Need Help with secure ZTP process - catalyst 9300/9500

[sindhujit]

I need some help with setting up the bootstrap servers for doing secure ZTP through automation. I have found a few articles :

To create the Bootstrap server: https://www.rfc-editor.org/rfc/rfc8572.html#section-4.4
But this example does not do a live demo of the step by step process.

There is another link : 

https://github.com/opiproject/sztp

But I mainly stuck with the overall process. A walk through would be good.

[Flavio Miranda]

Hi @sindhujit 

 those links does not work but that´s ok. Basically what you need is provide DHCP for the switch on the management interface.

On this 2 lnks below there will be many examples of DHCP configuration.  They will provide to the switch the IP address of the DNAC server. 

 After the discovery the switch and provisioning, you need to change the cable from management interface to another interface.

https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/content/en/us/td/docs/switches/lan/catalyst9300/software/release/16-5/configuration_guide/prog/b_165_prog_9300_cg/zero_touch_provisioning.html.xml

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/prog/configuration/1611/b_1611_programmability_cg/zero_touch_provisioning.html

[sindhujit]

The links open for me. I am talking specifically about the secureZTP, not ZTP. sZTp includes setting up a bootstrap server, connecting with MASA server, etc..

Theres no real documentation on the config needed for the bootstrap server.

[MHM Cisco World]

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/prog/configuration/1711/b_1711_programmability_cg/m_1711_prog_ztp.html

This guide for secure ztp and ztp.

Check example in end of this doc.

[sindhujit]

Not much help on how to set up bootstrap server

[Flavio Miranda]

@sindhujit  we can not find much information on the server side. I have found this link

https://www.cisco.com/c/en/us/td/docs/iosxr/ncs560/system-setup/73x/b-system-setup-cg-73x-ncs560/configure-secure-ztp.pdf 

[Rich R]

@sindhujit the links open for you because they're obviously intended for use inside your corporate network only!
Your hyperlinks:
https://isolate.menlosecurity.com/1/3735928037/https:/www.rfc-editor.org/rfc/rfc8572.html#section-4.4
https://isolate.menlosecurity.com/1/3735928037/https:/github.com/opiproject/sztp
Obviously intended to be:
https://www.rfc-editor.org/rfc/rfc8572.html#section-4.4
https://github.com/opiproject/sztp

[MHM Cisco World]

https://m.youtube.com/watch?v=sPGHvtK6M4g&pp=ygUJOTMwMCB6dHAg

[sindhujit]

I am talking specifically about the secureZTP process for catalyst 9300/9500, not ZTP. sZTp includes setting up a bootstrap server, connecting with MASA server, etc..

Theres no real documentation on the config needed for the bootstrap server.