topic cisco catalyst 3560cx SDA extended node PnP fail in Software-Defined Access (SD-Access)

cisco catalyst 3560cx SDA extended node PnP fail

mzouggagh — Thu, 25 Aug 2022 11:55:11 GMT

I tried to add catalyst 3560cx as an extended node to SDA fabric but I have this error message:

Device tried to contact the server and failed during certificate_install

how can I resolve this problem?

is it possible to add extended node without using PnP ?

Re: cisco catalyst 3560cx SDA extended node PnP fail

willwetherman — Thu, 25 Aug 2022 15:57:51 GMT

Hi @mzouggagh

Extended nodes can only be connected using PnP. The certificate install error is typically due to a TLS mismatch between the switch and DNA Center. You can check the TLS version that is enabled on DNA Center using the following command

magctl service tls_version --tls-min-version show

Some switches only support TLS version 1.1 or 1.0 for PnP. We had this exact issue with the C3560-CX which only supports TLS 1.1. We changed the TLS version on DNA Center to 1.2 as recommended in the DNA Center Security Best Practises Guide and had to drop back down to version 1.1 to allow the C3560-CX to complete PnP onboarding. Once PnP completed we were able to change the DNA Center TLS version back to 1.2.

magctl service tls_version --tls-min-version 1.0

magctl service tls_version --tls-min-version 1.1

https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/hardening_guide/b_dnac_security_best_practices_guide.html#task_vq4_yyk_ybb

Re: cisco catalyst 3560cx SDA extended node PnP fail

mzouggagh — Fri, 26 Aug 2022 16:02:26 GMT

Hi @willwetherman

after executing

magctl service tls_version --tls-min-version 1.0

PnP process is working and I can see 3560-CX switch in the inventory.

Thank you for your help 🙂