A device can be in either of these configuration modes:

• vManage mode–A template is attached to the device and you cannot change the configuration on the device by using the CLI.

• CLI mode – No template is attached to the device and the device can be configured locally by using the CLI.

When you attach a template to a device from vManage, it puts the device in vManage mode. You can change the device back to CLI mode if needed to make local changes to its configuration.

1. In WAN Edge List tab, select a device.

2. Click the Change Mode drop-down and select CLI mode.

An SSH window opens. To log in to the device, enter a username and password. You can then issue CLI commands to configure or monitor the device.

To toggle a controller device from vManage mode to CLI mode:

1. In the Controllers tab, select a device.

2. Click the Change Mode drop-down.

3. Select CLI mode and then select the device type. The Change Mode CLI window opens.

4. From the vManage mode pane, select the device and click the right arrow to move the device to the CLI mode pane.

5. Click Update to CLI Mode.

An SSH window opens. To log in to the device, enter a username and password. You can then issue CLI commands to configure or monitor the device.

The WAN Edge router authorized serial number file contains the chassis and serial numbers of all valid Cisco vEdge deviceCisco IOS XE SD-WAN devices in the overlay network. You retrieve a serial number file from the Cisco Plug-and-Play (PnP) portal and upload it to the vManage NMS. Then, from the vManage NMS, you send it to the controllers in the network. This file is required to allow the Cisco SD-WAN overlay network components to validate and authenticate each other and thus to allow the overlay network to become operational.

To upload the WAN edge router authorized serial number file to the vManage NMS and then download it to all the controllers in the overlay network:

1. In the WAN Edge List tab, click Upload WAN Edge List.

2. In the Upload WAN Edge List window:

   1. Click Choose File and select the WAN edge router authorized serial number file you received from Cisco SD-WAN.

   2. To automatically validate the routers and send their chassis and serial numbers to the controllers, ensure that the checkbox Validate the Uploaded WAN Edge List and Send to Controllers is selected. (It is selected by default.) If you do not select this option, you must individually validate each router in Configuration ► Certificates ► WAN Edge List.

   3. Click Upload.

A list of routers in the network is displayed in the router table, with details about each router.

Chassis and serial numbers of all valid Cisco vEdge deviceCisco IOS XE SD-WAN devices in the overlay network are required to allow the Cisco SD-WAN overlay network components to validate and authenticate each other and thus to allow the overlay network to become operational.

To upload the WAN edge router authorized serial numbers from a Cisco Smart account to the vManage NMS and then download it to all the controllers in the overlay network:

1. In the WAN Edge List tab, click Sync Smart Account.

2. In the Sync Smart Account window:

   1. Enter the username and password for your Smart account..

   2. To automatically validate the routers and send their chassis and serial numbers to the controllers, ensure that the checkbox Validate the Uploaded WAN Edge List and Send to Controllers is selected. (It is selected by default.) If you do not select this option, you must individually validate each router in Configuration ► Certificates ► WAN Edge List.

   3. Click Sync.

A list of routers in the network is displayed in the router table, with details about each router.

For vEdge Cloud routers, you need to generate a bootstrap configuration file that you use when you create vEdge cloud VM instances.

To generate and download a bootstrap configuration for one or more vEdge Cloud routers:

1. In the WAN Edge List tab, click the Export Bootstrap Configuration button.

2. In the Export Bootstrap Configuration window, in the Bootstrap Configuration field, click Cloud-Init or Encoded String, depending the Hypervisor you are using to bring up the vEdge Cloud router.

3. Select the devices to configure from the Available Devices pane, or click Select All to select all devices.

4. Click the right arrow to move the devices to the Selected Devices pane.

5. Click Generate Configuration. The configurations are downloaded to the vManage NMS.

6. Provision the vEdge Cloud router instance in AWS, KVM, or ESXi with the boostrap configuration. By default, ge0/0 is the device's tunnel interface and is a DHCP client. To use an interface other than ge0/0 as the tunnel interface or to use a static IP as the IP address, reconfigure the device through the CLI. For more information about configuring interfaces, see Configure Network Interfaces.

After you provision the vEdge Cloud router instance, vManage NMS installs a certificate on the device and the device's token changes to a serial number. After the device's control connections to vManage NMS come up, any templates attached to the device are automatically pushed to the device.

In an overlay network, you might have multiple devices of the same type that have identical or effectively identical configurations. For example, in a network with redundant Cisco vSmart Controllers, each controller must be configured with identical policies. Another example is a network with Cisco vEdge deviceCisco IOS XE SD-WAN devices at multiple sites, where each Cisco vEdge deviceCisco IOS XE SD-WAN device is providing identical services at each site.

Because the configurations for these devices are essentially identical, you can create one set of feature templates, which you then consolidate into one device template that you use to configure all the devices. You can create an Excel file in CSV format that lists the variables and defines each device specific variable value for each device. Then you can load the file when you attach a device template to a device.

To export data for all devices to a file in CSV format, click the Export icon. This icon, which is a downward-pointing arrow, is located to the right of the filter criteria both in the WAN Edge List and in the Controllers tab.

vManage NMS downloads all data from the device table to an Excel file in CSV format.

View a Device's Running Configuration

Running configuration is configuration information that vManage obtains from the memory of a device. This information can be useful for troubleshooting.

To view a device's running configuration:

1. In the WAN Edge List or Controllers tab, select the device.

2. Click the More Actions icon to the right of the row and click Running Configuration.

View a Device's Local Configuration

Local configuration is configuration that vManage has stored for a device. This information can be useful for troubleshooting or for determining how to access a device if, for example, a device is not reachable from vManage.

To view a device's local configuration created using Configuration ► Templates:

1. In the WAN Edge List or Controllers tab, select the device.

2. Click the More Actions icon to the right of the row and click Local Configuration.

Copy Router Configuration

When you are replacing one router at a site with another router, you copy the old router's configuration to the new router. Then you remove the old router from the network and add the new one.

To copy the configuration from the old router to the new router:

1. In the Configuration ► Certificates screen, mark the new Cisco vEdge deviceCisco IOS XE SD-WAN device as invalid.

2. In the Configuration ► Devices screen, in the WAN Edge List tab, select the old router.

3. Click the More Actions icon to the right of the row and click Copy Configuration.

4. In the Copy Configuration window, select the new router.

5. Click Update to confirm the copy of the configuration.

After you have copied the configuration to the new router, you can add the new router to the network. First, delete the old router from the network, as described below. Then add the new router to the network:

1. In the Configuration ► Certificates screen, mark the new router as valid.

2. Click Send to Controller.

Deleting a router removes its serial and chassis numbers from the WAN edge router serial number list and permanently removes the router's configuration from the vManage NMS. Delete a router if you need to remove it from your deployment.

1. In the Configuration ► Certificates screen, mark the WAN Edge router as invalid.

2. In the Configuration ► Devices screen, in the WAN Edge List tab, select the router.

3. Click the More Actions icon to the right of the row and click Delete WAN Edge.

4. Click OK to confirm deletion of the device.

5. In the Configuration ► Certificates screen, click Send to Controller.

Decommissioning a vEdge Cloud router removes the device's serial number from vManage NMS and generates a new token for the device. To do so:

1. In the WAN Edge List tab, select a vEdge Cloud router.

2. Click the More Actions icon to the right of the row and click Decommission WAN Edge.

3. Click OK to confirm the decommissioning of the router.

View Log of Template Activities

A log of template activities contains information that relates to creating, editing, and deleting configuration templates, and the status of attaching configuration templates to devices. This information can be useful for troubleshooting.

To view a log of template activities:

1. In the WAN Edge List or Controllers tab, select the device.

2. Click the More Actions icon to the right of the row and click Template Log.

View Status of Device Bringup

You can view the status of the operations involved in bringing a router or controller up in the overlay network. This information can help you monitor these operations.

To view the status of a device bringup:

1. In the WAN Edge List or Controllers tab, select the device.

2. Click the More Actions icon to the right of the row and click Device Bring Up.

A Cisco vBond Orchestrator automatically orchestrates connectivity between Cisco vEdge deviceCisco IOS XE SD-WAN devices and vManage controllers. If any Cisco vEdge deviceCisco IOS XE SD-WAN device or Cisco vSmart Controller is behind a NAT, the Cisco vBond Orchestrator also serves as an initial NAT-traversal orchestrator. To add a Cisco vBond Orchestrator:

1. In the Controllers tab, click the Add Controller drop-down and select vBond.

2. In the Add vBond window:

   1. Enter the management IP address of the vBond controller.

   2. Enter the username and password to access the vBond orchestrator.

   3. Select the Generate CSR checkbox to allow the certificate-generation process to occur automatically.

   4. Click Add.

3. Repeat Steps 1 and 2 to add additional Cisco vBond Orchestrators.

The new Cisco vBond Orchestrator is added to the list of controllers in the Controllers screen.

Add a vSmart Controller

After the Cisco vBond Orchestrator authenticates Cisco vEdge deviceCisco IOS XE SD-WAN devices, the Cisco vBond Orchestrator provides Cisco vEdge deviceCisco IOS XE SD-WAN devices information that they need to connect to the Cisco vSmart Controller. A Cisco vSmart Controller controls the flow of data traffic throughout the network via data and app-route policies. To configure Cisco vSmart Controllers:

1. In the Controllers tab, click the Add Controller drop-down and select vSmart.

2. In the Add vSmart window:

   1. Enter the system IP address of the Cisco vSmart Controller.

   2. Enter the username and password to access the Cisco vSmart Controller.

   3. Select the protocol to use for control-plane connections. The default is DTLS. The DTLS (Datagram Transport Layer Security) protocol is designed to provide security for UDP communications.

   4. If you select TLS, enter the port number to use for TLS connections. The default is 23456.

      The TLS (Transport Socket Layer) protocol that provides communications security over a network.

   5. Select the Generate CSR checkbox to allow the certificate-generation process to occur automatically.

   6. Click Add.

3. Repeat Steps 1 and 2 to add additional Cisco vSmart Controllers. The vManage NMS can support up to 20 Cisco vSmart Controllers in the network.

The new Cisco vSmart Controller is added to the list of controllers in the Controllers screen.

Edit Controller Details

Editing controller details lets you update the IP address and login credentials of a controller device. To edit controller details:

1. In the Controllers tab, select the controller.

2. Click the More Actions icon to the right of the row and click Edit.

3. In the Edit window, edit the IP address and the login credentials.

4. Click Save.

Delete a Controller

Deleting a controller removes it from the overlay. Delete a controller it if you are replacing it or if you no longer need it in your network.

To delete a controller:

1. In the Controllers tab, select the controller.

2. Click the More Actions icon to the right of the row and click Invalidate.

3. Click OK to confirm the removal of the device and all its control connections.

Configure Reverse Proxy on Controllers

To configure reverse proxy on an individual vManage NMS and Cisco vSmart Controller:

1. In the Controllers tab, select the device.

2. Click the More Actions icon to the right of the row, and click Add Reverse Proxy. The Add Reverse Proxy popup is displayed.

3. Click Add Reverse Proxy.

4. Configure the private IP address and port number for the device. The private IP address is the IP address of the transport interface in VPN 0. The default port number is 12346. This is the port used to establish the connections that handle control and traffic in the overlay network.

5. Configure the proxy IP address and port number for the device, to create the mapping between the private and public IP addresses and port numbers.

6. If the vManage NMS or Cisco vSmart Controller has multiple cores, repeat Steps 4 and 5 for each core.

7. Click Add.

To enable reverse proxy in the overlay network, in vManage NMS select Administration ► Settings. Then click Edit to the right of the Reverse Proxy bar, click Enabled, and click Save.

Prerequisites to Set up CA for SSL/TLS Proxy

To be able to configure CA certificates, the CA server and the device seeking the certificate must have their time synchronized. See Configure NTP to learn how to coordinate and synchronize time across all devices in the Cisco SD-WAN overlay network.

Configure Enterprise CA

1. Download a CA certificate from your CA server in PEM or Base 64 format.

2. In Cisco vManage, go to Configuration > TLS/SSL Proxy.

3. Select Enterprise CA.

4. [Optional, but recommended] Select the Simple Certificate Enrollment Protocol (SCEP) check-box.

   1. Enter the SCEP server URL in the URL Base field.

   2. [Optional] Enter the Challenge Password/Phrase if you have one configured.

   Note	If Enterprise CA is configured with SCEP, the Enterprise SCEP CA server should be reachable from transport VPN (VPN 0).

5. Upload your PEM-encoded CA certificate by clicking the Select a file option next to Root Certificates.

   OR

   Paste the CA certificate in the Root Certificates Box.

6. Verify that the fingerprint, which auto-populates after you upload the certificate, matches your CA.

7. Click Save Certificate Authority.

   Note	This step concludes configuring enterprise CA. However, you must complete steps 8, 9, and 10 to complete setting up the device as TLS proxy.

8. Configure a security policy with SSL decryption enabled

9. Attach the policy to the device that you want to set as SSL proxy.

10. Upload a Subordinate CA Certificate to TLS Proxy

Prerequisites to Set up CA for SSL/TLS Proxy

To be able to configure CA certificates, the CA server and the device seeking the certificate must have their time synchronized. See Configure NTP to learn how to coordinate and synchronize time across all devices in the Cisco SD-WAN overlay network.

1. In Cisco vManage, go to Configuration > TLS/SSL Proxy.

2. Select vManage as CA.

   Note	Leave the Set vManage as Intermediate CA check-box unselected if you want to set vManage as CA.

3. Enter the requested details: Common Name, Organization, Organizational Unit, Locality, State/Province, Country Code, and Email.

4. Select the certificate validity period from the drop-down list.

5. Click Save Certificate Authority.

6. Click the Download option on the vManage as CA page to download the root certificate generated.

7. Import the downloaded certificate into your client's trustStore as a trusted root CA.

   Note	This step concludes configuring Cisco vManage as CA. However, you must complete steps 8, 9, and 10 to complete setting up a device as TLS proxy.

8. Configure TLS/SSL Decryption security policy.

9. Configure a security policy with SSL decryption enabled

10. Attach the policy to the device that you want to set as SSL proxy.

    When TLS/SSL decryption is applied to a Cisco IOS XE SD-WAN device, Cisco vManage automatically issues a subordinate CA for the proxy and imports it to the device.

Prerequisites to Generate a CSR from the TLS Proxy Device

1. Configure Enterprise CA

2. Configure SSL decryption

3. Apply the security policy to an XE SD-WAN device

Generate CSR and Upload Subordinate CA Certificate to TLS Proxy

1. In Cisco vManage, navigate to Configuration > Certificates.

2. Select TLS Proxy. The page shows a list of devices on which a CA certificate has been installed and the status of the certificates.

3. Select the device for which you want to generate CSR and click Download CSR at the top of the page.

   A pop-up window opens. You can copy or download the CSR. Ensure that the certificate that you request is downloaded in PEM format.

4. On your CA server, request a certificate and upload or paste the CSR file you generated in the previous step.

5. Download the certificate issued by your CA in PEM format.

   Important

   Ensure that the certificate you generate is a subordinate or an intermediate CA certificate. The procedure to generate a subordinate CA certificate may differ from one enterprise CA to another. The certificate generated in this step must have its constraint set as CA: TRUE. Cisco IOS CA can’t be used for the TLS proxy feature as it doesn’t support generating a certificate with the constraint set as CA: TRUE.

6. Repeat steps 1 and 2.

7. Select the device and click Upload Certificate at the top of the page.

8. In the pop-up window that opens, upload or paste the PEM-encoded certificate that you generated from your CA server in step 5.

9. Click Upload and Save.

10. Verify that the certificate is installed on the device by running the command show crypto pki trustpoint PROXY-SIGNING-CA status on your device CLI.

    Device#show crypto pki trustpoint PROXY-SIGNING-CA status
    Trustpoint PROXY-SIGNING-CA:
      Issuing CA certificate configured:
        Subject Name:
         e=appqoe@cisco.com,cn=server-name,ou=AppQoE,o=CISCO,l=Blr,st=KA,c=IN
        Fingerprint MD5: 755C9485 DDACC0BD B5ED93E6 4E8A7DEB 
        Fingerprint SHA1: 4D4380EA 07392044 6A5BF891 938AC610 C0C0AA6D 
      Router General Purpose certificate configured:
        Subject Name:
         cn=sign
        Fingerprint MD5: 1956194E FEC057A3 8FE5BFA5 DD84662B 
        Fingerprint SHA1: 864A8126 EBC780E2 D958AD86 93CB8923 3EF3B7FF 
      State:
        Keys generated ............. Yes (General Purpose, non-exportable)
        Issuing CA authenticated ....... Yes
        Certificate request(s) ..... Yes
    

Enterprise Certificate Supported Devices

The following are the supported enterprise supported devices.

Configuring Enterprise Certificates

1. Navigate to Administration > Settings Hardware WAN Edge Certificate Authority and select Edit.

   

2. Click Enterprise Certification (signed by Enterprise CA).

   Security: On Box Certificate(TPM/SUDI Certificate) is the default option.

3. Click Set CSR Properties if you want to specify custom certificate properties. The following properties are listed under the CSR Properties checkbox.

   • Domain Name

   • Organizational Unit

     Note	Organizational Unit is a noneditable field. Organization Unit needs to be the same as Organization Name on vManage.

   • Secondary Organization Unit: This optional field is only available in Cisco IOS XE Release 17.2 or Cisco SD-WAN Release 20.1.x and onwards. Note that if this optional field is specified, it will be applied to all controllers and edge devices.

   • Organization

   • City

   • State

   • Email

   • 2-Letter Country Code

4. Chose Select a file to upload a root certificate authority file.

   The uploaded root certificate authority displays in the text box.

5. Select Save.

6. Navigate to Configuration > Devices.

7. Select the Upload WAN Edge List tab.

8. Browse to the location of the Cisco IOS XE SD-WAN devices and Cisco vEdge devices list and click Upload.

9. At the Configuration > Certificates page, using the More options, select the appropriate action, View Enterprise CSR, View Enterprise Certificate, Renew Enterprise CSR, or Revoke Enterprise Certificate.

   • View Enterprise CSR (certificate signing request): Copy the CSR and sign it using the enterprise root certificate, and upload the signed certificate on vManage using the Install Certificate operation. vManage automatically discovers on which hardware edge the certificate needs to be installed on.

   • View Enterprise Certificate: Once the certificate is installed, you can see the installed certificate and download it.

   • Renew Enterprise CSR: In case you need to install a new certificate on the hardware device, you can use the Renew Enterprise CSR option. The Renew Enterprise CSR option generates the CSR. You can then view the certificate (View Enterprise CSR option) and install the certificate (Install Certificate option). This step flaps the control connections as a new serial number. You can see the new serial number and expiry data on the Configuration > Certificates page.

   • Revoke Enterprise Certificate: This option removes the enterprise certificate from the device and moves it back to prestaging. The device has only vBond and vManage controls up.

   For a Cisco IOS XE SD-WAN device, using the More options, select the appropriate action, View Feature CSR, View Feature Certificate, or Revoke Feature Certificate.

   • View Feature CSR:

     • Copy the CSR available from the Cisco IOS XE SD-WAN device.

     • Sign the certificate using the enterprise root certificate from a certifying authority.

     • Upload the signed certificate on Cisco vManage using the Install Feature Certificate operation.

       Cisco vManage automatically discovers on which hardware edge the certificate needs to be installed. After you install feature certificate, the option View Feature Certificate is available.

   • View Feature Certificate: After you install the feature certificate, you can view the feature certificate and download it.

   • Revoke Feature Certificate: This option removes the feature certificate or trustpoint information from the Cisco IOS XE SD-WAN device. After revoking a certificate, all actions against devices are not available. To view all actions for a device, ensure that you configure logging information of the device to a Transport Layer Security (TLS) profile with authentication type as server, and then configure back to mutual. Alternatively, to view the actions, reset Cisco IOS XE SD-WAN device to factory default configuration.

     To reset a device to factory default:

     • Click Configuration > Templates.

     • Create a device template with the factory-default template.

       The factory-default template is, Factory_Default_feature-name_Template. See Create a Device Template from Feature Templates for information about creating a device template with feature template.

10. Select Install Certificate or Install Feature Certificate to upload the signed certificate.

    The certificate has to be a signed certificate. Initially, the state is CSR Generated.

    The state changes to Certificate Installed when successfully installed.

11. At the Configuration > Certificates page, you can see enterprise certificate columns, including the device type, chassis-id, enterprise serial number, and enterprise certificate date.

Generating a Bootstrap Configuration

The on-site bootstrap process involves generating a bootstrap configuration file that loads from a bootable USB drive or from internal boot flash to a device that supports SD-WAN. When the device boots, it uses the information in the configuration file to come up on the network.

1. If you need to generate a bootstrap configuration, use the Configuration > Devices page, and select Generate Bootstrap Configuration under More options.

Deleting a WAN Edge Device

Before deleting a WAN edge device, invalidate the device on the Configuration > Certificates page.

Supported Devices for Cisco PKI Certificates

The following are the supported devices for using Cisco PKI certificates.

Use Cases for Cisco PKI Controller Certificates

Use Case 1

Cisco-Hosted Cloud Overlays with Software Version 19.x and Above

Prerequisites

vManage and the controllers should all be running the same 19.x software version.

You can verify the software version for the new or expired overlays without having control connections using SSH.

1. SSH to each of the controllers and the version should show during the SSH process.

2. You do not need to actually have the credentials work, therefore you can run this on a controller where the credentials do not work.

   Repeat this process for all the controllers in the overlay to make sure.

3. Customer Smart Account credentials need to be ready using either of the following methods:

   1. Email and request the customer contact from PnP trigger notifications to individually email you and provide the Smart Account credentials.

      or

   2. Email and request the customer contact to log on to vManage and add them. Also ensure that you ask the customer for their IPs to whitelist.

      Ensure that if asking the customer to provide their customer contact to log on, this step is done after asking the customer for their IPs to whitelist, so that they can reach the vManage GUI, be able to log on, and input their Smart Account credentials.

      You can find your Smart Account credentials in the vManage GUI in Administration ► Settings ► Smart Account Credentials at the very bottom of the page.

      Enter the user name and password and select Save.

Runbook to Request and Install Cisco PKI Certificates

1. Verify that you have satisfied the prerequisites and that you have added the Smart Account credentials.

2. Navigate to Administration ► Settings ► Controller Certificate Authorization and press Edit.

3. Select the radio button Cisco Automated (Recommended).

   Note	You get an error if the Smart Account credentials are not added. Check the prerequisites.

4. Set the validity period to 1 year for POCs, 2 years for production overlays in the drop-down.

5. Set Certificate Retrieve Interval to 1 minute and press Save.

   Note	Currently there is no customer email field to notify customers about approval because the certificates are auto-approved as soon as the CSR request is done.

6. From this step onwards, the process is the same as for the Symantec/Digicert controllers in the vManage GUI.

   Navigate to the Configuration ► Certificates ► Controllers tab. Click on the More (dot) menu on the right ► Generate CSR.

   The operation status shows the CSR sent for signing, the certificate signed and installed automatically without needing human intervention.

7. The certificates get installed automatically and shows the expiration date and status of a successful install. The operation status shows Installed for vBonds and vBond Updated for vSmarts and vManage along with the certificate serial number.

8. Ensure that the control connections have come up to the controllers on the vManage dashboard.

Use Case 2

Migration of an Active Existing Overlay from Digicert to Cisco PKI Controller Certificates During Certificate Renewal

Prerequisites

vManage, controllers, and vEdges should all have their control connections up.

1. Verify that the control connections to controllers and vEdges are up in the vManage GUI dashboard.

   If the control connections are not up, let the customer know that migrating from Digicert to Cisco PKI cannot proceed until the control is up.

   If the control connections are only partially up, that is some vEdges are control down, then let the customer know that those vEdges will not be able to automatically reconnect to the controllers if their control comes up once the certificates have been moved to Cisco PKI.

   If it is a case of expired certificates and control connections are down, then certificates need to be renewed on Digicert first and control connections need to be brought up before migrating them to the Cisco PKI controller certificates.

2. Verify that the software version of the controllers is 19.x.

   How to Verify the Software Version for the Active Existing Overlays (with Valid Control Connections to Controllers) Using the vManage GUI

   1. Navigate to the Maintenance ► Software Upgrade in the vManage GUI menu.

   2. Select the vManage tab and look for the column Current Version. Verify that it is 19.x or above.

      If the control connections are up and vManage and controller versions are not 19.x, then let the customer know to upgrade them to 19.x first (vEdges need not be upgraded) before migration to Cisco PKI can be done.

      Note	It is mandatory that controllers upgraded to 19.x should immediately have their certificates renewed with Cisco PKI as part of the upgrade; they cannot be allowed to run with the existing Symantec certificates even if those certificates are going to remain valid.

   3. Once the prerequisites are verified, check that the Cisco PKI root-CA has been propagated to all the controllers and the vEdges.

      This requires SSH access to the controllers.

      1. SSH into the vManage and controllers and run the following command: show certificate root-ca-cert | include Cisco.

         If the output is blank or does not show the result, escalate to the cloud infrastructure team.

   4. Customer Smart Account credentials need to be ready by either of the following methods:

      1. Email and request the customer contact from a PnP trigger notification to individually email you and provide the Smart Account credentials.

         or

      2. Email and request your customer contact to log on to the vManage themselves and add them. Also ensure that you ask for the customer IPs to whitelist.

         Ensure that if asking the customer to provide, this step is done after asking the customer for their IPs to whitelist, so that they can reach the vManage GUI, be able to log on, and input the Smart Account Credentials.

         You can find the Smart Account credentials in the vManage GUI at Administration ► Settings ► Smart Account Credentials (at the very bottom).

      3. Enter the username and password and press Save.

         Once all the prerequisites have been satisfied, follow the Runbook to Request and Install Cisco PKI Certificates to request CSRs and get the Cisco certificates installed. Verify that all the control connections to the controllers and the vEdges have come back up. If not, then escalate to the cloud infrastructure team.

Use Case 3:

Submitting CSRs and Downloading Certificates on On-Premises Controllers

The following steps require access to PnP and to the SA/VA in question. Customers have access to their own SA/VA.

Prerequisites

The prerequisites are the same in the above cases, except that you use the manual method for installing the certificates.

Runbook

1. Verify in the vManage GUI Administration ► Settings ► Controller Certificate Authorizaton is set to Manual.

2. Generate the CSRs for the controllers.

   Navigate to the Configuration ► Certificates ► Controllers tab. Click on the More (dot) menu on the right and then select Generate CSR.

   Download each CSR to a file with a filename .csr and keep it ready to submit to the PnP portal for getting the signed certificates.

3. Log on to the PnP portal to the required SA/VA and select the Certificates tab.

4. Click on Generate Certificate and follow the steps to give a name for the certificate file, paste the CSR, and download the signed certificate.

   The finished certificate is ready for download. Repeat this process for each CSR and download all the required certificates.

5. You can install the downloaded certificates in the vManage GUI by navigating to Configuration ► Certificates ► Controllers ► Install Certificate button (top right).

   Once installed, verify that the control connections are up.

Debugging and Log Information

1. Check the vBond profile under the VA in PnP to verify that the correct organization name exists.

2. Check the output at /var/log/nms/vmanage-server.log on the vManage for logs of the entire certificate process.

3. vManage should have internet connectivity to reach the Cisco PKI servers.

To create a device template by entering a CLI text-style configuration directly on the Cisco vManage:

1. In the Device tab, click the Create Template drop-down and select CLI Template.

2. From the Device Type drop-down, select the type of device for which you are creating the template.

3. In the Template Name field, enter a name for the device template. This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 through 9, hyphens (–), and underscores (_). It cannot contain spaces or any other characters.

4. In the Description field, enter a description for the device template. This field is mandatory, and it can contain any characters and spaces.

5. In the CLI Configuration box, enter the configuration either by typing it, cutting and pasting it, or uploading a file.

6. To convert an actual configuration value to a variable, select the value and click Create Variable. Enter the variable name, and click Create Variable. You can also type the variable name directly, in the format {{variable-name}}; for example, {{hostname}}.

7. Click Add. The new device template is displayed in the Device Template table. The Feature Templates column shows the number of feature templates that are included in the device template, and the Type column shows "CLI" to indicate that the device template was created from CLI text.

Edit a Device Template

1. In the Device or Feature tab, select a template.

2. Click the More Actions icon to the right of the row and click Edit.

You cannot change the name of a device or feature template when that template is attached to a device.

Note that you can edit templates simultaneously from one or more vManage servers. For simultaneous template edit operations, the following rules apply:

• You cannot edit the same device or feature template simultaneously.

• When you are editing a device template, all other feature templates attached to that device template are locked and you cannot perform any edit operations on them.

• When you are editing a feature template that is attached to a device template, that device template as well as all other feature templates attached to it are locked and you cannot perform any edit operations on them.

Delete a Template

Deleting a template does not remove the associated configuration from devices.

1. In the Device or Feature tab, select a template.

2. Click the More Actions icon to the right of the row and click Delete.

3. Click OK to confirm deletion of the template.

Copy a Template

1. In the Device or Feature tab, select a template.

2. Click the More Actions icon to the right of the row and click Copy.

3. Enter a new template name and description.

4. Click Copy.

Edit a CLI Device Template

1. In the Device tab, select a template.

2. Click the More Actions icon to the right of the row and click Edit.

3. In the Device CLI Template window, edit the template.

4. Click Update.

View a Template

1. In the Device or Feature tab, select a template.

2. Click the More Actions icon to the right of the row and click View.

View Device Templates Attached to a Feature Template

1. In the Feature tab, select a template.

2. Click the More Actions icon to the right of the row and click Show Attached Device Templates. The View Attached Device Templates popup window opens, displaying the names of the device templates to which the feature template is attached.

View Devices Attached to a Device Template

For a device template that you created from feature templates:

1. In the Device tab, select a template.

2. Click the More Actions icon to the right of the row and click Attach Devices.

3. In the Attach Devices window, click the Attached Devices tab.

For a device template that you created from a CLI template:

1. In the Device tab, select a template.

2. Click the More Actions icon to the right of the row and click Show Attached Devices.

To configure a device on the network, you attach a device template to the device. You can attach only one device template to a device, so the template—whether you created it by consolidating individual feature templates or by entering a CLI text-style configuration—must contain the complete configuration for the device. You cannot mix and match feature templates and CLI-style configurations.

On Cisco Cisco vEdge deviceCisco IOS XE SD-WAN devices in the overlay network, you can perform the same operations, in parallel, from one or more vManage servers. You can perform the following template operations in parallel:

• Attach a device template to devices

• Detach a device template from a device

• Change the variable values for a device template that has devices attached to it

For template operations, the following rules apply:

• When a device template is already attached to a device, you can modify one of its feature templates. Then when you click Update ► Configure Devices, all other template operations—including attach devices, detach devices, and edit device values—are locked on all vManage servers until the update operation completes. This means that a user on another vManage server cannot perform any template operations until the update completes.

• You can perform the attach and detach device template operations on different devices, from one or more vManage servers, at the same time. However, if any one of these operations is in progress on one vManage server, you cannot edit any feature templates on any of the servers until the attach or detach operation completes.

If the device being configured is present and operational on the network, the configuration is sent to the device immediately and takes effect immediately. If the device has not yet joined the network, the pushing of the configuration to the device is scheduled. When the device joins the network, Cisco vManage pushes the configuration immediately after it learns that the device is present in the network.

Attach a Device Template to Devices

You can attach the same templates to multiple devices, and you can do so simultaneously, in a single operation.

To attach a device template to one or more devices:

1. In the Device tab, select a template.

2. Click the More Actions icon to the right of the row and click Attach Devices. The Attach Devices dialog box opens with the Select Devices tab selected

3. In the Available Devices column on the left, select a group and search for one or more devices, select a device from the list, or click Select All.

4. Click the arrow pointing right to move the device to the Selected Devices column on the right.

5. Click Attach.

6. If the template contains variables, enter the missing variable values for each device you selected in one of the following ways:

• Enter the values manually for each device either in the table column or by clicking the More Actions icon to the right of the row and clicking Edit Device Template. When you are using optional rows, if you do not want to include the parameter for the specific device, do not specify a value.

• Click Import File in the upper right corner of the screen to upload a CSV file that lists all the variables and defines each variable's value for each device.

1. Click Update

2. Click Next. If any devices have the same system IP address, a pop-up or an error message is displayed when you click Next. Modify the system IP addresses so that there are no duplicates, and click Save. Then click Next again.

3. In the left pane, select the device, to preview the configuration that is ready to be pushed to the device. The right pane displays the device's configuration and the Config Preview tab in the upper right corner is selected. Click the Config Diff tab to view the differences between this configuration and the configuration currently running on the device, if applicable. Click the Back button to edit the variable values entered in the previous screen.

4. If you are attaching a Cisco vEdge deviceCisco IOS XE SD-WAN device, click Configure Device Rollback Timer located at the bottom of the left pane, to configure the time interval at which the device rolls back to its previous configuration if the router loses its control connection to the overlay network. The Configure Device Rollback Time dialog box is displayed.

   1. From the Devices drop-down, select a device.

   2. To enable the rollback timer, in the Set Rollback slider beneath the Devices drop-down, drag the slider to the left to enable the rollback timer. When you do this, the slider changes in color from gray to green.

   3. To disable the rollback timer, click the Enable Rollback slider. When you disable the timer, the Password field pops up. Enter the password that you used to log in to the vManage NMS.

   4. In the Device Rollback Time slider, drag the slider to the desired value. The default time is 5 minutes. You can configure a time from 6 to 15 minutes.

   5. To exclude a device from the rollback timer setting, click Add Exception and select the devices to exclude.

   6. The table at the bottom of the Configure Device Rollback Time dialog box lists all the devices to which you are attaching the template and their rollback time. To delete a configured rollback time, click the Trash icon to the right of the device name.

   7. Click Save.

5. Click Configure Devices to push the configuration to the devices. The Status column displays whether the configuration was successfully pushed. Click the right angle bracket to the left of the row to display details of the push operation.

Export a Variables Spreadsheet in CSV Format for a Template

1. In the Device tab, select a device template.

2. Click the More Actions icon to the right of the row and click Export CSV.

By default, when you attach a Cisco vEdge deviceCisco IOS XE SD-WAN device to a configuration template, if the router is unable to successfully start after 5 minutes, it returns to, or rolls back to, the previous configuration. For a configuration that you have created from the CLI, you can change the device's rollback timer:

1. In the Device tab, select a device template.

2. Click the More Actions icon to the right of the row and click Change Device Values. The right pane displays the device's configuration, and the Config Preview tab in the upper right corner is selected.

3. In the left pane, click the name of a device.

4. Click Configure Device Rollback Timer located at the bottom of the left pane. The Configure Device Rollback Time dialog box is displayed.

5. From the Devices drop-down, select a device.

6. To enable the rollback timer, in the Set Rollback slider beneath the Devices drop-down, drag the slider to the left to enable the rollback timer. When you do this, the slider changes in color from gray to green.

7. To disable the rollback timer, click the Enable Rollback slider. When you disable the timer, the Password field pops up. Enter the password that you used to log in to the vManage NMS.

8. In the Device Rollback Time slider, drag the slider to the desired value. The default time is 5 minutes. You can configure a time from 6 to 15 minutes.

9. To exclude a device from the rollback timer setting, click Add Exception and select the devices to exclude.

10. The table at the bottom of the Configure Device Rollback Time dialog box lists all the devices to which you are attaching the template and their rollback time. To delete a configured rollback time, click the Trash icon to right right of the device name.

11. Click Save.

12. Click Configure Devices to push the configuration to the devices. The Status column displays whether the configuration was successfully pushed. Click the right angle bracket to the left of the row to display details of the push operation.

For a configuration that you have created from the CLI:

1. In the Device tab, select a device template.

2. Click the More Actions icon to the right of the row and click Change Device Values. The right pane displays the device's configuration, and the Config Preview tab in the upper right corner is selected.

3. In the left pane, click the name of a device.

4. Click the Config Diff tab to view the differences between this configuration and the configuration currently running on the device, if applicable. Click the Back button to edit the variable values entered in the previous screen.

5. Click Configure Devices to push the configuration to the devices. The Status column displays whether the configuration was successfully pushed. Click the right angle bracket to the left of the row to display details of the push operation.

For a configuration that you have created from device configuration templates, if the templates contain variables, the vManage NMS can automatically populate the variables with actual values when you attach the templates to the devices. To do this, you create an Excel file that lists the variable values for each device and save the file in CSV format. You can also enter values for these variables manually.

After you have pushed the configuration to a device, you can change the value assigned to any variable:

1. In the Device tab, select the device template.

2. Click the More Actions icon to the right of the row, and click Change Device Values. The screen displays a table of all the devices that are attached to that device template.

3. For the desired device, click the More Actions icon to the right of the row, and click Edit Device Template.

4. In the Update Device Template pop-up, enter values for the items in the variable list.

5. Click Update.

6. Click Next.

7. Click Configure Devices to push the configuration to the device. The Status column displays if the configuration was successfully pushed or not. Click the right angle bracket to the left of the row to display details of the push operation.