IOS-XR ZTP expected behavior

[Scott.ODonnell@gmail.com]

I'm working through getting IOS-XR devices to ZTP.
I'm using DHCP Option 67 to pass the URL for a ztp python script.
The DHCP offer also includes DNS server options.

It seems that if the URL uses FQDN in the URL, the ZTP script will not be downloaded.
Once I change the url to use an IP address in the DHCP offer, it does download the file.

Just needed to confirm if that is expected behavior.

[Enes Simnica]

Scott.ODonnell@gmail.com Yes, that’s expected. IOS-XR ZTP won’t resolve FQDNs during the very early boot phase, even if DHCP provides DNS servers. So using an IP address in Option 67 is the reliable method.......

hope it helps and PEACE!!!!!

-Enes

[Scott.ODonnell@gmail.com]

@Enes Simnica Thank you for the confirmation.
Can I ask one more point to clarify?
If the URL provided is https: (opposed to http:) , what requirements are there?
I was able to get https: to work using "-k https://x.x.x.x" in option 67
I think this was due to the certificate offered was using a FQDN instead of IP.
If I reissue the certificate using IP , can I avoid using "-k" ?
I'd like to ensure there is some level of validation of the certificate offered during https connection.

[Cristian Matei]

Hi,

  You need the '-k' switch if you use self-signed certificates, has nothing to do with certificate attributes using FQDN or IP as CN / SAN values.  There is built-in validation happening, meaning certificate must be valid / not expired and the IPv4 address inside the certificate must match the IPv4 address of the HTTPS server provided in the URL of option 67.

Thanks,

Cristian.

[Thomasanderson33]

It’s actually expected behavior on many IOS-XR ZTP setups early in the boot process, the device may not perform DNS resolution even if DHCP provides DNS servers. That’s why FQDN-based URLs often fail while direct IP URLs work consistently. Using the IP address in Option 67 is the recommended and most reliable approach for ZTP on XR, unless you’re handling DNS resolution later in the workflow.