This article was written by Andrea Dainese, senior network and security architect, and author of UNetLab (now EVE-NG and Route Reflector Labs.
ZTP, or Zero Touch Provisioning, is a feature that allows you to provision and configure devices automatically. In other words, ZTP is the process that moves a device from an out-of-the-box state to a fully configured state.
Some devices include this feature as the primary means of deployment (like Cisco Meraki or Cisco SD-WAN solution), others offer it as a secondary way of installation and configuration (Nexus, IOS-XE...).
The installation of new (unconfigured) devices is part of a process that should be well defined and documented. For example, consider how will a newly-employed technician learn how to provision a new switch?
Let's move now to the maintenance and operation phases. Which previous tasks are included?
The only step unique to ZTP is initial device reachability... and because we must develop a process for the entire lifecycle management of the device anyway, we should avoid duplicate effort and focus only on the first step: once a device is online and reachable, we can start the regular lifecycle management process.
upgrading the firmware after the initial provisioning (operation).
What if we just make the device reachable during the provisioning phase and we leave everything else to the operation phase? We should, at least, evaluate pros and cons of both approaches within our team.
Again, before starting with a technology, be sure you understand the big picture.
To illustrate the above concepts, let's see how ZTP works in Cisco Nexus switches. When a NX-OS switch boots, the POAP (PowerOn Auto Provisioning) process tries to download a Python script via TFTP. The script can be used to automatically install the right NX-OS version and configure the whole switch. Cisco provides an official customizable script, but as always there are many alternatives.
POAP works only for Cisco Nexus switches.
Reviewing a simple POAP script we realize that's not so simple and it's valid only for NX-OS switches.
Using POAP just to make the device reachable simplifies the development and the maintenance of the auto provisioning script... and as discussed above you have deploy tools to deal with device configurations and firmware upgrade anyway, so don't cram those operations into POAP script.
POAP and Ansible integration: short posts about integration of POAP in Ansible.
Cisco Nexus 9K POAP Scripts: GitHub repository of Cisco Nexus 9K POAP Scripts, including docs.
Automating with NX-OS: slides from Cisco Live explaining how automate Cisco Nexus devices.
Cisco IOS-XE (and Cisco IOS) based devices try to automatically download a configuration file during the first boot. This feature is called AutoInstall and it's simple: when a IOS device boots, the AutoInstall process tries to download a the configuration via TFTP. This behavior can be disabled with: no service config.
If a custom TFTP server is used, the configuration provided to the device can be built with information gathered from DHCP Server (looking up the MAC address from the IP address) and from CMDB/IPAM (looking up the static management address for the device).
Latest releases of Cisco Catalyst 9k implements a ZTP process using Python 3.0 . The idea is similar to POAP scripts on Cisco Nexus, but the implementation is different, so you can't reuse your POAP scripts on Catalyst 9k.
Zero Touch Provisioning DIY Tutorial: an interesting tutorial about a custom TFTP server provisioning configurations to IOS/IOS-XE devices via AutoInstall.
Zero-Touch Provisioning on Catalyst 9000: how automate Cisco Catalyst 9000 series using ZTP.
When Andrea is not writing about network automation tools he's busy automating Cisco ACI environments. To learn more about what he's doing, and whether he might be able to help you doing something similar, contact him through email, LinkedIn or on Twitter.