After you create a device profile, you can add IR routers to the Application Manager service by using this procedure.

1. In the Cisco IoT Operations Dashboard, navigate to Application Manager service.

2. Choose Devices > Staged tab.

   

3. Click Add Devices. The Select Add Device Method window appears.

4. On the window, select Single Device to open the Add Device page.

5. On the Add Device page, enter the product ID, serial number, and a name in the respective fields.

   
    Note

   Use the following command on the console of your device to display the product ID and the serial mumber:

   Router# show license udi

6. Click Next.

7. On the Select Device Profile for Assignment page, choose a device profile from the list and click Next.

8. Review the configuration information on the Review page.

   

9. Click Add Device.

   The new device is listed under Staged Devices, indicating it is added through the Application Manager service but not registered with the Cisco IoT Operations Dashboard yet.

• For IR1101 devices: Ensure that the device has IOx container keys programmed:

  Verification

  1. Run the command: Router#show software authenticity keys | i Name

  2. Check for lines with "Product Name: Cisco Services Containers"

  If missing:

  • Pre-January 2020 devices: Disable signature verification or upgrade the device.

    IR1100 devices shipped after January 1, 2020, should have the container keys programmed.

   Note

  If the device doesn’t have container keys programmed and signature verification enabled, SEA installation will fail with a signature verification error.

• Ensure that the IR router is added to Cisco IoT OD Application Manager.

1. Prepare the device

2. Configure and Enable IOx

3. Configure the IR Router to Connect to IoT OD

4. Verify the Configuration on the Device

5. Verify the Device Status on the IoT Operations Dashboard

1. Attach the necessary networking cables.

2. Power up the device.

IOx is a container hosting platform that runs on Cisco IOS XE. It's used to install and execute several services that Cisco IoT Operations Dashboard can deliver such as Secure Equipment Access (SEA), Cisco Cyber Vision (CCV), and Edge Intelligence (EI).

Follow these steps to configure and enable IOx on your IR router:

1. Configure the VirtualPortGroup0 (VPG) Interface , DHCP Pool, and NAT Rules on the device for IOx Network.

   1. Configure the VPG Interface. The virtual interface that connects IOx applications to IOS XE is called VirtualPortGroup0. The IOx applications will need IP connectivity through the virtual interface, which includes receiving an IP address. An example configuration is given in the next line. You can change the IP address to suit your requirements. Enter these configuration commands on the router console, in the config mode.

      ! Example
        conf t    
        interface VirtualPortGroup0
        description IOx Interface
        ip address 192.168.16.1 255.255.255.0
        ip nat inside
        ipv6 enable
        end

   2. Configure the DHCP pool. When the IOx applications start, they will request an IP address via DHCP. Therefore, you need to configure a DHCP pool for IOx applications. An example configuration of IP pool and DNS server is given in the next line. You can customize this configuration to suit your requirements. Ensure that the default router IP address is the same as the IP address previously configured for the VirtualPortGroup0 interface.

      ! Example
        conf t
        ip dhcp pool ioxpool
        network 192.168.16.0 255.255.255.0
        default-router 192.168.16.1
        dns-server 192.168.16.1 8.8.8.8 
        end

   3. Configure NAT. IOx Apps use private IP addresses obtained from DHCP. They need Network Address Translation (NAT) to access the internet. Add NAT Rules for the DHCP pool to enable IOx App traffic to access the internet.

      In the example below, assume that the connection to the internet will be through Cellular 0/1/0. Make sure to change or adjust the interface if it is not Cellular 0/1/0. For example, it could be GigabitEthernet 0/0/0 or Cellular 0/3/0.

      ! Example of a NAT rule for using Cellular0/1/0 as an uplink:
        conf t       
        interface Cellular0/1/0
        ip nat outside
        ip access-list extended NAT_ACL
        10 permit ip 192.168.16.0 0.0.0.255 any
        route-map RM_WAN_ACL2 permit 10
        match ip address NAT_ACL
        match interface Cellular0/1/0
        ip nat inside source route-map RM_WAN_ACL2 interface Cellular0/1/0 overload
        end

2. Enable IOx.

   conf t
   iox
   end

3. Verify that IOx is running correctly by running this command in exec mode:

   show iox-service
   ! Example 1: When IOx is up and running, both the “IOx service (CAF)” and “dockerd” will be running.
   Router#sh iox-service
   IOx Infrastructure Summary:
   ---------------------------
   IOx service (CAF)         : Running
   IOx service (HA)          : Not Supported
   IOx service (IOxman)      : Running
   IOx service (Sec storage) : Running
   Libvirtd 5.5.0            : Running
   Dockerd v19.03.13-ce      : Running

To establish a connection with the Cisco IoT Operations Dashboard, you must run a set of IOS commands on the device's CLI. To manage the IOx Apps, the Cisco IoT Operations Dashboard requires a valid user configured with level 15 credentials on the switch in IOS XE.

1. Create a privilege 15 user by applying the following configuration. The credentials should match the values configured in the Device Profile on the Cisco IoT Operations Dashboard:

   conf t
   username <DEVICE PROFILE USERNAME> privilege 15 algorithm-type scrypt secret <DEVICE PROFILE PASSWORD>
   end

2. Configure the authentication-related settings and WSMA settings.

   conf t 
   aaa new-model
   aaa authentication login default local
   aaa authorization exec default local
   ip http server
   ip http authentication local
   ip http secure-server
   wsma agent exec
   profile exec
   wsma profile listener exec
   transport http path /wsma/exec
   cgna gzip
   end

3. Configure the IDA transport profile: Enable a secure TLS connection using WebSocket to Cisco IoT Operations Dashboard using TLS with port TCP 443.

   For the US Cluster:

   
     conf t
     ida transport-profile wst
      callhome-url wss://device-us.ciscoiot.com/wst/cgna
      active
     end

   For the EU Cluster:

   
     conf t
     ida transport-profile wst
      callhome-url wss://device-eu.ciscoiot.com/wst/cgna
      active
     end

4. Configure the CGNA registration profile.

   conf t
     cgna profile cg-nms-register
      transport-profile wst
      add-command show version | format flash:/managed/odm/cg-nms.odm
      add-command show inventory | format flash:/managed/odm/cg-nms.odm
      interval 3
      active
      url https://localhost/cgna/ios/registration
      gzip
     end

    Note

   Once the configuration is done, the device connects to IoT OD and triggers the registration process.

5. (Optional) Enable DNS on the router if it’s not already acquired through the DHCP server.

   This is important if the router is configured with a static IP and a static default gateway, and no DNS server is explicitly specified. In this example, we use a Cisco DNS. You can use any DNS server.

   conf t
   ip name-server 208.67.222.222
   end

Use the following commands to verify that the device is configured correctly to connect to IoT OD.

Router# show ida transport-profile-state all

! Verify that IDA status is connected for the "wst" transport profile
 ! Notice the line "IDA Status: Connected" in the show command output below for the "wst" transport profile. 
 Router#sh ida transport-profile-state all
 Transport Profile 1:
 Profile Name: wst
 Activated at: Fri Jun  7 07:26:42 2024
 Reconnect Interval: 30 seconds
 keepalive timer Interval: 50 seconds
 Source interface: [not configured]
 callhome-url: wss://device-us.ciscoiot.com/wst/cgna
 Local TrustPoint: CISCO_IDEVID_SUDI
 Remote TrustPoint: [not configured]
 Execution-url: http://192.168.16.1  
 Proxy-Addr: [not configured]
 IDA Status: Connected
 State: Wait for activation
 Last successful response at Fri Jun  7 08:25:29 2024
 Last failed response:
 Last failed reason:

Once IoT OD receives a registration request from a device and validates its configuration, the device automatically moves from the Devices > Staged status to Registered status in your IoT OD Organization.

Troubleshoot Issues

• If IoT OD receives a registration attempt but encounters some issues, (e.g., incorrect credentials), the IR device remains in the Devices > Staged list with Configure Failure status until IoT OD receives a registration attempt with the correct credentials.

• If IoT OD does not receive any registration attempt, the IR device remains in the Devices > Staged list.