All right, so logging into our manager, we should be greeted by this monitor
dashboard.
And what we want to do is we want to come over here to configuration first.
We're going to go to the certificate section down here and look at our WAN
edges.
So recall, this is where we have imported our WAN edge device that we got from
the plug
and play portal.
We sent it to the controllers and effectively these are these UUIDs as well as
the tokens
that we're going to use in order to bring these devices online.
The funny thing about this is that in order for us to use these, we have to
tell a virtual
router what your UUID and what your OTP are.
And so that's the configuration we're going to apply.
But before we get to that point, we want to make sure that the environment is
ready or
potentially not ready, depending on our perspective, for these devices to come
online.
There are three different statuses that we can associate with these SD WAN
edges.
We can declare them to be valid, invalid, or potentially staging.
Let's just go through the difference real quick.
First and foremost, if a device is invalid, then that edge device is not going
to be allowed
to form control plane connections.
And it's not going to be allowed to create data plane connections.
So in invalid device is usually one that we're getting ready to delete.
It might mean that we don't exactly know where this one came from.
Maybe somebody created a virtual edge device and we're pretty sure it should be
removed.
But either way, we don't want it forming any kind of connections in our SD WAN
environment.
We can also move it into the staging status.
And the staging status allows us to form control plane connections, but doesn't
allow
us to form data plane connections.
In other words, I can form connections to the V-bond and the V-manage and the V
-Smart,
or our validator, manager, and controller, while not allowing me to form
connections
to other edge devices.
So that would be staging.
It's going to allow us to get a device online without actually allowing us to
join the
data plane part of the SD WAN.
Now lastly, we do have valid.
And as we might imagine, this is going to be full functionality where I can
communicate
to the control plane and I can communicate to the data plane.
And this is the default setting when we first add devices in.
Because Cisco's looking at it saying, "Hey, you just added a whole WAN edge
list of devices.
We're assuming that you did that intentionally and therefore it's going to
place it into
the valid state."
The good news is our devices aren't online yet, so if we don't want this to be
valid,
then we can change that.
So to demonstrate this, what we're going to do is place these devices into the
staging
state.
So I'm going to say, "Yes, we want to stage these devices."
Yeah, the pop-ups get in the way, especially when you're dealing with a reduced
resolution
for the sake of recording.
So we've got to clear these out just so I can click the stage device link and
there
we go.
So now they are in the staging device, but as always, pay attention to this
link here.
If it turns red, that means that it's out of sync, at least from manager's
perspective,
it's out of sync with the other control components, namely our controller and
our validator.
So if I click send to controllers and click confirm, it's going to alert the
other devices
that we want these edges to be in the staging state.
So in a few brief moments, it doesn't take very long at all.
There we go.
It is already successful and we can move on to the next configuration.
So next up, we're going to create our configurations.
We need to do that in two places.
Again, as I mentioned, we are going to create a generic configuration that we
can apply
to all of the devices.
That's going to consist of all of the certificates we want our edges to trust.
All of the edges to trust all of the same certificates, which allows to
communicate with
all of our control components.
But then we also need to create specific configurations, which has to do with
the UUID
and OTP, which are going to be unique per device.
The goal is to create one configuration for every device and we're going to
combine these
two configurations in order to do it.
So let's go ahead and obtain the generic configuration, which contains the
trusted certificates.
So I'm going to go to configuration and under devices, now I go to WAN edges.
I know we're trying to get certificate configuration.
You'd think it'd be down here, but nope, it's under devices.
So I'm going to come here and I'm going to click this link right here that says
export,
export, bootstrap configuration.
So I just click this.
Now what this is asking for is what is our WAN interface name going to be?
And I could like type gig one in here, something as soon as I start typing,
says, hey, this
should be the full name.
So for example, gigabit ethernet zero slash zero, so I can actually copy that,
paste it
in and in our CML environment, if you're using the same interface IDs, you'll
recall, actually,
we can just click over and look that all of our WAN edges are using gig one for
connecting
to VPN zero is specifically the internet connection.
Now yes, both of these are VPN zero.
However, the internet one is the one that's going to get us out and
communicating to not
only the manager here, but also potentially going externally if needed.
So let's go back here, make sure gigabit ethernet one is in place.
And it says generate the generic configuration.
I love it.
So we now have the generic configurations, but we still need the specific one.
So I'm just going to stay right on this page under actions, use this ellipses.
So once again, now find an option in this case, we're going to say generate a
bootstrap configuration.
Now it already knows the device model because of the WAN edge list, as well as
the host
name.
So now I just have to pick which type of bootstrap configuration I want.
Well, I want to use cloud in it because that's what we're going to use for CML.
Recall, if I click on one of these, go to the config, we see cloud config right
in here.
And then if I scroll down, we will see cloud boot boot hook, we're going to use
that section
as well.
But ultimately, this is this whole thing is set up around that cloud
configuration.
So cloud in it is what we want.
We'll hit OK.
We've successfully created it.
It's right here.
So here's the thing we have to be careful of.
I could cancel it, or I could download it, or I could copy it out of here.
But I do need to make sure that I get it.
And so I'm just going to copy this, and I'm going to paste it into a text file.
Now to be careful, because I just created this configuration for edge 12, I
need to
keep track of which devices, which otherwise we're going to get all mixed up
here between
our CML names and our manager names, because the EUIDs and such are how
managers going
to tell them apart.
So I just generated the edge 12 configuration.
Let's go ahead and generate all of these for 13, 14, and 11 as well.
And I'll just go ahead and skip ahead to the point that we have this all
documented.
Make sure you document this as well if you're following along.
Okay, so we've got all of these configurations.
And now what's interesting here is if you go back to the certificate section
under configuration,
look at WAN edges, you'll notice that this icon actually changes.
It lets us know that we created a bootstrap configuration, and it doesn't
indicate necessarily
we've done anything with it, because it doesn't know that for sure.
But it at least allows us to see which devices have, in theory, been worked on
by somebody
in our department.
So we have the generic config, and we have the bootstrap config.
Let's go see how we're going to apply that into CML.
So I've got edge 11 pulled up here.
And again, we've got this whole configuration section.
What we'll notice here is that under VINET param or all of our initialization
parameters,
we see a bunch of variables on the left.
These are taking the form of key value pairs, or maybe dictionaries or whatever
we want
to think about this, where I've got a key on the left and a value on the right.
So what I need to do for edge 11 is paste in some important information.
So what information am I pasting it?
Well, let's just go back real quick and look at under devices, WAN edges, and I
look at
edge 11, look at the bootstrap configuration again, this hasn't changed.
But notice that we've also got that VINET param.
This is intended for me to copy and paste.
So I can copy this, go back to my CML, and now paste it in.
Here's what I have to be careful of.
We notice I'm getting UUID OTP, the VBond, which is cool and org.
But notice what I didn't get.
I didn't get this RCC value, and there's another configuration that's going to
be required.
So I have to be careful here to make sure I get all the configurations in place
.
I'm going to go and highlight all of these and paste in those four parameters.
So again, UUID OTP, VBond, and org.
Order doesn't matter here, it just needs to be pasted in correctly.
But again, we're not done.
So now I'm going to pull up what it looks like with that generic configuration.
So here's what the configuration looks like.
We see again VINET parameters listed up here.
But then we get the CA search section.
As I scroll down, I see all of the certificates that we're wanting to trust.
So I'm going to copy this whole thing.
But notice that we don't want to overwrite the section that we just pasted in.
So I'm going to copy all of this, but I'm going to start here with this WAN
interface
parameter.
Make sure I get that RCC, and then I copy all of the rest of this.
So all the way down through N certificate.
Now I can go back to my CML, and I can effectively paste in for this whole
section here.
From CA search down to N certificate, I'm going to hit paste.
I now have a new N certificate scrolling all the way back up.
We should see that I now have six total parameters up here.
WAN if and or WAN interface and RCC are both indicated here now.
So that is how I need to configure all of these devices.
Now very importantly, notice that CML says unsafe changes here.
So I'm going to click save, and that's going to make sure that all of these
changes are
locked in.
So that's what I have to do for all four of these.
I'm going to go ahead and perform that configuration on all four of my edge
devices, but I'm going
to fast forward so we don't have to watch it all together.
Okay, so on my end, what I did was I pasted the generic configuration in on all
of these
devices, and then I went around and pasted in the specific configurations
around the
UID's.
We want to make sure that all of the UID's are different and properly assigned,
because
if they're not again, that's going to cause a whole lot of confusion.
So that's a very important part of this.
So now one last part in all of it is that if I will notice is if I scroll all
the way
down to the bottom of this configuration, we're going to see that cloud boot
hook section
that I mentioned earlier.
We'll notice that it has a host name option in here, insert host name here, and
it indicates
that I could replace this with edge 11, and indeed I can.
If I want to give it a configuration that is outside of the balance of
everything else
we did, namely a host name configuration, or even an interface level
configuration, then
I can do that here.
And that's exactly what I'm going to do.
I'm going to provide it with a host name, allow it to give it this username of
Cisco
and a secret of Cisco.
I can change this if I want to right now, but Cisco Cisco works, but then check
this
out.
I can hit enter and I can just keep going.
I can put other configurations in here again, including interface level
configurations.
So let's go ahead and do that.
Let's go ahead and give it a configuration for interface.
Now we have to be careful here with how we do this.
I'm just going to use the full interface name of gigabit ethernet one, hit
enter and add
an IP address IP.
Let's just use the full command system, make sure that everything takes
correctly, but
255 dot what are we doing?
Oh yeah, with edge 11, we're doing dot 11.
And then that's a slash 24.
So that's an IP address I just applied to an interface.
And then I can even do my gig to interface.
So interface gigabit ethernet to and then IP address.
And that's going to be the two five four subnet as we indicated still part
again of VPN zero
of VPNs or VRS can have a whole lot of IP addresses and subnets.
And so we're going to create that.
And then also as part of VPN zero, we want a default route.
So I can do IP route, give it an all zeros for a default.
And then the default is going to be out the 255 subnet.
And then also DNS now DNS in iOS space uses the IP name server command.
And so I can use something like Gargenerica Google internet DNS server.
So this configuration, I can then copy out of here.
Don't forget to hit save.
I can copy this and go to edge 12, scroll all the way down.
And now I can paste this in here so I can change the host name again to edge 12
and
then just change these IP addresses to 12 and 12 and we should be in pretty
good shape.
So don't forget to click save edge 13.
I'm going to go ahead and do this on edge 13 like this.
We got to be really careful with edge 14.
I want to demonstrate that.
So we'll do edge 13, click save.
And now go to edge 14.
And this is where we have to be careful because we have different interface
configurations
here.
So notice that we've got, for example, gig two going to the internet and gig
one going
to the other one.
This is just how we ended up configuring it.
And also I just realized I applied gig two to edge 13 and we didn't actually
need that.
So let me just go ahead and remove that configuration.
All right, no problem.
So edge 14, let's go ahead and paste this config in.
But again, 254 for gig one and 255 for gig two.
And then we need to put 14s in as the last digit.
And then edge 14 here.
OK, so now we should be good.
This is going to allow us again, what CML gives us is the ability for us to
create configuration
that gets applied when the device comes online.
We always have to remember to hit save here if it shows that there's unsafe
configuration.
I can kind of click through all of these to make sure that that icon isn't up
there.
That's usually a good best practice.
And if all of our configurations are in good place, we should be able to go
ahead and come
over to settings and hit start.
So start on edge 11, start on edge 12, start on edge 13, start on edge 14.
So that brings us to the end of what we need to accomplish here.
We just want to make sure that the devices are fully configured and they're
coming online
in the next video.
We're going to log into the devices, confirm they have network connectivity
like we think
they should, and then go into vManager manager and see that they are actually
online and
part of the SD-Wans fabric.