IWAN APIC-EM Prime

[Ahmed Zein]

Hello Experts,

A question in PnP for IWAN deployment

1-one of the major benefits of using APIC-EM for IWAN deployment is PnP (Zero Touch deployment) of branch. <-- (Is this correct?)

2-the Prime also support PnP (zero touch deployment)<-- (Is this correct?)

3-The prime PnP need integration of APIC-EM or CNS PnP profile<-- (Is this correct?)

4-Question 1: If i am using Prime for IWAN, and i wanna use PnP (Zero Touch), I can use CNS instead of APIC-EM,,so what is the benefits of having APIC-EM and integrate it with Prime for PnP? is it add something new for PnP to Prime more than using CNS?

5-Question 2: In configuration Guide for Prime, to use PnP using APIC-EM integration, a bootstrap file should be uploaded to the device "via USB", to enable the device to call-home "i.e. call PnP app at APIC-EM",,,,,however i know that PnP just need DHCP option 43 with APIC-EM IP,,and device will register to APIC-EM PnP ,,,,why i must upload the Bootstrap file as per the configuration guide? is this only for the old devices or old IOS? if it is correct, how i can know the old devices that need Bootstrap file to register PnP, i.e a compatibility matrix or something like that?

Please consider this as urgent and reply with the same numbering schema, to fully understand your answer.

thanks for your help and support.

[aradford]

#1.  Yes APIC-EM does PnP

#2 PI also does PnP, but now uses APIC-EM as the underlying PnP engine.  There used to be extra things that PI did with PnP (like templates), but APIC-EM supports those now.  PI also allows for a post deployment template to be applied too.  APIC-EM is the strategic PnP engine.

#3.  PI can use CNS (old way) or APIC-EM (new way)

#4  CNS is not being developed.  PnP is the strategic way.

#5.  In many cases in the WAN, you do not have access to the DHCP server, so you cannot use option 43.  The other challenge in the WAN is you often need to assign a static IP address to the WAN interface (e.g. MPLS).  You would use a bootstrap config in this case.  If you can use DHCP, that is great and you now have two DHCP options. A) Option 43.  B) PnP Connect - a cloud based service that the device will connect to and be redirected to APIC-EM.

PnP Connect is an example of something that is not supported with CNS.

[Ahmed Zein]

thanks that's very descriptive,

however i need more clarification:

1-in APIC-EM PnP, if i have new router ISR4K or ISR4K-AX,,,with new IOS image,,,why i need bootstrap file to be uploaded to it? it is a new router with new bootstrap image and new IOS!,,,if this router will use static ip, i have other options to make him call PnP app server,,,like internet (cloud service),,,or use smart phone app,,,i remember there are 5 options,,,the question is when and why i should upload bootsrap file to this new router?

2-for this new router i think it is programmed automatically to call cloud service at internet to search PnP server? is it correct? why you mentioned it still need DHCP to call that cloud service for PnP?

3-For old router with Old IOS,,,i believe there is a workaround to use PnP,,,can you explain this please?

thanks for the great effort

[aradford · Accepted solution]

Hi Ahmed.

#1.  for  a new router, you have the 5 options.  If you need to configure a static IP, there are only two options, either a bootstrap config on a USB stick, or the smart phone app.  Both do the same thing... they install a small configuration file onto the device that allows it to connect to the network and also then to APIC-EM

#2 The device will connect automatically to cloud service, if none of the other methods (DHCP, DNS etc work).  The device needs an IP address before it can communicate to anything.  DHCP is one option, static IP (in a bootstrap config file) is the other

#3  An old router can be used.  It does need to have a version of code that supports PnP though... there is pnp agent in IOS.  If you have a existing router with the right version of IOS, then you can "Wr er" and reload the device.  This will remove the configuration completely, and then the device will try to use PnP.  NOTE:  Make sure you have a backup of the old configuration or you do not need it as the "wr er" destroys the current config. 

[Ahmed Zein]

thanks, that's very clear.