Step 1

Sync your device inventory. On the SD-WAN Manager, go to Workflows > Quick Connect and click Get Started. Use one of the options to add the devices:

• Log into your Smart Account - (Preferred) Enter your credentials to add the device to SD-WAN Manager. The device information is synced from PnP Connect portal and is listed under Configuration > Devices page.

  OR

• Upload file with serial numbers - Upload the .csv file containing the device information. You can gather this information by entering the CLI command on the Routing device.

  Device# show crypto pki certificate CISCO_IDEVID_SUDI

  A sample csv file is shown below.

  chassis number	product id	cert serial number	sudi serial	mode
  ISR4461/K9-FDU1231M56W	ISR4461/K9	0215ZS7X	FDU1231M56W	autonomous

  The device is now listed under the Edge Devices.

  1. Select the device that you want to onboard and click Next.

  2. In the Add and Review Device Configuration dialog box, enter the Site-ID, System-IP (mandatory), Hostname, and click Apply.

  3. Review the device details and click Onboard. To verify the device that is added, go to Configuration > Devices > WAN Edge List. A list of routers in the network is displayed, showing detailed information about each router and the status as Unreachable.

Step 2

From the Cisco SD-WAN Manager menu, choose Configuration > Devices and select the device for which you want to generate the bootstrap.

Step 3

Click the Export Bootstrap Configuration dialog box, enter the WAN Interface name and select the checkbox for SD-Routing to generate the bootstrap file. The bootstrap file contains the organization name, Cisco SD-WAN validator IP, and root-ca certificates. For the enterprise network, it will have the enterprise root-ca- certificates.

 Note

The management interface name may vary among Cisco IOS XE device models. Specify the interface name based on the model you wish to onboard and which can reach the Cisco SD-WAN Validator and Cisco SD-WAN Manager. Check the interface on the Routing device and ensure that it has connectivity to both.

Step 4

Download the generic .cfg bootstrap applicable for the hardware devices. Unzip the file and rename it as ciscosdwan.cfg.

Step 5

Copy the bootstrap file to the device internal bootflash as ciscosdwan.cfg.

Step 6

Reload the device with controller-mode reset or writer erase with reload command to bring it to Day-0 state.

Step 7

Verify the control connection using these commands on the device:

Router# show sd-routing connections summary

Router# show sd-routing system status

Router# show sd-routing local-properties summary

Step 8

On the Catalyst SD-WAN Manager, navigate to Configuration > Devices to verify that the device status is shown as In Sync and Reachable.

Step 1

Sync your device inventory. On the SD-WAN Manager, go to Workflows > Quick Connect and click Get Started. Use one of the options to add the devices:

• Log into your Smart Account - (Preferred) Enter your credentials to add the device to SD-WAN Manager. The device information is synced from PnP Connect portal and is listed under Configuration > Devices page.

  OR

• Upload file with serial numbers - Upload the serial.viptela file downloaded from PnP Connect containing the device information(available under Controller Profiles and click Download the Provisioning file of PnP Connect portal). The device is now listed under the Edge Devices. .

  1. Select the device that you want to onboard and click Next.

  2. In the Add and Review Device Configuration dialog box, enter the Site-ID, System-IP (mandatory), Hostname, and click Apply.

  3. Review the device details and click Onboard. To verify the device that is added, go to Configuration > Devices > WAN Edge List. A list of routers in the network is displayed, showing detailed information about each router and the status as Unreachable.

Step 2

If you are using enterprise certificates, go to Administration > Settings > Trust and Privacy > Controller Certificate Authorization and select Enterprise Root Certificate and paste the enterprise root-cert. This ensures that you have the enterprise root-cert in the bootstrap file.

Step 3

Go to Configuration > Devices and select the device for which you want to generate the bootstrap.

Step 4

Click ... at the right pane of the window and choose Generate Bootstrap Configuration and enter the GigabitEthernet1 as the VPN0 interface name. If enterprise certificates are being used, include the information in the provided field.

 Note

Ensure that the DHCP is enabled on the selected interface and is reachable to Cisco Catalyst SD-WAN Validator and Cisco SD-WAN Manager.

Step 5

Click OK and download the .cfg file on the device. The following example shows a sample file type.

ciscosdwan_cloud_init.cfg

Step 6

Convert the downloaded file to a consumable form for the virtual machine. Create a disk image from the file using the following command:

mkisofs -l -o /my/path/c8000v_config.iso ciscosdwan_cloud_init.cfg

Step 7

Mount the c8000v_config.iso as an additional disk during creation of the Cisco Catalyst 8000V virtual machine by using the following steps:

Step 8

Verify the control connection using these commands on the device:

Router# show sd-routing connections summary

Router# show sd-routing system status

Router# show sd-routing local-properties summary

Step 9

On the Catalyst SD-WAN Manager, navigate to Configuration > Devices to verify that the device status is shown as In Sync and Reachable.

Step 1

Sync your device inventory. On the SD-WAN Manager, go to Workflows > Quick Connect and click Get Started. Use one of the options to add the devices:

• Log into your Smart Account - (Preferred) Enter your credentials to add the device to SD-WAN Manager. The device information is synced from PnP Connect portal and is listed under Configuration > Devices page.

  OR

• Upload file with serial numbers - Upload the .csv file containing the device information. You can gather this information by entering the CLI command on the Routing device.

  Device# show crypto pki certificate CISCO_IDEVID_SUDI

  A sample csv file is shown below.

  chassis number	product id	cert serial number	sudi serial	mode
  ISR4461/K9-FDU1231M56W	ISR4461/K9	0215ZS7X	FDU1231M56W	autonomous

  The device is now listed under the Edge Devices.

  1. Select the device that you want to onboard and click Next.

  2. In the Add and Review Device Configuration dialog box, enter the Site-ID, System-IP (mandatory), Hostname, and click Apply.

  3. Review the device details and click Onboard. To verify the device that is added, go to Configuration > Devices > WAN Edge List. A list of routers in the network is displayed, showing detailed information about each router and the status as Unreachable.

Step 2

Configure the minimum parameters on the Routing device to enable the control connection with the Cisco SD-WAN Manager.

router(config)# netconf-yang​

sd-routing​​
  no ipv6-strict-control
  organization-name "%Your Org. Name%"
  site-id %id%
  system-ip %system ip%
  vbond name %vbond name or vbond ip%
  vbond port 12346
  wan-interface %uplink interface%​​

ip route 0.0.0.0 0.0.0.0 %next hop ip%​​

interface %uplink interface%
   ip address  %dhcp or static%​​
   no shutdown

 Note

Ensure that the interface is configured with a static IP address or through DHCP. It must have IP reachability to both the Cisco Catalyst SD-WAN Manager and Cisco Catalyst Validator. Also, the interface must be in no shut state.

Step 3

Verify the control connection using these commands on the SD-Routing device:

Router# show platform software yang-management process status
Router# show sd-routing connections summary

Router# show sd-routing system status

Router# show sd-routing local-properties summary

Step 4

On Cisco Catalyst SD-WAN Manager, navigate to Configuration > Devices and verify the device status is shown as In Sync and Reachable.

Step 1

Sync your device inventory. On the SD-WAN Manager, go to Workflows > Quick Connect and click Get Started. Use one of the options to add the devices:

• Log into your Smart Account - (Preferred) Enter your credentials to add the device to SD-WAN Manager. The device information is synced from PnP Connect portal and is listed under Configuration > Devices page.

  OR

• Upload file with serial numbers - Upload the .csv file containing the device information. You can gather this information by entering the CLI command on the Routing device.

  Device# show crypto pki certificate CISCO_IDEVID_SUDI

  A sample csv file is shown below.

  chassis number	product id	cert serial number	sudi serial	mode
  ISR4461/K9-FDU1231M56W	ISR4461/K9	0215ZS7X	FDU1231M56W	autonomous

  The device is now listed under the Edge Devices.

  1. Select the device that you want to onboard and click Next.

  2. In the Add and Review Device Configuration dialog box, enter the Site-ID, System-IP (mandatory), Hostname, and click Apply.

  3. Review the device details and click Onboard. To verify the device that is added, go to Configuration > Devices > WAN Edge List. A list of routers in the network is displayed, showing detailed information about each router and the status as Unreachable.

Step 2

From the Cisco SD-WAN Manager menu, choose Configuration > Devices and select the device for which you want to generate the bootstrap.

Step 3

Click the Export Bootstrap Configuration dialog box, enter the WAN Interface name to generate the bootstrap file. The bootstrap file contains the organization name, Cisco SD-WAN Validator IP, and Root-CA certificates. For the enterprise network, it will have the enterprise Root-CA certificates.

 Note

The management interface name may vary among Cisco IOS XE device models. Specify the interface name based on the model you wish to onboard and which can reach the Cisco SD-WAN Validator and Cisco SD-WAN Controller. Check the interface on the Routing device and ensure that it has connectivity to both.

Step 4

Download the generic .cfg bootstrap applicable for the hardware devices. Unzip the file and rename it as ciscosdwan.cfg.

Step 5

Copy the bootstrap file to the device internal bootflash as ciscosdwan.cfg.

Step 6

Enter the sd-routing bootstrap load bootflash:ciscosdwan.cfg command on the Routing device.

Router# sd-routing bootstrap load bootflash:ciscosdwan.cfg
Located the file. Beginning to extract the data
Extraction summary
-Organization name - "testb2"
-Interface - GigabitEthernet0/0/0
-vbond  - 99.99.1.51
Successfully extracted root-cert info

Do you want to proceed and apply extracted
parameters to enable sd-routing feature?? (yes/[no]): yes
Successfully configured bootstrap extracted parameters
Router#
*May 10 08:56:11.159: %SYS-5-CONFIG_P: Configured programmatically by process Exec from console as console
*May 10 09:05:11.751: %DMI-5-AUTH_PASSED: R0/0: dmiauthd: User 'vmanage-admin' authenticated successfully from 201.201.201.1:41902  for netconf over ssh. External groups

Step 7

Verify the control connection using these commands on the device:

Router# show sd-routing connections summary

Router# show sd-routing system status

Router# show sd-routing local-properties summary

Step 8

On the Catalyst SD-WAN Manager, navigate to Configuration > Devices to verify that the device status is shown as In Sync and Reachable. It also shows up on Monitor > Device as a SD-Routing device.

Step 1

On the SD-Routing device to be onboarded, enter the following commands.

Router(config)# netconf-yang​

sd-routing​​
  no ipv6-strict-control
  organization-name "%Your Org. Name%"
  site-id %id%
  system-ip %system ip%
  vbond name <FQDN> or vbond ip <ipaddress>
  vbond port 12346
  wan-interface %uplink interface%​​

ip route 0.0.0.0 0.0.0.0 %next hop ip%​​

interface %uplink interface%
   ip address  %dhcp or static%​​
   no shutdown

Step 2

On the Cisco Catalyst SD-WAN Manager, navigate to Configuration > Devices > Unclaimed WAN Edges page, verify the device serial number and claim the SD-Routing device by checking the Validate the uploaded vEdge List and send to controllers check box.

Step 3

Verify the control connection to the Cisco SD- WAN Manager by using these commands on the SD-Routing device:

Router# show sd-routing connections summary

Router# show sd-routing system status

Router# show sd-routing local-properties summary

Router# show sd-routing connection history

Step 4

On the Catalyst SD-WAN Manager, navigate to Configuration > Devices to verify that the device status is shown as In Sync and Reachable.

Step 1

Sync your device inventory. On the SD-WAN Manager, go to Workflows > Quick Connect and click Get Started. Use one of the options to add the devices:

• Log into your Smart Account - (Preferred) Enter your credentials to add the device to SD-WAN Manager. The device information is synced from PnP Connect portal and is listed under Configuration > Devices page.

  OR

• Upload file with serial numbers - Upload the serial.viptela file downloaded from PnP Connect containing the device information(available under Controller Profiles and click Download the Provisioning file of PnP Connect portal). The device is now listed under the Edge Devices.

  1. Select the device that you want to onboard and click Next.

  2. In the Add and Review Device Configuration dialog box, enter the Site-ID, System-IP (mandatory), Hostname, and click Apply.

  3. Review the device details and click Onboard. To verify the device that is added, go to Configuration > Devices > WAN Edge List. A list of routers in the network is displayed, showing detailed information about each router and the status as Unreachable.

Step 2

On the routing device, configure the minimum parameters to enable control connection to Cisco SD-WAN Manager.

Router(config)# netconf-yang​

sd-routing​​
  no ipv6-strict-control
  organization-name "%Your Org. Name%"
  site-id %id%
  system-ip %system ip%
  vbond name %vbond name or vbond ip%
  vbond port 12346
  wan-interface %uplink interface%​​

ip route 0.0.0.0 0.0.0.0 %next hop ip%​​

interface %uplink interface%
   ip address  %dhcp or static%​​
   no shutdown

Step 3

Verify that the feature is enabled by checking the status of the vdaemon.

Router# show platform software yang-management process state
Confd Status: Started


Process              Status              State
-------------------------------------------------------
nesd                 Running             Active
syncfd               Running             Active
ncsshd               Running             Not Applicable
dmiauthd             Running             Active
nginx                Running             Not Applicable
ndbmand              Running             Active
pubd                 Running             Active

Router#show platform software process list r0 name vdaemon
Name: vdaemon
  Process id       : 29075
  Parent process id: 29070
  Group id         : 29075
  Status           : S
  Session id       : 8829
  User time        : 263002
  Kernel time      : 347183
  Priority         : 20
  Virtual bytes    : 405110784
  Resident pages   : 12195
  Resident limit   : 18446744073709551615
  Minor page faults: 716496
  Major page faults: 9130

Step 4

Cisco devices are loaded with PKI and Symantec root-certificates by default. If your overlay network is for an Enterprise, you need to install the Enterprise Root Certificate. Copy the root certificate from the Certificate Authority (CA) to Cisco 8000v. Enter the following commands. scp root-ca-chain.crt cisco@<c8kv>:root-ca-chain.crt and the request platform software controller-managed root-cert-chain install<path-to-root-cert> command.

Router# scp root-ca-chain.crt cisco@<c8kv>:root-ca-chain.crt

Router#  request platform software sd-routing root-cert-chain install bootflash:root-ca-chain.crt

Step 5

Install the client enterprise certificates.

1. Generate a Certificate Signed Request (CSR) for the device using the request platform software sd-routing csr upload bootflash: tmp_cert_dir/C8kCsrFile.csr command . You can specify any name for the folder that is created within the tmp_cert_dir/ directory.

2. Copy the generated CSR file from the c8k device to the directory where you have the Enterprise CA. You can sign the certificate using the root key and root CA certificate and generate the pem/crt certificate file.

   • In Enterprise CA : scp cisco@<c8kv ip>:tmp_cert_dir/C8kCsrFile.csr 

   • openssl x509 -req -in C8kCsrFile.csr -CA root-ca-chain.crt -CAkey rootCA.key -CAcreateserial -out C8kCsrFile.crt -days 3650 -sha256

3. Copy the generated crt file signed to c8000v device. In Enterprise CA: scp C8kCsrFile.crt cisco@<c8kv ip>:C8kCsrFile.crt

4. Install the copied certificate on the device with request platform software sd-routing certificate install bootflash:C8kCsrFile.crt command.

Step 6

Verify the installation status of the certificates.

Router# show sd-routing local-properties summary
….....

certificate-status                Installed
certificate-validity              Valid
certificate-not-valid-before      Apr 25 00:55:28 2023 GMT
certificate-not-valid-after       Apr 24 00:55:28 2024 GMT
…........
dns-name                          Validator
site-id                           100
tls-port                          0
system-ip                         172.16.255.11
chassis-num/unique-id             C8K-aa079ca1-c141-4ac6-9b76-05864005f94e
serial-num                        12345707

Step 7

When you install the client certificate using the CLI, or if you had to redo the CSR generation and certificate installation due to any reason, ensure that you add the device information to the Cisco SD-WAN Manager for it to start control connections with the Cisco SD-WAN Manager . The steps are outlined below.

1. Get the chassis number and serial number. To get the chassis number and serial number, use the show sd-routing local-properties or show sd-routing certificate serial command.

   Router# show sd-routing local-properties summary
   chassis-num/unique-id             C8K-aa079ca1-c141-4ac6-9b76-05864005f94e
   serial-num                        12345707
   

2. Upload the chassis-id using the request vedge add chassis-num <Chassis id> org-name <Org Name> serial-num <Serial number from c8kv> command on SD-WAN Manager and SD-WAN Validator.

Step 8

Verify the control connection status on the SD-Routing device.

Router#show sd-routing connections summary
                                                                                     PEER                                            PEER
PEER     PEER  PEER             SITE        PEER                                     PRIV   PEER                                     PUB
TYPE     PROT  SYSTEM IP        ID          PRIVATE IP                               PORT   PUBLIC IP                                PORT   STATE   UPTIME
--------------------------------------------------------------------------------------------------------------------------------------------------------------
vmanage  dtls  172.16.255.22    200         10.0.12.22                               12446  10.0.12.22                               12446  up      12:05:29:3

Step 9

On Cisco Catalyst SD-WAN Manager, navigate to Configuration > Devices and verify the device status is shown as In Sync and Reachable.

Step 1

Sync your device inventory. On the SD-WAN Manager, go to Workflows > Quick Connect and click Get Started. Use one of the options to add the devices:

• Log into your Smart Account - (Preferred) Enter your credentials to add the device to SD-WAN Manager. The device information is synced from PnP Connect portal and is listed under Configuration > Devices page.

  OR

• Upload file with serial numbers - Upload the serial.viptela file downloaded from PnP Connect containing the device information(available under Controller Profiles and click Download the Provisioning file of PnP Connect portal). The device is now listed under the Edge Devices.

  1. Select the device that you want to onboard and click Next.

  2. In the Add and Review Device Configuration dialog box, enter the Site-ID, System-IP (mandatory), Hostname, and click Apply.

  3. Review the device details and click Onboard. To verify the device that is added, go to Configuration > Devices > WAN Edge List. A list of routers in the network is displayed, showing detailed information about each router and the status as Unreachable.

Step 2

On the Routing device, run the following commands to apply the minimum configuration.

Router(config)# netconf-yang
!
sd-routing
 no ipv6-strict-control
 organization-name "vIptela Inc Regression"
 site-id 500
 system-ip 172.16.255.15
 vbond ip 10.0.12.26
 vbond port 12346
 wan-interface GigabitEthernet2 
!
ip route 0.0.0.0 0.0.0.0 10.0.5.13
!
ip interface GigabitEthernet2
 ip address 10.0.5.11 255.255.255.0
 no shutdown
!

Step 3

Go to the Cisco SD-WAN Manager menu, choose Configuration > Certificates and get the UUID and One Time Password (OTP) of the device you want to onboard.

Step 4

To override the chassis number that is generated by the virtual device, run the CLI command on the virtual Routing device.

request platform software sd-routing activate chassis newly uploaded chassis id from vmanage
token token generated by SD-WAN Manager

Step 5

Verify the control connection status on the Routing device using these commands:

show sd-routing local-properties summary
show sd-routing local-properties wan ipv4
show sd-routing connections summary
show sd-routing connections history

Step 6

On the Catalyst SD-WAN Manager, navigate to Configuration > Devices to verify that the SD-Routing device status is shown as In Sync and Reachable.