The Cisco Network Plug and Play solution includes the following components:

• Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM)—Cisco APIC-EM is Cisco’s SDN Controller for Enterprise Networks (Access, Campus, WAN, and Wireless). The platform hosts multiple applications (SDN apps) that use open Northbound REST APIs that drive core network automation solutions. The platform also supports a number of south-bound protocols that enable it to communicate with the breadth of network devices that customers already have in place, and extend SDN benefits to both greenfield and brownfield environments.

• Cisco Network Plug and Play application—This preinstalled Cisco APIC-EM application receives plug and play requests from Cisco devices and provisions devices based on predefined rules and criteria.

• Cisco Plug and Play IOS Agent—This agent is embedded in Cisco devices and communicates to the Cisco Network Plug and Play application using the open plug and play protocol over HTTPS during device deployments.

• Cisco Plug and Play Mobile App for iOS and Android devices—Mobile application for iOS and Android devices that helps configure Cisco devices with a bootstrap configuration and triggers remote branch deployments. The app communicates with the Cisco Network Plug and Play application over 3G/4G/WiFi connections to get the predefined device bootstrap configuration, and delivers it to a Cisco network device by using a special serial cable that is physically connected to the device.

• Cisco SMI Proxy—Optional component needed to deploy Cisco switches that have older IOS versions without the new Cisco Plug and Play IOS Agent (older than IOS-XE3.6.3E and IOS15.2(2)E3). SMI Proxy acts as a proxy between older Cisco switches and the Cisco Network Plug and Play application using the newer plug and play protocol. This proxy is not supported on routing platforms.

• Generic HTTP Proxy—Optional component for remote branch deployments where the Cisco APIC-EM is not reachable directly by remote devices because it is behind a DMZ zone. A generic HTTP reverse proxy can be placed before the APIC-EM in the DMZ, to relay messages between devices and the controller. Alternately, you can choose to set up a private VPN link so that the controller is reachable via VPN, without using a generic proxy.

• Plug and Play Connect—Optional cloud component for automatic PNP server discovery if the DHCP or DNS methods are not available. The PNP Server is the backend part of the Cisco Network Plug and Play application in the APIC-EM. The Cisco network device contacts the Cisco Plug and Play Connect cloud service at devicehelper.cisco.com to obtain the IP address of the appropriate PNP server that is defined for your organization.

This section describes workflows for the following typical use cases:

• Remote Branch/Site Deployment

• Campus/LAN Deployment

• Unplanned Device Deployment

• Plug and Play Connect Device Deployment

A prerequisite is an operating Cisco APIC-EM controller with the Cisco Network Plug and Play application.

Follow these recommendations when deploying the Cisco Network Plug and Play solution:

• Configure a DHCP server with option 43 to allow Cisco network devices to auto-discover the APIC-EM controller. For DHCP and DNS configuration details, see Configuring DHCP for APIC-EM Controller Auto-Discovery.

• Pre-provision the device configuration in the Cisco Network Plug and Play application for all new devices to be deployed. This includes setting up the site and devices in it with the device serial numbers, bootstrap configuration, full configuration, and IOS image. For details, see the Configuration Guide for Cisco Network Plug and Play on Cisco APIC-EM. Note that pre-provisioning is not needed if you plan to use the Unplanned Device deployment option.

• To use the trustpool security feature, a valid certificate from a well-known certificate authority (CA) must be installed on the APIC-EM controller. The default self-signed certificate does not allow the use of trustpool security. Additionally, the DHCP option 43 string must be configured with the HTTPS transport option (K5); for details, see Configuring DHCP for APIC-EM Controller Auto-Discovery.

• Device bring up order—In general, routing and upstream devices should be brought up first. Once the router and all upstream devices are up and provisioned, switches and downstream devices can be brought up. The Cisco Network Plug and Play IOS Agent attempts to auto-discover the APIC-EM controller only during initial device startup. If at this time, the device cannot contact the controller, device provisioning fails, so upstream devices should be provisioned first.

• Cisco Router Trunk/Access Port Configuration—Typical branch networks include routers and switches. One or more switches are connected to the WAN router and other endpoints like IP phones and access points connect to the switches. When a switch connects to an upstream router, the following deployment models are supported for Cisco Network Plug and Play:

  • Downstream switch is connected to the router using a switched port on the router. In this type of connection, the switched port on the router can be configured as a trunk or access port.

    Note	If the upstream router is a Cisco 4000 Series ISR router, this functionality is impacted by caveat CSCut77951 , which is resolved in software release 15.5(3)S4.

  • Downstream switch is connected to the router using a routed port on the router. In this case, the routed port can support multiple VLANs using sub-interfaces. During the Plug and Play process the switch would automatically configure its port as a trunk port. In a large branch scenario, it becomes necessary to carry multiple VLANs between the router and the downstream switch. To support this use case, the switch must be connected to a routed port.

• Non-VLAN 1 configuration-Cisco Network Plug and Play supports devices using VLAN 1 by default. To use a VLAN other than 1, adjacent upstream devices must use supported releases and configure the following global CLI command on the upstream device to push this CLI to the upcoming Plug and Play device: pnp startup vlan x . When you execute this command on an adjacent upstream device, the VLAN membership change does not happen on that device. However, all the active interfaces on the upcoming Plug and Play device are changed to the specified VLAN. This guideline applies to both routers and switches.

Note

When using the non-VLAN 1 feature, ensure that all the neighboring switch devices are running Cisco IOS XE Release 3.6.3 or later, and not the 3.6.0, 3.6.1, or 3.6.2 releases. For more information about related caveat CSCut25533 that exists in these previous releases, see the Caveats section in the Release Notes for Cisco Network Plug and Play .

During Cisco Network Plug and Play configuration provisioning, the configuration file is applied to the running configuration of the device. If the device is using Virtual Route Forwarding (VRF), or it has multiple IP interfaces in the final configuration, the source IP address used to contact the APIC-EM controller could change after the final configuration is applied. This IP address change could result in the loss of connectivity to the controller and the device status will show a provisioning error because the controller fails to receive a successful response from the device.

For example, for a router deployment, the initial source IP address that the router uses to contact the APIC-EM controller is its WAN IP address. After the controller pushes the configuration to the router, the router could use any IP address (such as the tunnel IP address) to contact the controller. If there is no IP connectivity from the tunnel IP address to the controller, it will cause a health check error on the controller.

To avoid this issue, use the ip http client source-interface interface command in the final provisioning configuration. Since the plug and play protocol uses HTTP/HTTPS, this command tells the device to use the same interface for a response as was initially used for contacting the controller before configuration provisioning, regardless of VRF. For a router deployment scenario, you can specify the same WAN interface as the source interface.

The Cisco Network Plug and Play solution uses HTTPS connections between network devices and the APIC-EM controller. This secure connectivity is implemented in one of two ways, depending on the type of transport you specify in the DHCP option. For details on configuring DHCP, see Configuring DHCP for APIC-EM Controller Auto-Discovery.

Depending on the transport specified in the K parameter in the DHCP option 43 string, secure connectivity is implemented in the following ways:

• HTTP is specified as the transport protocol (default) and secure connectivity is based on trustpoint.

  Trustpoint based secure connectivity relies on the self-signed certification that is installed by default on the APIC-EM controller. This self-signed certificate is used to create a default trustpoint on network devices, which allows devices to connect securely over HTTPS to the APIC-EM controller. HTTPS is used for communications with the APIC-EM controller, despite the fact that HTTP is specified as the transport protocol.

• HTTPS is specified as the transport protocol and secure connectivity is based on trustpool.

  Trustpool based secure connectivity additionally requires that you replace the self-signed certification on the APIC-EM controller with your own CA signed certificate. A trustpool is a special store of certificates signed by trusted certificate authorities and published by Cisco InfoSec. A Cisco network device imports the trustpool bundle immediately upon contacting the APIC-EM controller and this allows it to validate the controller certificate and create root CA trustpoints, enabling secure communications over HTTPS with its own signed certificate.

You can choose to host the trustpool bundle in a different location in your network, which you can specify in the T parameter to DHCP option 43. In this case, network devices would obtain your trustpool bundle instead of the default one that is installed in the APIC-EM.

For more details on security, importing certificates, and the trustpool bundle, see the “Cisco APIC-EM Security” chapter in the Cisco Application Policy Infrastructure Controller Enterprise Module Deployment Guide.

The Cisco Plug and Play Mobile App (iOS or Android version) can be used by the device installer to help configure Cisco devices with a bootstrap configuration and trigger remote branch deployments, if auto-discovery of the APIC-EM controller is not possible. The mobile app communicates with the Cisco Network Plug and Play application over 3G/4G/WiFi connections to get the predefined device bootstrap configuration, and delivers it to a Cisco network device by using a special cable that is physically connected to the device console port.

The mobile apps are available at the following app stores:

• iOS: https://itunes.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=1050793709&mt=8

• Android: https://play.google.com/store/apps/details?id=com.cisco.ciscopnpandroid

Note	The Cisco Plug and Play app for iOS requires iOS version 7 or later. The Android app requires Android version 4.1 or later.

Note	The Cisco Plug and Play Mobile App is not used for deploying Cisco wireless access point devices.

The following console cable is needed, depending on whether the device is an iOS or Android device:

• iOS device: Redpark Lightning Console Cable ( L2-RJ45V ), for iOS devices with the Lightening (8-pin) connector, or Redpark Console Cable ( C2-RJ45V ), for iOS devices with the older 30-pin connector.

• Android device: Airconsole bluetooth adapter

Note	After disconnecting the console cable from the network device, if you want to connect it to a different network device, you must first manually refresh the mobile app to reflect the correct status when connecting to the new device.

Note

If you have an iOS mobile device with a Redpark cable and are deploying multiple network devices, after you are done with one device, you must unplug the Redpark cable from both your mobile device and the network device to close the serial connection. If you do not disconnect the cable from your mobile device, the serial session is not closed and the wrong configuration could be deployed on the next device.

The Smart Install (SMI) Proxy leverages Smart Install functionality that exists in Cisco switches that have older IOS versions without the new Cisco Plug and Play IOS Agent (older than IOS-XE 3.6.3E and IOS 15.2(2)E3). SMI Proxy acts as a proxy between the switches and the Cisco Network Plug and Play application using the newer plug and play protocol.

The SMI proxy is applicable only to switching platforms that support Smart Install Director functionality and is not supported on routing platforms.

For details on configuring SMI Proxy, see the “Configuring SMI Proxy” chapter of the Smart Install Configuration Guide .

Note

Customers should consider upgrading to newer IOS images to get full benefit of the Cisco Network Plug and Play Solution. The SMI Proxy does not provide all of the capabilities of the newer Cisco Plug and Play IOS Agent and it should be considered only as an interim solution until deployment of an IOS image with the newer Cisco Plug and Play IOS Agent.

If the remote network devices to be deployed need to contact the APIC-EM controller by using the public Internet, and the controller is behind a DMZ, a generic HTTP proxy must be installed in the network so that the network devices can contact the APIC-EM controller. A generic HTTP reverse proxy, such as the Apache reverse proxy, can be placed before the APIC-EM controller in the DMZ, to relay messages between network devices and the APIC-EM controller.

To use a reverse proxy, the same certificate from a well known certificate authority (CA) must be installed on the Apache HTTP proxy server, the APIC-EM, and the network device that is being deployed. The certificate allows all devices to establish trusted communications. The APIC-EM controller installs the certificate on the network device.

To import the certificate on the APIC-EM, use the Settings > Proxy Gateway Certificate GUI command as described in the chapter “Configuring the Cisco APIC-EM Settings” in the Cisco Application Policy Infrastructure Controller Enterprise Module Deployment Guide .

Note	Cisco recommends against using and importing a self-signed certificate into the controller. Importing a valid X.509 certificate from a well-known, certificate authority (CA) is recommended.

The Cisco Network Plug and Play solution has been tested with Apache HTTP Server version 2.4.7 on Ubuntu. The following lines from the Apache configuration file show an example of how to enable the reverse proxy in Apache. Substitute the IP address of the APIC-EM controller in place of APIC-EM-ip-address in the commands below:

<VirtualHost *:80>
        ProxyRequests Off
        ProxyPreserveHost On
        ProxyPass / http://apic-em-ip-address
/
        ProxyPassReverse / http://apic-em-ip-address
/
        ServerName your-server-name
        ServerAdmin webmaster@localhost
        SSLCertificateChainFile /etc/apache2/sites-available/Your-IntermediateCA-file.crt
        DocumentRoot /var/www/html
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
<VirtualHost *:443>
        SSLProtocol ALL
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        SSLEngine On
        SSLCertificateFile /etc/apache2/sites-available/your-certificate-file.crt
        SSLCertificateKeyFile /etc/apache2/sites-available/your-certificate-key-file.key
        SSLProxyEngine On
        SSLProxyVerify none
        SSLProxyCheckPeerCN Off
        SSLProxyCheckPeerExpire Off
        SSLProxyCheckPeerName Off
        SSLProxyProtocol all -SSLv2
    <Location />
        ProxyPass https://apic-em-ip-address
/ retry=1 acquire=3000 timeout=600 KeepAlive=On
        ProxyPassReverse https://apic-em-ip-address
/
    </Location>
        <Proxy *>
        Order allow,deny
        Allow from all
        </Proxy>
        ProxyPreserveHost On
        <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
        SSLOptions +StdEnvVars
        </Directory>
        BrowserMatch "MSIE [2-6]" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0
        BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
</VirtualHost>

Refer to this section for common self-help topics or issues that may come up during deployment.

Note	If you purchased this product through a Cisco reseller, contact the reseller directly for technical support. If you purchased this product directly from Cisco, contact Cisco Technical Support at this URL: http://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html

Devices can automatically discover the APIC-EM controller through DHCP, DNS, a proxy server, or the cloud through Plug and Play Connect. This section contains the following topics related to controller discovery:

• Configuring DHCP for APIC-EM Controller Auto-Discovery

• Using DNS for APIC-EM Controller Auto-Discovery

• Configuring Server Identity