What we're going to be doing in this skill is taking a look at some of the
ways that we can take advantage of the fact we're deploying a software defined
network. That's what SD-WAN is. It's literally what the SD stands for. It's
software defined, wide-area networking, and that's going to bring us some
advantages that we wouldn't have been able to necessarily achieve with
traditional WANs. And one of the first things we want to talk about is the
concept of zero touch provisioning or ZTP. So the idea is this. If we're a
network
manager and we've got maybe a small team, maybe it's a large team, but either
way
we've got some people here who are technical. And it's our job on our
networking team with technical individuals to be able to deploy
configurations and to be intelligent about how we go about doing things with
our network. The problem is that when we look at this team it doesn't
necessarily
scale to the dozens or hundreds or potentially even thousands of remote
sites. If we work for a retail organization we might truly have thousands
of remote locations. Maybe they're within the country that we operate in or
maybe
it's worldwide or at least outside of our country's borders. And so as we're
constantly spinning up new sites, new WAN edges are going to need to be
deployed.
And these edges are going to be connected in maybe to a couple of different WAN
circuits. And we're going to have to keep deploying and deploying these. Well,
these
edges naturally are going to require configuration. And not just any
configuration, we have to be very intentional about what we're doing. And so
we've got to make sure that we've got the proper format and meeting our own
standards. We have to make sure that we have good security in place. And the
challenge that comes with a lot of this is that we have to get this
configuration onto a device that's being delivered where, somewhere in the
world.
Maybe it's down the street or maybe it's a thousand or two thousand miles away.
So either way we understand that this could be a challenge for us to do. In
fact
we usually have two options neither of which are great. The first of which is
that the technical person gets the device in advance, places the configuration
on
here and then ships it to the remote site. And at this point we have to have a
non-technical person do the deployment. They're going to have to power it on
and
plug it in and potentially do the sum amount of configuration for us which is
oftentimes a non-starter. Naturally this leads us to another decision which is
to
simply send a technical resource out to the remote site where they can perform
the configuration themselves. So they put the configuration on while on site
and
bring it up. And while this usually results in smooth sailing because the
technical individual is there and able to bring it online this is not trivial.
If
I have to send a technical resource on an airplane again potentially across
national borders in order to get them to where they need to go well this can
cause a lot of problems especially if this is in a remote area they might even
potentially have to get off the plane and drive five six hours to get to where
they're going it doesn't scale out to these large networks. So what we can do
instead now with SD-WAN is to take advantage of something like zero touch
provisioning. As the name implies it requires zero touch from the perspective
of our techs configuring the device itself. Basically this part right here
we're a smart technical person is putting config on we're trying to remove the
requirement altogether. So how exactly would we go about doing something like
that? Well that's going to require an architecture that works largely behind
the scenes in order to make it happen. So first let's just talk about what
happens and then we'll talk about how it works behind the scenes. So here's how
ZTP is going to work. I am going as the admin now this is me as the technical
resource I am going to get into my SD-WAN manager and I'm going to create
configuration. Then what's going to happen this is step one step two is we
have that router show up at a remote site and we have our non technical
resource available on hand and they are simply going to do two things they're
going to apply power to the device and they're going to apply the network cable
.
Whatever that looks like in a lot of cases it will be an ethernet connection
but it might be something like a T1 or an E1 or something along those lines. So
they're going to connect it in physically and power it up naturally
might have to install it into a rack but either way these processes these steps
are usually not too bad. What we really want to prevent is the non technical
person having to provide configuration or otherwise facilitate providing
configuration maybe through a remote session with the technical person
because that doesn't tend to go well. But notice at this point we have done
absolutely no direct configuration and this is why we call it zero touch
provisioning. We have not provisioned our own configuration we are going to
provision it by not touching it at all. The cool thing about this is that step
three is that from the cloud yes this magical cloud of ours we're going to
whoops I drew that to the wrong circle we're going to deploy a configuration.
Which configuration well this configuration the configuration that we
put into manager. So we as the technical resource did create a
configuration but I never had to leave the comfort of my own office. I simply
log in to manager I configure it or create a configuration and thanks to the
power of Cisco's cloud this device is able to connect to the internet and
acquire the configuration. So we have accomplished everything we wanted to
accomplish without having to worry about either of these really not good
scenarios. And overall everybody is a lot happier. So that's great from a high
level overview but then we have to ask ourselves okay that's great but how
exactly does this work because you and I are both not going to be content with
the idea that we just magically plug something in or may I should say we
plug something in without magic and then magically that configuration is
downloaded. So what are the details of how this is working? Well this cloud is
a
specific Cisco service this is known as the Cisco plug-and-play cloud service.
This is a service that actually Cisco has created that applies far beyond SD
WAN. I can take advantage of this with my software defined access architecture
SDA as well as other products that can you know just use this plug-and-play
concept I plug it in and then it downloads the configuration. So it's a
pretty cool product and because all of this zero touch provisioning existed
before the product was acquired by Cisco and the Viptela cloud it used a
Viptela service well now that service has been migrated into Cisco's own
plug-and-play cloud. Now prior to the edge being deployed keep in mind that we
have acquired this router in some way through official Cisco channels. And
said at this point the Cisco plug-and-play cloud already knows the serial
number that this device is going to have and it knows to associate that with
our
organizational account. So the plug-and-play cloud already knows which
devices are going to belong to our account and from there it knows from our
organizational account what our validators are. Remember these validators that
help
with onboarding this is another use case for them and a very important aspect
of
why we rely on them. So the process is this our router is going to reach out
and provide its serial number as well as its certificate for the sake of
security to the plug-and-play cloud. The plug-and-play cloud is going to match
the serial number to an organization and that leads us to a validator IP
address. Remember the validator IP address is a public IP address it must be
public it's the only controller object that we have in our network or SDWAN
network at least in our SDWAN that requires a public IP address this is
another reason why. So now this device is going to reach out to the validator
also providing its certificate and making sure that we compare certificates
just
to make sure that we are joining the proper network and that we're
communicating
with an authentic validator. At this point the validator is going to
communicate with the manager and allow the manager to push the configuration
down to this remote device. So that is how it works in the back end and as we
can see it's not only a cloud-based service but it's also very secure as
it's providing certificates at every step. Now there are a few requirements
here
that we should pay attention to because you might have noticed that right away
this device is reaching out to Cisco's cloud. Well how does it do that? Well it
's
going to require some kind of network connection usually an internet connection
is going to be required here. This might be a conversation with the service
provider because if it's an MPLS circuit well we might need for them to enable
internet connectivity through that MPLS circuit. It's also going to require
DHCP
or potentially us manually intervening via a USB configuration meaning that we
can actually provide to our non-technical resource a USB stick that we put into
the router and that provides it with the critical information. So ideally we
don't
have to go through that step because that does inject us as more of a manual
part of this process but again this does otherwise rely on DHCP because this
device is going to require an IP address in order to reach out to the internet.
So that is how zero touch provisioning or ZTP allows us to just simply ship our
routers out to our remote sites and allow non-smart hands to plug them into the
power and the internet in order to download configuration and at that point
be able to join the SD-WAN.