Viptela Vmanage

[xshant]

I installed Vmanage on a virtual machine. On Vmanage i selected manual root certificate and generated certificate with "Generate CSR", it generated a .csr file, now i wanted to install this certificate for vManage and when uploading the certificate it gives me error saying "cannot decrypt serial number from the certificate".? Where do i get the serial number, its a VM? Is this the right way to do it, do i need to install this certificate for vManage?

[David Aicher]

CSR is certificate signing request.    you would generate the request and then use Symantec to sign the request. 

https://sdwan-docs.cisco.com/Product_Documentation/vManage_How-Tos/Security_Certificates/Generate_a_Certificate#Manually_Generate_a_Certificate

You can still do automated with on premise vmanage as long as you have internet access.    If you want to use your own CA then it becomes a bit more complicated.

[xshant]

I am actually stuck at this stage:

https://sdwan-docs.cisco.com/Product_Documentation/Getting_Started/Viptela_Overlay_Network_Bringup/03Deploy_the_vManage_NMS/05Generate_vManage_NMS_Certificate

I have installed a OVA image in my a lab VM environment, when i do generate CSR for vmanage it says:

Failed to get CSR signed

Unable to get response from signing server https://certmanager-webservices.websecurity.symantec.com/vswebservices/rest/services/enroll

even though from vmanage command line i can ping 8.8.8.8.

[David Klebanov]

Sounds like you are building a lab, are you? In this case you should not use Digicert (ex-Symmantec) certificates. Digicert certificates should be used for production deployments. For lab you should use private certificates. You can use tools like tinyCA (Ubuntu) or XCA (Mac) to sign CSRs generated on controllers. The process is:

1. Generate CSR on controller

2. Sign CSR on the private CA

3. Install signed CSR back on controller

4. Install root-chain of your private CA on controller

You will need to repeat this for vBond, vSmart and vManage.

Hope this helps.

David

[xshant]

Thanks David, i downloaded XCA, generated CSR from Vmanage, imported the CSR in XCA, went to Certificates in XCA->New Certificate->Selected the imported CSR->selected "create a self signed certificate" but it gave error:

"The Key you selected for signing is not a private one"

where do i get this private key?

[David Klebanov]

You need to create a working XCA setup before you import any CSRs... Please refer to some online documentation. XCA is just one tool, there are others as well.

[xshant]

XCA is pretty easy to use but it complains about private key. I just want to know where we create the CSR from VManage where does it store the private key?

[David Klebanov]

PKI is a private/public key system. Private key is stored on vManage. Public key is used in the CSR that XCA will sign. You do not need vManage private key for XCA.

[xshant]

Hi,

I did get the CSR signed and got the certificate when i installed it on vmanage it gave this error:

"Error: root-ca-chain unable to validate the certificate...Aborting!"

Thanks,

Aamir

[David Klebanov]

Great! Now before you try to install the signed CSR back into vManage, you need to load the root chain from your XCA into vManage. The root cert is exportable from XCA. You need this command to install root chain into vManage.

https://sdwan-docs.cisco.com/Product_Documentation/Command_Reference/Operational_Commands/request_root-cert-chain

[xshant]

Thanks David all is good now and Vmanage is up and has the certificate installed. Now i want to add Vbond and when i go to Vmanage->Controllers->Add Vbond, i put the management IP of vbond and it says:

Failed to add device

Network is unreachable

Even though i can ping the Vbond mgmt Ip from vmanage, any tips here?

[David Klebanov]

Which vBond IP do you try to connect to?

[xshant]

The IP which i configured on VPN 512 in Vbond. From Vmanage i can ping that IP.

[rimran2712]

Hi David,

I am also trying to setup SD-WAN lab and afterward will start customer PoC.

I have setup control n with vManage, vBond, vSmart with self signed certificate through  vshell and viptela cli. I generated CSR from vEdge cloud VM and also signed from vManage like I did with vBond and vSmart.

I am using version 18.3.3 for all devices.

last step where I am stuck is to add vEdge cloud VM router into control plan. I not using Symantec or private CA but using vManag as self signed certificate.

plea let m now how could I add vEdge cloud?

if I use MS CA server then which certificate template I will use to sign certificate from CA.

Thanks,

Imran

[David Klebanov]

Hi Imran,

The most convenient method to bring up vEdge Cloud is to use vManage as CA, so your approach is perfectly valid. For that to work you do not need to generate any CSRs manually on vEdge Cloud, everything is automated. What you need to do is the following:

1. Import WAN Edge list that includes vEdge Cloud. You can get it from software.cisco.com PnP Connect portal.
2. Create and attach configuration template to the vEdge Cloud
3. Generate bootstrap parameters by going to Configuraton>Devices, clicking on the three dots on the right and selecting Generate Bootstrap Configuration>Cloud-Init from the menu
4. Download bootstrap cloud-init config
5. Spin up vEdge Cloud VM and provide bootstrap cloud-init config through the tool you use to spin up the VM

If you cannot execute #5 above, here is the manual alternative:

1. Spin up vEdge Cloud VM without providing bootstrap cloud-init config. vEdge Cloud will not establish control connections.
2. SSH into vEdge Cloud and configure vBond IP address and org-name under the system subsection.
3. Execute command “request vedge-cloud active chassis-number token . You can take both chassis number and token from step #3 above.

David