WEBVTT 1 00:00.000 --> 00:06.280 Provisioning new sites as part of a wide area network can be a pretty big 2 00:06.280 --> 00:07.560 challenge. 3 00:07.560 --> 00:11.600 If we think about an organization that has hundreds or potentially even 4 00:11.600 --> 00:12.880 thousands of remote 5 00:12.880 --> 00:17.180 sites and they're all part of a wide area network, then we can really start to 6 00:17.180 --> 00:17.720 see some 7 00:17.720 --> 00:19.000 of the issues here. 8 00:19.000 --> 00:23.240 But even if we're not this large, think about the challenges of provisioning a 9 00:23.240 --> 00:24.200 new network. 10 00:24.200 --> 00:29.560 So let's say we've got a new site that we're spinning up and this site could be 11 00:29.560 --> 00:30.040 somewhere WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 11 00:29.560 --> 00:30.040 somewhere 12 00:30.040 --> 00:31.120 pretty remote. 13 00:31.120 --> 00:35.550 Maybe it's a few hours away, maybe it's an airplane right away, maybe it's in a 14 00:35.550 --> 00:36.400 completely 15 00:36.400 --> 00:37.960 different country. 16 00:37.960 --> 00:43.030 And so we and IT tend to live over here and I could bring a router in and 17 00:43.030 --> 00:45.200 configure it 18 00:45.200 --> 00:49.000 and then ship it out to this location. 19 00:49.000 --> 00:53.600 And that's typically what we expect to do with a traditional network. 20 00:53.600 --> 00:58.150 And so hopefully somebody here can be our smart hands and they can install this 21 00:58.150 --> 00:58.840 router, 22 00:58.840 --> 01:03.270 plug it in, hopefully get us connected to the right WAN circuit provider WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 22 00:58.840 --> 01:03.270 plug it in, hopefully get us connected to the right WAN circuit provider 23 01:03.270 --> 01:04.440 connection, 24 01:04.440 --> 01:07.480 maybe they provide a copper handoff, something like that. 25 01:07.480 --> 01:14.300 And then we have to hope that this connectivity into the WAN space comes online 26 01:14.300 --> 01:14.440 . 27 01:14.440 --> 01:16.320 And what happens if it doesn't come online? 28 01:16.320 --> 01:19.440 What happens if there is an issue with the configuration? 29 01:19.440 --> 01:22.600 Maybe I put the wrong IP address on the interface. 30 01:22.600 --> 01:25.480 Maybe I just had a circuit settings wrong. 31 01:25.480 --> 01:30.690 Maybe the IP address I was given changes by the time it arrives to the site and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 31 01:25.480 --> 01:30.690 Maybe the IP address I was given changes by the time it arrives to the site and 32 01:30.690 --> 01:31.360 the service 33 01:31.360 --> 01:35.240 provider says, you know what, don't do that IP address to this IP address 34 01:35.240 --> 01:36.000 instead. 35 01:36.000 --> 01:40.640 And now we're relying on our smart hands here to be really, really smart. 36 01:40.640 --> 01:45.300 In fact, usually we don't even need smart hands, we just need hands to get this 37 01:45.300 --> 01:46.720 thing installed 38 01:46.720 --> 01:48.480 and connected in. 39 01:48.480 --> 01:53.900 But now we're asking this person to log into this router and change an IP 40 01:53.900 --> 01:54.920 address. 41 01:54.920 --> 01:58.160 Maybe I can do a WebEx with them or screen share. 42 01:58.160 --> 02:01.160 We can tell that this is going to be very painful. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 42 01:58.160 --> 02:01.160 We can tell that this is going to be very painful. 43 02:01.160 --> 02:04.950 And the larger our organization is the more often we have to worry about this 44 02:04.950 --> 02:05.400 particular 45 02:05.400 --> 02:07.040 situation. 46 02:07.040 --> 02:13.890 And so we want to not have to rely on our managers or our staff at this 47 02:13.890 --> 02:15.960 location wherever 48 02:15.960 --> 02:17.160 it is. 49 02:17.160 --> 02:20.410 And we don't want to have to do that, but we also don't want to have to travel 50 02:20.410 --> 02:20.960 to get there 51 02:20.960 --> 02:21.960 ourselves. 52 02:21.960 --> 02:26.020 Yeah, if it's a few hours away, maybe even if it's a days travel away, it 53 02:26.020 --> 02:26.880 wouldn't be the 54 02:26.880 --> 02:28.640 worst thing in the world. 55 02:28.640 --> 02:30.080 Maybe we could ship it back. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 55 02:28.640 --> 02:30.080 Maybe we could ship it back. 56 02:30.080 --> 02:31.320 We've got options there. 57 02:31.320 --> 02:35.560 But as soon as it's a plane ride or again in another country on another 58 02:35.560 --> 02:36.760 continent, then 59 02:36.760 --> 02:39.080 this travel becomes very restrictive. 60 02:39.080 --> 02:42.510 And so yeah, we might just have to ship it back so that we can try to fix the 61 02:42.510 --> 02:43.320 configuration 62 02:43.320 --> 02:46.000 and hope this all doesn't happen again. 63 02:46.000 --> 02:50.400 So we want to solve this problem of provisioning. 64 02:50.400 --> 02:55.080 And we have a more sophisticated white area network architecture now. 65 02:55.080 --> 02:56.600 So can we do that? 66 02:56.600 --> 03:00.190 And the answer is, well, yes, if the answer was no, I'm not sure why we'd be WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 66 02:56.600 --> 03:00.190 And the answer is, well, yes, if the answer was no, I'm not sure why we'd be 67 03:00.190 --> 03:00.920 having this 68 03:00.920 --> 03:01.920 session. 69 03:01.920 --> 03:08.480 But we can address this with zero touch provisioning. 70 03:08.480 --> 03:12.000 Sometimes abbreviated as ZTP. 71 03:12.000 --> 03:14.160 So zero touch provisioning. 72 03:14.160 --> 03:21.760 The idea here is that we want to automate bringing up a new location. 73 03:21.760 --> 03:26.900 So these new, when edge devices that were shipping out and we still are going 74 03:26.900 --> 03:27.880 to have to ship 75 03:27.880 --> 03:30.320 this, we need to make sure that it gets there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 75 03:27.880 --> 03:30.320 this, we need to make sure that it gets there. 76 03:30.320 --> 03:32.800 Now, it doesn't necessarily have to come from me. 77 03:32.800 --> 03:38.260 It could actually come from, sure, from me, or it could come from the original 78 03:38.260 --> 03:39.440 manufacturer. 79 03:39.440 --> 03:42.160 In our case, we'll just say it's Cisco. 80 03:42.160 --> 03:45.920 I order a router from Cisco and I have them ship it to the site directly. 81 03:45.920 --> 03:47.400 And say, well, wait a second. 82 03:47.400 --> 03:49.600 I haven't added my configuration on there. 83 03:49.600 --> 03:53.000 If we're going to ship it directly to the site, it's not going to have any 84 03:53.000 --> 03:53.840 configuration 85 03:53.840 --> 03:55.240 and that's correct. 86 03:55.240 --> 04:01.850 Because we're going to automate these new edges coming online or onboarding to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 86 03:55.240 --> 04:01.850 Because we're going to automate these new edges coming online or onboarding to 87 04:01.850 --> 04:02.840 the SD-WAN 88 04:02.840 --> 04:04.920 environment. 89 04:04.920 --> 04:06.440 So here's how this comes together. 90 04:06.440 --> 04:15.270 I as the admin now log into V-manage and I create a template that I'm going to 91 04:15.270 --> 04:16.160 use for 92 04:16.160 --> 04:18.800 this edge device. 93 04:18.800 --> 04:23.840 I also add this particular edge device into my white list. 94 04:23.840 --> 04:26.880 This is important from a security perspective because if we're going to 95 04:26.880 --> 04:27.880 automate onboarding 96 04:27.880 --> 04:34.480 new WAN edges, we would not want a thread actor, a bad guy, somebody like that, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 96 04:27.880 --> 04:34.480 new WAN edges, we would not want a thread actor, a bad guy, somebody like that, 97 04:34.480 --> 04:35.000 to be able 98 04:35.000 --> 04:38.080 to add their own router into our environment. 99 04:38.080 --> 04:40.560 So I'm going to white list this new router. 100 04:40.560 --> 04:45.070 I understand that this new router is going to be coming online and so we need 101 04:45.070 --> 04:45.680 to allow 102 04:45.680 --> 04:50.440 it and we need to have a template that includes all of the key configuration 103 04:50.440 --> 04:51.200 points. 104 04:51.200 --> 04:53.320 So this is step one. 105 04:53.320 --> 04:55.800 I as the admin have to do this. 106 04:55.800 --> 05:03.760 Then step two over here is that we just need an installer to perform the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 106 04:55.800 --> 05:03.760 Then step two over here is that we just need an installer to perform the 107 05:03.760 --> 05:04.400 installation 108 05:04.400 --> 05:06.280 for us. 109 05:06.280 --> 05:08.080 What does the installation look like? 110 05:08.080 --> 05:14.760 Well, it's putting the router into a rack and providing power as well as 111 05:14.760 --> 05:16.280 hopefully some 112 05:16.280 --> 05:19.320 amount of connectivity. 113 05:19.320 --> 05:24.180 So I need to connect the router into the WAN circuit and possibly not just the 114 05:24.180 --> 05:24.760 WAN circuit 115 05:24.760 --> 05:28.840 on this side but also the Ethernet connector to the rest of my network on the 116 05:28.840 --> 05:30.320 other side. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 116 05:28.840 --> 05:30.320 other side. 117 05:30.320 --> 05:35.000 But that's it. This is back to not needing smart hands. 118 05:35.000 --> 05:36.800 This installer can be anybody. 119 05:36.800 --> 05:40.950 It could be a local manager or some other staff person and I can just over the 120 05:40.950 --> 05:42.400 phone, ideally, 121 05:42.400 --> 05:48.480 walk them through getting the router into the rack and power it on and connect 122 05:48.480 --> 05:49.040 it. 123 05:49.040 --> 05:50.040 So here's how this works. 124 05:50.040 --> 05:55.560 There's a little bit of glue in the middle to connect this new WAN edge to the 125 05:55.560 --> 05:56.040 rest of 126 05:56.040 --> 05:57.640 our environment. 127 05:57.640 --> 06:02.110 And so it can't just go out directly to V-manage for example and download its WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 127 05:57.640 --> 06:02.110 And so it can't just go out directly to V-manage for example and download its 128 06:02.110 --> 06:03.360 configuration. 129 06:03.360 --> 06:08.150 That's not going to work because this WAN edge device does not know which 130 06:08.150 --> 06:08.960 customer it 131 06:08.960 --> 06:10.680 belongs to. 132 06:10.680 --> 06:13.880 We are setting it potentially directly from Cisco. 133 06:13.880 --> 06:19.390 So this is just a blank WAN edge no configuration included device that's being 134 06:19.390 --> 06:20.560 shipped to this 135 06:20.560 --> 06:21.560 location. 136 06:21.560 --> 06:29.170 So it's going to be configured to reach out to a ZTP cloud server that Cisco 137 06:29.170 --> 06:30.240 manages. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 137 06:29.170 --> 06:30.240 manages. 138 06:30.240 --> 06:37.590 And this ZTP cloud server is going to connect the device to the V-bond in our 139 06:37.590 --> 06:39.480 organization. 140 06:39.480 --> 06:44.200 The V-bond is ultimately the glue that holds everything together as we've said. 141 06:44.200 --> 06:50.040 And so it's going to push the configuration info down to this device and tell 142 06:50.040 --> 06:50.720 it how to 143 06:50.720 --> 06:54.530 connect in and start to download its configuration which at that point it's 144 06:54.530 --> 06:55.560 going to be able to 145 06:55.560 --> 07:02.440 do thanks to the V-bond getting it connected into our environment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 145 06:55.560 --> 07:02.440 do thanks to the V-bond getting it connected into our environment. 146 07:02.440 --> 07:05.080 So that's the gist of zero touch provisioning. 147 07:05.080 --> 07:11.030 Now there are a few requirements that we need to consider and it really has to 148 07:11.030 --> 07:11.960 do with 149 07:11.960 --> 07:15.760 making sure that this connection can happen here. 150 07:15.760 --> 07:19.000 It needs to be able to reach out to the ZTP cloud server. 151 07:19.000 --> 07:20.520 So what does it need for that? 152 07:20.520 --> 07:25.160 Well first and foremost it's going to need an IP address and it's going to need 153 07:25.160 --> 07:25.760 to go through 154 07:25.760 --> 07:31.210 the internet for this so it's going to need a default gateway and it's going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 154 07:25.760 --> 07:31.210 the internet for this so it's going to need a default gateway and it's going to 155 07:31.210 --> 07:32.280 need to 156 07:32.280 --> 07:37.480 be able to perform name resolution to find this ZTP cloud server. 157 07:37.480 --> 07:41.080 So we need DNS servers configured. 158 07:41.080 --> 07:46.680 Well ideally all of this just comes from DHCP. 159 07:46.680 --> 07:52.350 If I connect into my service provider and I'm given DHCP then I should have an 160 07:52.350 --> 07:53.240 IP address 161 07:53.240 --> 07:55.920 to default gateway and DNS servers. 162 07:55.920 --> 08:00.230 Unfortunately if I don't have DHCP from the service provider and I have no WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 162 07:55.920 --> 08:00.230 Unfortunately if I don't have DHCP from the service provider and I have no 163 08:00.230 --> 08:01.200 other network 164 08:01.200 --> 08:05.560 connectivity that I can use to go out to the internet and find out all this 165 08:05.560 --> 08:06.440 information 166 08:06.440 --> 08:13.750 then I can actually also ship out a USB boot disk, some kind of USB key that 167 08:13.750 --> 08:14.520 can have 168 08:14.520 --> 08:18.840 a bootstrap configuration loaded up. 169 08:18.840 --> 08:22.250 So it will require a little bit more information from the admin because then I 170 08:22.250 --> 08:22.920 would also have 171 08:22.920 --> 08:26.440 to ship out this USB potentially. 172 08:26.440 --> 08:31.250 But again this is in a perfect world not going to be required because we can WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 172 08:26.440 --> 08:31.250 But again this is in a perfect world not going to be required because we can 173 08:31.250 --> 08:32.280 just rely on 174 08:32.280 --> 08:35.200 our DHCP. 175 08:35.200 --> 08:39.790 Now a very important component in all of this as we already mentioned is 176 08:39.790 --> 08:40.800 security. 177 08:40.800 --> 08:47.170 As if I have a staff member on my IT team maybe leave the company and they bear 178 08:47.170 --> 08:47.800 some amount 179 08:47.800 --> 08:51.350 of ill will towards the company or maybe just somebody who has intimate working 180 08:51.350 --> 08:51.920 knowledge 181 08:51.920 --> 08:54.200 of how our company operates. 182 08:54.200 --> 09:00.330 There's no reason in theory why a threat actor couldn't spin up their own SD- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 182 08:54.200 --> 09:00.330 There's no reason in theory why a threat actor couldn't spin up their own SD- 183 09:00.330 --> 09:01.360 WAN router 184 09:01.360 --> 09:05.920 and attempt to take advantage of this process. 185 09:05.920 --> 09:10.150 We would want to prevent this at all costs because as soon as their router is 186 09:10.150 --> 09:11.360 part of our SD-WAN 187 09:11.360 --> 09:14.480 environment they can do all kinds of attacks. 188 09:14.480 --> 09:16.640 They can look at our route information. 189 09:16.640 --> 09:23.350 They can do man in the middle attacks by advertising routes and doing all kinds 190 09:23.350 --> 09:24.480 of bad behavior 191 09:24.480 --> 09:26.760 and mischief and mayhem. 192 09:26.760 --> 09:31.690 Ultimately it would be detrimental to my organization if this was remotely a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 192 09:26.760 --> 09:31.690 Ultimately it would be detrimental to my organization if this was remotely a 193 09:31.690 --> 09:32.680 possibility. 194 09:32.680 --> 09:36.140 Now fortunately we already mentioned one of the techniques we have to avoid 195 09:36.140 --> 09:36.760 this and that 196 09:36.760 --> 09:42.960 would be to white list any edge devices that are coming online. 197 09:42.960 --> 09:48.480 So as these devices get shipped out I can manage them through my Cisco portal 198 09:48.480 --> 09:49.280 to make sure 199 09:49.280 --> 09:54.640 that I can provision only the routers that I know are part of my network. 200 09:54.640 --> 09:58.050 But the other aspect to security which is so important with all of this is 201 09:58.050 --> 09:58.640 going to be 202 09:58.640 --> 10:03.000 the use of certificates. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 202 09:58.640 --> 10:03.000 the use of certificates. 203 10:03.000 --> 10:09.760 All of our WAN edge devices are going to come with certificates. 204 10:09.760 --> 10:14.360 And this certificate is going to be used in a couple of different ways. 205 10:14.360 --> 10:19.230 First of all it allows the WAN edge device to authenticate itself to the rest 206 10:19.230 --> 10:20.480 of the network. 207 10:20.480 --> 10:26.270 So to my SD-WAN environment I know that you are an authentic WAN edge device 208 10:26.270 --> 10:27.360 and not just 209 10:27.360 --> 10:30.240 some software designed to emulate it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 209 10:27.360 --> 10:30.240 some software designed to emulate it. 210 10:30.240 --> 10:36.290 The other thing it allows me to do is it allows me to ensure that the other 211 10:36.290 --> 10:37.360 devices in the 212 10:37.360 --> 10:44.780 network such as my V-Bond and V-Smart, my controllers they can also authent 213 10:44.780 --> 10:45.840 icate to the 214 10:45.840 --> 10:47.280 WAN edge. 215 10:47.280 --> 10:52.560 And so this allows me to make sure that I am not talking to a controller that 216 10:52.560 --> 10:53.520 isn't a valid 217 10:53.520 --> 10:58.080 controller because they also have certificates. 218 10:58.080 --> 11:03.410 And so now we can make sure that I am not only running an authentic SD-WAN WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 218 10:58.080 --> 11:03.410 And so now we can make sure that I am not only running an authentic SD-WAN 219 11:03.410 --> 11:04.760 device but again 220 11:04.760 --> 11:08.720 I could deploy this authentic device and it connects to the threat actor who 221 11:08.720 --> 11:09.120 spun up 222 11:09.120 --> 11:13.360 their own V-Manage or V-Bond or whatever the situation is. 223 11:13.360 --> 11:17.380 And so the security level is very, very important for us in managing and 224 11:17.380 --> 11:19.000 maintaining our SD-WAN 225 11:19.000 --> 11:19.600 environment.