access
to my Ubuntu machine, which I already provided a name.
In the configuration, if you didn't provide that name
by creating this environment yourself,
it might say something like insert those name here.
But the name is not really relevant.
So what we need to do is we're going to use again
that open SSL suite to perform the generation of an RSA key.
So I'm going to say out here, we're
going to create an output called CA.Key.
And I can choose the bits.
We'll just do 2048.
And so this is going to generate a set of keys.
If I do an LS that shows me what's in the directory,
I see the key there.
I can do a cat.
This is a great command.
It just allows me to read a file as if it's a text file.
And I see the whole private key generated there.
All right, very good.
So we've got a private key.
And wouldn't you know it?
Right in the middle there is the name Mary.
I don't know how that jumped out at me.
But I guess that's important for some reason.
Yeah.
So either way, we've got a key.
It has Mary in it.
And so now what we need to do is we need to generate
a certificate using this key.
This is another open SSL command.
And so we're going to type in open SSL request, req new.
And we're going to use the x509 format.
We can specify how many days that this is going to be eligible.
This is a lab environment.
I'm just going to say 500.
And then I specify the key using my full directory path.
But because I'm in the home directory,
it can just specify the key name.
And then the output name once again.
And we'll call this CA.crt.
So again, CA being the certificate authority,
this is essentially our root certificate.
Now I'm going to ask some questions that it will use
to help generate the certificate.
And this part is very important, especially
from the perspective of the organization name.
So I'm just going to use some parameters here,
like my country's the US.
I'm just going to put myself in Chicago, Illinois.
That's close enough to where I actually am.
That didn't work very well.
All right, organization name.
Look at that, internet widgets.
I like that.
I'm just going to say CBTN here.
And then we don't need to worry about anything else.
All right, so we have just generated our certificate.
So again, I do LS to take a look at the list of files
that are in my home directory here.
I now see CA.crt.
And I can use that cat command to look at it.
And I see a lovely certificate here.
So we see the begin and end.
And when we're copying this, we're
going to want to copy the whole thing,
including the begin certificate at the start,
including the end certificate at the end.
And I don't see Mary in here.
I do see the mamba.
So that's kind of cool.
Always fun to look for random words jumping out at you.
At least it is for me for some reason.
So at this point, we have what we set out to accomplish.
We're done from a Ubuntu perspective.
So if you have a little bit of an allergy to Linux,
don't worry.
It's just running those two commands.
And we have generated our root certificates.
So this is what we're going to need to copy over.
So next, we're going to hop on over to the Cisco Cloud.
So I'm already over here.
I'm at software.sisco.com, Cisco Software Central.
I'm going to scroll all the way down.
And we see network plug-in play.
So this PNP we refer to over and over again,
it's simply Cisco leveraging that plug-in play moniker.
I'm going to say manage devices here.
And now we need to log into our account.
So I'm going to go and do that real quick.
All right.
And now I am logged in.
So again, this is a real actual Cisco login.
I'm using my real world CBT nuggets login.
We see that it actually identifies me as being part of CBT
nuggets there at the top.
You see my initials all the way at the top right.
And so again, this is not a lab environment
from Cisco's perspective.
Yes, our SD-WAN environment is a lab,
but we can still use the plug-in play connect feature
in order to get our devices, I guess, configured and installed
with signed licenses.
So remember our process.
We need to take that root certificate.
We need to provide it to Cisco.
And we need to provide it to the manager.
And so that's the goal here.
So I'm going to go ahead and start by providing it here
to plug-and-play connect portal.
But we have to go through a little bit of a process to do that.
So first of all, we're going to click on controller profiles
here and add a profile.
Now, this is an interesting one.
We look at the dropdown.
We do see V-bond there.
Is that what we're talking about?
And the answer is actually yes.
So we need to select V-bond here.
You'd think it's a SD-WAN.
And maybe by the time you're watching,
the Cisco has changed this.
Maybe it says validator.
Maybe it says SD-WAN validator.
But just keep in mind that we're looking
for whatever feature that is.
So the profile name, we can call this whatever we want.
And I'm just going to call this something like CBT lab.
This is really just a description
so I know what this is for.
Now, we do need a default profile in the system.
So if I don't say yes here, it'll bark at me
because we need at least one default.
This is the only one.
So I'm going to make it the default.
For me, I just need to type in the organization name.
Remember what we've said.
It's very important that we keep the organization name
consistent through this whole process.
So CBT and lowercase is what I've been using at every turn.
Now, I'm going to change the host name to an IPv4 address.
I'm going to type in the IP address of my system here.
Now, importantly, this is going to be the public IP address
of the lab environment.
Remember, we've got that NAT concept.
We're netting out-- now in my environment,
my CML virtual machine has a private IP address.
I'm guessing yours does as well.
So this is going to be a double NAT situation.
My VPN0 address, that .255 address in there
that's in the third octet.
VPN0 is a private IP address range.
It exists only inside the lab.
It's basically it's NATted to my 192.168.17,
basically the same network I use for VPN 5.12.
And then when it goes out to the internet,
it gets NATted again to another public IP address.
So hence, double NAT.
But just make sure that this actually
matches the public IP address that your V-bond would use
when it reaches out to this Cisco Cloud service.
So we're going to enter that in.
And then this is where we need to paste it in.
I copied it already.
Let me make sure it's still in there.
It looks like it is.
All right, very good.
So I just pasted in the certificate.
And now we need to say next.
And submitted.
And now we are done.
So I can just say done here.
Oh, nice.
Cisco wants me to fill out a survey.
We'll do that another time.
So now I've got this profile added here.
So that's good.
And we're going to eventually come over here to certificates,
but not yet.
First of all, we need to go provide the same certificate
to our manager.
So that was the goal.
Whoops.
Looks like I got logged out.
No problem.
Gonna log right back in using the admin account,
which is admin Cisco by default.
All right.
So we're going to clear out the popups.
And I'm going to go to configuration.
And down here, under certificates,
I'm going to go to my control components,
come over to CA cert, say add a CA certificate.
And I can just switch this over to paste.
I'm going to call this my root cert.
And I will paste it in.
So there we go.
Again, we are including the end certificate
and the begin certificate, the front and the start.
But all I need to do is paste it in and click save.
And now I have provided my root certificate
to the two entities that I needed,
the plug and play connect portal, as well as manager.
In the next step, we will generate our CSRs
and get installed or signed licenses installed
onto the controllers.