All right, I wanted to take a quick moment and identify where we are in this
process
because it's one thing to have a diagram and then do a bunch of stuff in the UI
, but
let's just pause for a moment and come back to the diagram.
So over here on the right, we started on the Ubuntu machine, we generated that
root certificate.
And now what we've done is we've transferred it over to the Cisco plug and play
connect
portal.
And we also have moved it on to manager.
So we could kind of draw a line right in here and say, this is about where we
are, but it's
a little bit, maybe the line doesn't do a good job of expressing where we are
because we really
need to pay attention to this.
We need to generate these certificate signing requests, the CSRs, that will be
automatically
pushed to the Cisco plug and play connect portal.
So step one, we're going to generate the CSR step two, Cisco will sign those
certificates.
This might actually take a couple minutes when you're doing it yourself, just
be aware that
it might take a little bit of time.
Usually by the time we generate all three of these, the sign certificates have
started
at least to be created by Cisco.
Remember, we need to download them.
So that'll be step three over here.
And then step four, we actually have to provide them back into manager, which
will push the
other ones who will still call this step four, step four here, it'll still push
it down to
controller and validator on our behalf.
So this is what we're going to accomplish.
We're going to start by generating the CSRs.
So back into manager, we go, we're going to start from the configuration
certificates,
actually, where it's actually right where we are, we're going to click over
here on control
components.
And again, at this point, we see that we've got the validator and the managers
itself
and the controller.
So it knows some things about the manager because again, that's the device we
're on.
It knows everything about itself, including the fact that there's no
certificate installed.
But the fact that there's no certificate installed on the validator and the
controller, that's
why we don't see any information in here.
And hopefully by the end, ideally, we've done enough so that this is fully
populated
and our devices are communicating with one another.
What we have to do here is we have to come over to actions and use these three
dots to
say generate a CSR.
So it's just going to say that, hey, this is going to generate it, say yes, and
this is
going to take a few moments.
Now keep in mind, earlier in the process, actually, it didn't take very long at
all.
There we go.
The CSR request is sent to Cisco for signing automatically.
Okay, so that's good.
We need to do this three times.
What I was going to say is that we are relying on the fact that we have
provided our login
credentials for Cisco smart accounts.
So remember, earlier in the process, we did that.
There's number two.
Let's do number three, generate CSR.
Remember we did that earlier.
I'll show where that is here in just a moment as well, just in case we're
getting errors
here in any way.
Hopefully we're not getting any errors.
But if we are having problems communicating with the cloud, we're going to need
to come
over here to configuration.
Actually no, it's administration and then settings.
And the right at the top is Cisco account.
So even though it looks like plug and play connect, oh, that's what we want to
do here.
No, we actually just need to provide our credentials here for our Cisco smart
account.
So that's all we actually need to accomplish is to make sure that those
credentials are
in place.
So now we're going to go back over to the plug and play connect.
So recognize this screen right here.
And I mentioned we're going to come over to certificates.
Well, let's do that.
And look at that, we see not only the certificates that were just generated
today here.
These are the top three.
And yes, I've delayed long enough that all three of them are done.
Years might not be done quite that quickly, but you know, it doesn't take long
very, very
long.
And we see the other ones that have been generating is part of my lapping that
I've used as part
of the prep work.
So all we need to do is download these.
So I'm just going to download these.
And it does say that we are going to potentially want to be aware of the fact
that these can
be malicious files because they're not CER, they're not certificate files.
But yes, we do want to keep them all.
All right.
So that's that we have the signed licenses now.
So Cisco took those certificate signing requests that you had the root
certificate here in
the cloud.
So create and signed certificates.
Now we need to install them.
All right.
So now we're on to step.
Well, step three was downloading.
Step four is actually uploading.
So now we're going to come back.
Whoops, not there to here.
Let's just kind of get back and reset ourselves.
So now we're at the Cisco catalyst SD when a manage interface.
I'm going to come to configuration here and I'm going to then come down to
certificates
and control components.
And now there's this link right here for install certificate.
What I can do is I can select the files here or I could just paste it in if I
wanted to.
So whichever one is easier, I'm just going to select the file.
And we see that I have downloaded a whole lot of certificates.
But what's interesting about this is I'm going to, let's say, pick V bond here
and you keep
track of which one and it pays the text in and then I just say install.
Now wait, I didn't tell it which device to map it to.
It's going to know because embedded inside of the certificate is the device
that it applies
to in manager V manage.
It knows what all those devices are.
So it's very important, by the way, that we sit here and wait while this
installation
is taking place.
So we see this in progress message.
Hopefully, we see that this is progressing.
If we get any errors, then we're going to need to reevaluate our process and
try to figure
out what might have gone wrong.
I can click this action link over here and it gives me all of the information
of everything
that's happening, including the fact that now we are at a successful point.
I will say the number one potential concern with this.
Let me just go ahead and go back here.
So let's go back to the control components.
The control and concern could be that I logged in using the wrong login.
So Cisco does by default allows to log in with Cisco.
I might need to come over here, say edit and change the username to admin.
It's not so much that the login name has to be admin.
It has to be part of the administrative role and Cisco gives us an
administrative role
called admin by default.
If I want to create a new admin account, that's fine, but it does need to be
part of
that role.
So, if we did use Cisco here, we just come in here and edit it and life will be
good.
So at this point, let's see here, we need to install a couple more.
I guess, yeah, we need to install our certificate.
So I'm going to install now RVVantage.
We did VBond.
So we'll install that.
And again, this is going to take a few moments.
It doesn't take long.
But again, like if I watch and this says install certificate, that's the
message.
It does say scheduled.
That's a little deceptive.
It's kind of in the middle of trying to do things.
Oh, it says canceling install.
Did I accidentally do that?
Let's see here.
Started by admin install certificate already in progress.
Interesting.
Okay.
So let's go ahead and go back to control components.
Let's see here.
So installed validator has one installed.
Now that's good.
We still see that this isn't showing up.
And that's because we haven't actually formed tunnels yet to these devices.
No problem.
We just got to get these certificates installed.
So let's go ahead and install.
Oh, it's because I did the VManage.
So it should have already, well, I think that was okay.
Tell you what, let's go ahead and install VSmartFirst before going back to
manager.
And it's entirely possible that something got messed up there with manager.
We'll just try that again here momentarily.
All right.
So this one's in progress.
That's good.
It looks like updating controllers with new certificate.
And again, as long as there's progress here, that usually means that it's going
to end
up working.
So as we've said a few times, getting the certificates installed can be a
little bit
of a cumbersome process.
Fortunately, using the plug and play connect cloud, it's not that bad, but we
still have
a little bit of manual processes here.
We do see as a success, so that's good.
But there are potential errors that you might head along the way.
For the most part, it's just making sure that we're logged in correctly, but
also making
sure that we have the right root certificate installed in all of the locations
as well.
That's also important.
So if I come one more time out here, let's see here.
So validator updated, validator updated, installed.
Okay.
So we might be good here.
We view the certificate.
Okay.
It looks like it did take it.
So that's good.
So the last thing we have to do is create some tunnel interfaces.
So when we look back on our diagram here, we were focused very much on getting
all of
this done.
And now we have all of that done.
But these devices up here need to form tunnels to one another.
And right now we've got these three devices.
We've got the VPN 512 connecting in, but we also have VPN zero.
These interfaces right here, which are ethernet zero and gig E zero slash zero,
depending
on our device, these need to be enabled for tunnels.
And now we're at the point where we can enable that and allow the devices to
actually form
the tunnels that are going to allow for control plane information as well as
orchestration
plane and all of those, everything will be able to be fully synchronized once
those tunnel
configurations are in place.
So I'm going to flip over here to my terminal session.
I'm on the vSmart or the controller interface or yeah, we're on the controller.
I'm going to do my config and I'm going to get into VPN zero and I'm going to
get onto
interface vSmart has e0.
So interface e0 and I'm simply going to enable tunnel interface.
So that's it.
And then I can do that commit and quit command.
We're good there.
Do the exact same thing on manager.
I'm going to do my config VPN zero interface e0 tunnel interface commit and
quit.
Now I'm going to look slightly different on validator because the validator
runs that
the edge software has a different interface.
Also needs to know what type of tunnel we're using at the data plane.
So for that, I'm going to say config VPN zero interface gig e0 zero and enable
tunnel interface.
But now I also am going to specify encapsulation IP sec.
So now I can do my commit and quit and our configuration is complete.
Let's go ahead and swing back over to our manager interface and make sure that
everything
is coming up.
So I'm going to come over to monitor and at this point we should see all three
of our
control components.
The fact that I've got one of each is really good.
We're in a good place here.
I can go to configuration.
Look at my devices control components.
And look at that.
Now we've got information.
I see the system IP addresses.
The fact that we're in sync, different host names and such.
And if I go now to my certificates control components, we can see that we've
got the
certificates listed as well as the expiration dates.
Everything looks proper and good there.
So that last piece of making sure that the tunnel interfaces are enabled, that
is something
that we need to make sure happens.
I wanted to set that aside because that can be a problem in trying to bring all
of this
online.
And if it's just a command that we happened to miss earlier or something along
those lines,
then that would cause a lot of chaos.
So let's just make sure that that's part of our mental checklist and part of
our process
that the interfaces actually allow for tunnels.
Indeed, at this point, these devices are communicating.
Our tunnels are online.
We successfully use the Cisco plug and play connect cloud in order to sign our
certificates.
And thanks to managers clicking click around interface, we're able to very
seamlessly get
those certificates installed.