Secure Zero Touch Provisioning

(SZTP) with Cisco Catalyst Switches

Story DeWeese, Technical Marketing

@StoryDeWeese
DEVNET-1249

-
 • Secure ZTP Demo
• Intro to Programmability &
Automation
• What is ZTP?
• Classic ZTP
• Classic ZTP vs Secure ZTP
• Certificate Generation
• YANG Models
• Resources

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 2
 Secure ZTP
Demo

-
 Secure Boot

As a new employee, you receive company

equipment such as a laptop, which needs to
perform secure boot. This prevents any
unauthorized applications from accessing the
device.

Now, we will use the same principles with

Secure ZTP to onboard our Catalyst devices

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 4
-
 Intro to
Programmability
& Automation

-
 Programmability Solutions for Complex Networks

Efficient Consistent Scalable Secure Seamless Smart

Managing Repeatable Reduce time and Secure APIs Create value Real time event
infrastructure and precise effort with large and integrations integrating with 3rd notifications, AI/ML
as code while intent-based network automation party platforms capabilities, and
lowering OPEX outcomes requirements streaming telemetry

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 8
 Cisco IOS XE Programmability & Automation
Lifecycle

Day 0

Day N Day 1

Day 2

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 9
 Cisco IOS XE Programmability & Automation
Lifecycle

I just received 5000

switches. How can I
Day 0 onboard them reliably,
efficiently and at scale?

Day N Day 1

Day 2
Network
Engineer

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 10
 Cisco IOS XE Programmability & Automation
Lifecycle
Pre-boot Execution Provisioning
Environment (iPXE) Automation Device
Onboarding
RFC8572 Secure Zero Nice! All 5000 switches are
Touch Provisioning ZTP onboarded using Secure
Day 0 Zero Touch Provisioning
VM Automation

Day N Day 1

Day 2
Network
Engineer

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 11
 Cisco IOS XE Programmability & Automation
Lifecycle

Day 0

Now that the 5000 new

switches are onboarded,
how can I configure them
reliably, efficiently and at
Day N Day 1
scale?

Day 2

Network
Engineer
-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 12
 Cisco IOS XE Programmability & Automation
Lifecycle Network Configuration Protocol
Model Driven
(NETCONF), RESTCONF, gNMI
Programmability

YANG “native” Data Models,

OpenConfig,
Day 0
YANG Suite, Terraform, Ansible,
I can use a tooling such Device
pyATS tooling
as Ansible or Terraform Configuration
to configure my 5000
switches at once
Day N Day 1

Day 2

Network
Engineer
-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 13
 Cisco IOS XE Programmability & Automation
Lifecycle

Day 0

Now that the 5000 new

switches are configured,
how can I monitor them
reliably, efficiently and at
Day N Day 1
scale?

Day 2

Network
Engineer
-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 14
 Cisco IOS XE Programmability & Automation
Lifecycle

Day 0

I’ll use gRPC for Model

Driven Telemetry to
monitor changes on my
device and quickly find any
Day N Day 1
anomalies

Day 2 TIG_MDT container + guide

Model Driven
Telemetry YANG On-Change support
Device
Monitoring gRPC Dial-Out + DNS + mTLS
Network
Engineer gNMI/NETCONF Dial-In

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 15
 Cisco IOS XE Programmability & Automation
Lifecycle

How can I update the

OS version on all 5000
Day 0 switches them reliably,
efficiently and at scale?

Day N Day 1

Day 2
Network
Engineer

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 16
 Cisco IOS XE Programmability & Automation
Lifecycle

I’ll update the OS on

all 5000 of my
Day 0 switches using
scripting and gNOI
[Link]

Day N Day 1

gNOI cert/os/reset proto

Device
Optimization
Guest Shell + Python/NETCONF
Day 2
CentOS 8 Python 3 Software Image Network
Application Hosting with Docker
Management
Engineer

“show run” CLI to YANG

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 17
 Cisco IOS XE Programmability & Automation
Lifecycle

Whew! Now that

programmability has me
Day 0 covered, I can focus on
the important stuff!

Day N Day 1

Day 2
Network
Engineer

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 18
 Cisco IOS XE Programmability & Automation
Lifecycle
Pre-boot Execution Network Configuration Protocol
Provisioning Model Driven
Environment (iPXE) (NETCONF), RESTCONF, gNMI
Automation Device Programmability
Onboarding
RFC8572 Secure Zero YANG “native” Data Models,
Touch Provisioning ZTP OpenConfig,
Day 0
VM Automation YANG Suite, Terraform, Ansible,
Device
pyATS tooling
Configuration

Day N Intent-based Day 1

Network Infrastructure

gNOI cert/os/reset proto

Device
Optimization
Guest Shell + Python/NETCONF
Day 2 TIG_MDT container + guide
CentOS 8 Python 3 Software Image Model Driven
Management Telemetry YANG On-Change support
Application Hosting with Docker Device
Monitoring gRPC Dial-Out + DNS + mTLS
“show run” CLI to YANG
gNMI/NETCONF Dial-In

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 19
 Programmable Interfaces
CLI
The NETCONF, RETCONF and gNMI are programmatic interfaces that provide additional
SNMP
methods for interfacing with the IOS XE device – Just like the CLI, SNMP, and WebUI is
used for configuration changes and operational metrics so can the programmatic interfaces
WebUI of NETCONF, RESTCONF and gNMI
NETCONF RESTCONF gNMI
YANG data models define the data
that is available for configuration YANG Data Models
and streaming telemetry
OpenConfig Cisco Native
Intent-based
Network Infrastructure
Configuration and Operation

Device Features
SNMP
Interface BGP QoS ACL …

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 20
 Cisco IOS XE - YANG model API documentation
• There are 10 types of data models
including config, oper, actions, and
deviations
• RFC 7950 YANG data modelling language
are the API definitions for IOS XE
• The YANG modules are available for
download from the API and are also
published on [Link]
• Notable modules are listed below for the
running-config, feature oper, actions and
event notifications

The YANG models are available for download directly from the running
IOS XE device’s NETCONF, RESTCONF, or gNMI API, and from:
[Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 21
 What is ZTP?

-
 Linux Shell Environment on Cisco IOS XE devices

Cisco IOS XE devices can access the

on-box Guest Shell using API calls
Linux
applications
This Linux shell can be used for
• Scripting
Guest Shell
• Hosting Applications
• Zero Touch Provisioning Open Application Container
• & so much more! API

Cisco IOS XE

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 23
 Day 0 - Classic ZTP Overview
The Day 0 ZTP features are used to automatically configure and provision network devices
1. When an IOS XE device
boots and no
configuration is present,
the device will issue a
DHCP request on the
management port and
on the front panel port.
2. If the DHCP response
contains option 67 then
ZTP is initiated and the
device will retrieve and Intent- based
Network Infrastructure
execute the python Guest Shell
script from within the
(CentOS 8)

Guest Shell Python / YANG / CLI / EEM APIs

3. Guest Shell is started

and networking is IOS XE
automatically configured

[Link]
[Link]
[Link]
Secure ZTP blog [Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 24
 FYI

Python API between Guest Shell and Cisco IOS XE

Each Python module below takes a Cisco IOS XE command as an argument
Function Description
[Link](command) runs the command through the IOS parser and returns the resulting text.

[Link](command) runs the command through the IOS parser and prints the resulting text
to stdout (rather than returning it).
[Link](command) executes a single EXEC command and returns the output. No semicolons or
newlines are allowed as part of this command. Use a Python list with a for-loop to
execute this function more than once.
[Link](command) executes a single EXEC command and prints the resulting text to stdout (rather than
returning it). No semicolons or newlines are allowed as part of this command. Use a
Python list with a for-loop to execute this function more than once.
[Link](command) configures the device and returns a list of named tuples that contains the command
and its result
[Link](command) configures the device and prints a list of named tuples that contains the command
and its result to stdout (rather than returning it).

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 25
 ZTP Example using Python Modules

[Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 26
 NETCONF API
The NETCONF interface on Cisco IOS XE is accessible from
within the Guest Shell, which can be used at Day 0. No
interface configuration or connectivity is required.

The ncclient Python library can be used to connect to the

NETCONF interface when there is no IP connectivity, similar to
the Python CLI modules and API. This can be used by ZTP at
Day 0 to programmatically configure the device using either
CLI or YANG.

NETCONF API
CLI API
Preform RPC Actions
ZTP Enable NETCONF
Enable AAA Programmatic Configuration
of device features

Authentication from Guest Shell to NETCONF is still required, both credentials and certificates are supported
get_hostname.py example at [Link]
[Link] example at. [Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 27
 ZTP customer use case – code samples
[Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 28
 Classic ZTP

-
 Summary ZTP Workflow
3. Trigger ZTP
1. DHCP Option 67
using the following commands
$ cat /etc/dhcp/[Link]
Device# write erase
# ZTP option 67 example Device# reload
option bootfile-name "[Link]
# *** This maps to /var/www/html/[Link]

2. [Link] File 4. Success

$ cat /var/www/html/[Link] $ ping [Link]
From [Link] icmp_seq=261 Destination Host Unreachable
64 bytes from [Link]: icmp_seq=262 ttl=254 time=15.8 ms
hostname = 'c9300-pod22'
[Link](['hostname {}'.format(hostname)])

[Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 30
 Option 67 [Link]
$ cat /etc/dhcp/[Link]
default-lease-time 600;
max-lease-time 7200;
ddns-update-style none;
authoritative;

# Pod Network
# interface has IP 10.1.1.x • ZTP requires DHCP option
subnet [Link] netmask [Link] {
range [Link] [Link];
67 to be configured
option domain-name "[Link]"; • Configure DHCP option 67
option domain-name-servers [Link];
option subnet-mask [Link]; using “option bootfile-
option broadcast-address [Link];
option routers [Link]; name” and specify where
option ntp-servers [Link];
default-lease-time 600000;
the Python bootfile can be
max-lease-time 720000; found
# ZTP option 67 example
option bootfile-name "[Link]
# *** This maps to /var/www/html/[Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 31
 [Link] example
$ cat /var/www/html/[Link]

hostname = 'c9300-pod22'
[Link](['hostname {}'.format(hostname)])
ID = hostname[-2:]
vlan_num = str(int(ID) + 20)
[Link](["vlan " + vlan_num, "end"])
[Link](["int vlan 1", "no ip address", "end"])
[Link](["int vlan " + vlan_num, "ip address [Link] [Link]", "end"])
Python file
[Link](["int range gi1/0/1 - 24", "switchport access vlan " + vlan_num, "end"])
[Link](["ip route [Link] [Link] [Link]", "end"])
containing
# AAA
[Link](["username admin privilege 15 secret 0 Cisco123"])
configuration
[Link](["aaa new-model", "aaa authentication login default local", "end"])
[Link](["aaa authorisation exec default local", "aaa session-id common", "end"])
to apply to
# TCP settings
[Link](["ip tftp blocksize 8192", "end"])
device
[Link](["ip tcp window-size 65535", "end"])
[Link](["ip http client source-interface GigabitEthernet1/0/24", "end"])
# Create loopback0
[Link](["interface Loopback0", "ip address [Link] [Link]", "end"])
# Enable NETCONF-YANG API
[Link](["netconf-yang", "end"])
# NETCONF from Guestshell
#[Link](["netconf-yang ssh local-vrf guestshell enable", "end"])
# Enable gNMI secure API
#[Link](["gnxi", "gnxi secure-init", "gnxi secure-server", "end"])

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 32
 Trigger ZTP with ‘write erase’ & ‘reload’
Switch# write erase
************************************************************************************************************
Erasing Nvram will not clear license trust code.
************************************************************************************************************
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]
[OK]
Erase of nvram: complete
*Dec 5 00:49:05.790: %SYS-7-NV_BLOCK_INIT: Initialised the geometry of nvram
Switch# reload

System configuration has been modified. Save? [yes/no]: no

Reload command is being issued on Active unit, this will reload the whole stack
Proceed with reload? [confirm]

*Dec 5 00:49:16.278: %SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload Command.
Chassis 1 reloading, reason - Reload command

<snip>
No startup-config, starting autoinstall/pnp/ztp...

Autoinstall will terminate if any input is detected on console

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 33
 Verify [Link] Successfully ran
From [Link] icmp_seq=255 Destination Host Unreachable
From [Link] icmp_seq=256 Destination Host Unreachable
From [Link] icmp_seq=257 Destination Host Unreachable
From [Link] icmp_seq=258 Destination Host Unreachable Once the
From [Link] icmp_seq=259 Destination Host Unreachable
From [Link] icmp_seq=260 Destination Host Unreachable
device is
From [Link] icmp_seq=261 Destination Host Unreachable reachable,
64 bytes from [Link]: icmp_seq=262 ttl=254 time=15.8 ms the ZTP
64 bytes from [Link]: icmp_seq=263 ttl=254 time=0.919 ms process has
64 bytes from [Link]: icmp_seq=264 ttl=254 time=0.807 ms
64 bytes from [Link]: icmp_seq=265 ttl=254 time=0.639 ms been
64 bytes from [Link]: icmp_seq=266 ttl=254 time=0.764 ms successfully
64 bytes from [Link]: icmp_seq=267 ttl=254 time=0.772 ms completed!
64 bytes from [Link]: icmp_seq=268 ttl=254 time=2.58 ms
64 bytes from [Link]: icmp_seq=269 ttl=254 time=0.669 ms
64 bytes from [Link]: icmp_seq=270 ttl=254 time=0.788 ms

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 34
 Classic ZTP vs
Secure ZTP
(RFC8572)

-
 Admin Setup Workflow
1 Order 5000 new switches

Receive 5000 new switches

2 with serial numbers for each Day 0 SZTP onboarding complete!
F01 F02 F03

Devices onboard using OV

3 Add each serial number 6 with its serial number
(+PDC) to MASA

Generate OV per device from

4 MASA
OV1 OV2 OV3

Put OVs into bootstrapping

5 service

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 36
 SZTP Overview Cisco MASA Server

DHCP Server

Restconf Server

1 TLS Handshake, SUDI Certificate

Database/ Web Server
(Artifacts)
Server Certificate

Owner Certificate
Cisco IOS-XE Get Bootstrapping Data | Signed-data-preferred
Conveyed Information

TAm
OC | OV | Redirect Info | Trust Anchor
2 Network Admin
Get Bootstrapping Data | Without signed-data-preferred

Bootstrapping Artifacts:

SUDI
3 •
•
•
Ownership Voucher
Owner Certificate
Onboarding Information
SUDI
SUDI
Certificate Private Key Public Key

SZTP/Bootstrap Server

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 38
 17.11
RFC8572 Secure ZTP
RFC details: [Link]
1. Conveyed Information: used to encode the redirect information and onboarding information (switch config)
2. Ownership Certificate: used by a device to verify the signature over the conveyed information
3. Ownership Voucher: used to verify a device owner as defined by the manufacturer (from the MASA)

Classic Zero Touch Provisioning Secure

SecureZero Touch
Zero Touch Provisioning
Provisioning RFC8572 (2019)
Device
Turn on
DHCP Server
DHCP Discovery Bootstrapping
(RESTCONF)
Option 143 (136), URL List Server
TLS Handshake; SUDI Client Certificate Validate client
Server Certificate using SUDI

get- bootstrapping- data using YANG- modeled RPC POST Request

Bootstrapping Artifacts:
• Ownership Voucher
• Owner Certificate
• Conveyed Information

Some security requirements for classic ZTP are resolved using Secure ZTP:
Validate Server

Update Image Information

• Management system needs to validate the device Ownership Ownership
Configuration Scripts
Conveyed
• Device needs to validate the server Device Trust
Anchor
Voucher Certificate Information NETCONF Configuration
(RFC 8366)
• Device must validate the data is what server sent
Encoded Redirect Traffic
and Onboarding
Information Guestshell

As part of the SZTP RFC, the device supports image upgrade as part of the conveyed information

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 39
 Classic vs Secure ZTP Example Output
Classic ZTP Secure ZTP
Acquired IPv4 address [Link] on Interface Vlan1 Acquired IPv4 address [Link] on Interface
GigabitEthernet0/0
Received following DHCPv4 options:
Received following DHCPv4 options:
domain-name : ios-xe-programmability-
[Link] bootstrap-server-list : [Link]

bootfile : [Link]

dns-server-ip : [Link]

si-addr : [Link]

See additional info here: [Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 40
 Workflows
Secure Zero Touch Provisioning RFC8572 (2019)
Device
Turn on
Single bootstrap DHCP Server
server without DHCP Discovery Bootstrapping
(RESTCONF)
validation. Option 143 (136), URL List Server
TLS Handshake; SUDI Client Certificate Validate client
Redirect to Server Certificate using SUDI
bootstrap server get- bootstrapping- data using YANG- modeled RPC POST Request
with trust anchor
Bootstrapping Artifacts:
validation. • Ownership Voucher
• Owner Certificate
• Conveyed Information
Validate Server

Update Image Information

Configuration Scripts
Ownership Ownership Conveyed
Device Trust Certificate NETCONF Configuration
Voucher Information
Anchor (RFC 8366) Encoded Redirect Traffic
and Onboarding
Information Guestshell

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 41
 Bootstrapping Server
The bootstrapping
server is a RESTCONF
server where all the
bootstrapping data is
located including the
Conveyed Information,
Ownership Voucher,
and Ownership
Certificate.

Note: a detailed guide on how to setup a bootstrapping server and what needs to be included on it
can be found here: [Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 42
 Trust Anchor
The Trust Anchor is
also known as the
SUDI certificate burnt
into the device during
manufacturing. This
certificate is validated
using the
manufacturer-provided
What makes SZTP secure? public certificate to
validate that the device
Trust Anchor = SUDI Cert authenticity.

Use case: if switch & artifacts were stolen, Certificate Authority can see
Serial Number is marked as stolen & we can prevent SZTP from
working

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 43
 Ownership Voucher, Ownership Certificate and
Conveyed Information
The Ownership
Voucher, Ownership
Certificate and
Conveyed information
is provided by the
bootstrapping server

Provided by Bootstrapping server

RFC details: [Link]

1. Conveyed Information: used to encode the redirect information and onboarding information (switch config)
2. Ownership Certificate: used by a device to verify the signature over the conveyed information
3. Ownership Voucher: used to verify a device owner as defined by the manufacturer (from the MASA)

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 44
 Ownership Voucher (OV)
The Ownership Voucher,
provided by the
bootstrapping server,
verifies the identity of the
device owner. To generate
Generated from MASA
this, the customer must
provide a pinned-domain-
cert and the serial number
of the device to the MASA
Example Voucher Provided by MASA server.

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 45
 Ownership Certificate (OC)

The Ownership Certificate,

provided by the bootstrapping
server, binds an owner identity
to a public key. This can be
The admin creates the OC and adds it to the bootstrapping used to validate the signature
server before the onboarding process begins. of the conveyed information.
Using the pinned-domain certificate to sign the OC creates a
layer of PKI security

Example of how to create OC:

openssl ecparam -out [Link] -name prime256v1 -genkey
openssl req -new -sha256 -key [Link] -out [Link]
openssl x509 -req -in [Link] -CA [Link] -CAkey [Link] -CAcreateserial -out [Link] -days 365 –sha256

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 46
 Conveyed Information
The Conveyed Information,
provided by the bootstrapping
server, includes the scripts and
binary files that are needed for
the onboarding process. This
includes pre-configuration
scripts, the zero-touch
provisioning Python file as well
as post-configuration scripts.
This can also include a binary file
if devices require an upgrade.

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 47
 Image upgrade
{
"ietf-sztp-conveyed-info:onboarding-information" : {
"boot-image" : {
"os-name" : ”CiscoIOSXE",
"os-version" : "17.16.1",
"download-uri" : [ [Link] ],
"image-verification" : [
{
"hash-algorithm" : "ietf-sztp-conveyed-info:sha-256",
"hash-value" : "ba:ec:cf:a5:67:82:b4:10:77:c6:67:a6:22:ab:\
7d:50:04:a7:8b:8f:0e:db:02:8b:f4:75:55:fb:c1:13:b2:33"
}
]
},
"configuration-handling" : "merge",
"pre-configuration-script" : "base64encodedvalue==",
"configuration" : "base64encodedvalue==",
"post-configuration-script" : "base64encodedvalue=="
}
}

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 48
 Conveyed Information
Pre-Config Post-Config
import subprocess import datetime

import datetime with open('/bootflash/guest-share/post-

[Link]', 'w') as f:
with open('/bootflash/guest-share/pre-
[Link]', 'w') as f: [Link]('This file was created by the
post-configuration script\n')
[Link]('This file was created by the
pre-configuration script\n') now = [Link]()

now = [Link]() [Link]('Current time: ' + str(now))

[Link]('Current time: ' + str(now))

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 49
 Reference
Examples to set DHCP option 143
Once the device starts in the auto-install mode, the DHCP will be started automatically and if the
DHCP server sends Option 143, SZTP will be executed. No device configuration is needed.

DHCPv4 DHCPv4 or DHCPv6

Configure the generic option under DHCP address pool. Use open-source ISC-DHCP server and configure it to send option 143.
Refer to RFC8572, Section 8 for DHCP Options to configure
a valid option 143

ip dhcp pool SZTP-POOL

option 143 instance <instance-number> hex <option-data>

Cisco DHCP Guide:

[Link]
xml/ios/ipaddr_dhcp/configuration/15-sy/dhcp-15-sy-book/config-dhcp-
[Link]#GUID-A7226CF3-66F5-46C3-B901-C94CAAB2FCDD

Same DHCP infra workflow as classic ZTP: set the DHCP option to point to the server

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 50
 Logs for SZTP
The SZTP bootstrapping server can report progress of the status of SZTP
Using the report-progress within the YANG Model
/restconf/operations/ietf-sztp-bootstrap-server:report-progress\

<input
xmlns="urn:ietf:params:xml:ns:yang:ietf-sztp-bootstrap-server">
<progress-type>bootstrap-complete</progress-type>
<message>example message</message>
<ssh-host-keys>
<ssh-host-key>
<algorithm>ssh-rsa</algorithm>
<key-data>base64encodedvalue==</key-data>
</ssh-host-key>
<ssh-host-key>
<algorithm>rsa-sha2-256</algorithm>
<key-data>base64encodedvalue==</key-data>
</ssh-host-key>
</ssh-host-keys>
<trust-anchor-certs>
<trust-anchor-cert>base64encodedvalue==</trust-anchor-cert>
</trust-anchor-certs>
</input>

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 51
 Day 0 device onboarding workflow
Q. What happens when multiple Day 0
DHCP options are presented to the device?
Is option 43 (Catalyst
Center PNP) or 143 A. 43/143 -> 67/150 -> TFTP Broadcast
(Secure ZTP) configured? If 43/143 fails for any reason, then 67/150
will be tried

Is options 67 (Classic
Use Secure Option
ZTP) or 150 (TFTP
(preferred)
list) configured?

Day 0 Workflow:
1. Secure options are preferred: 43
(DNAC PNP) and 143 (Secure ZTP)
If unsuccessful, attempt secure
option for a total of 4 retries before Use Legacy DHCP
moving to the next option Use Classic Option auto-install with
2. Classic ZTP using options 67 or 150
3. Legacy DHCP auto-install with TFTP TFTP broadcast
broadcast

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 52
 Certificate
Generation

-
 If we need this… Cisco MASA Server

DHCP Server

Restconf Server

1 TLS Handshake, SUDI Certificate

Database/ Web Server
(Artifacts)
Server Certificate

Owner Certificate
Cisco IOS-XE Get Bootstrapping Data | Signed-data-preferred
Conveyed Information

TAm
OC | OV | Redirect Info | Trust Anchor
2 Network Admin
Get Bootstrapping Data | Without signed-data-preferred

3 Bootstrapping Artifacts:
•
•
Ownership Voucher
Owner Certificate
• Onboarding Information
SUDI SUDI SUDI
Certificate Private Key Public Key

SZTP/Bootstrap Server

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 54
 Let’s set it up

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 55
 Cisco MASA Server

DHCP Server

Restconf Server

1 TLS Handshake, SUDI Certificate

Database/ Web Server
(Artifacts)
Server Certificate

Owner Certificate
Cisco IOS-XE Get Bootstrapping Data | Signed-data-preferred
Conveyed Information

TAm
OC | OV | Redirect Info | Trust Anchor
2 Network Admin
Get Bootstrapping Data | Without signed-data-preferred

3 Bootstrapping Artifacts:
•
•
Ownership Voucher
Owner Certificate
• Onboarding Information
SUDI SUDI SUDI
Certificate Private Key Public Key

SZTP/Bootstrap Server
-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 56
 Creating Pinned-Domain Certificate (PDC)
# Create pinned-domain-cert (PDC Cert)
openssl ecparam -out [Link] -name prime256v1 -genkey
openssl req -new -sha256 -key [Link] -out [Link]
openssl x509 -req -sha256 -days 365 -in [Link] -signkey [Link] -out [Link]

# Create owner-cert (Owner Cert)

openssl ecparam -out [Link] -name prime256v1 -genkey
openssl req -new -sha256 -key [Link] -out [Link]
openssl x509 -req -in [Link] -CA [Link] -CAkey [Link] -CAcreateserial -out [Link] -days 365 -sha256

The PDC can be created once

PDC is used to sign the owner-certificate
The owner-certificate is used to create vouchers

Using the PDC to sign the OC creates a layer of PKI security

The PDC keys are rarely used, except to sign more ownership certificates
The PDC key may be kept offline to improve security

The ownership certificate key is required to sign the onboarding_data

It it used more frequently so may need to be rotate more often

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 57
 Generate Keys 1
2
1. Run command to create pinned-
domain key
2. Use default values, and set CSR
1. Organization Name
2. CN
3. Email
3. Sign Key
4. Verify the files
5. Add Pinned domain cert & serial
number to MASA
1. Ensure IOS XE is selected
3

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 58
 MASA

-
 MASA and Certificate Signing for OV
(Manufacturer Authorized Signing Authority)

The upstream cloud-based certificate verification

service at [Link] is available to
generate the IOS XE Ownership Voucher (OV)

MASA API Docs: [Link]

Reference XR: [Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 60
 MASA Usage
Before a device can be onboarded with SZTP, a pre-requisite is that the bootstrapping server must contain an Ownership
Voucher (OV). One-time access to MASA is required to generate an OV per device.

Note: MASA access is not required every time a device completes the SZTP process. After an OV is created once by MASA and
added to the bootstrapping server, MASA access is no longer required for the device to complete SZTP multiple times (default expiry
after 1 year).
Q: When do I need to update OV? A: When the pinned-domain-cert is expired or the OV itself expires

2 MASA generates and returns OV to the admin

1 Admin provides PDC & Serial number

MASA
Pinned-domain-cert
Device Serial Number 3 Admin adds OV to bootstrapping server

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 61
 Using MASA
1. On your local device, create a PDC using OpenSSL see an example here
[Link]
signed-ssl-certificate-using-openssl
• openssl req -x509 -newkey rsa:4096 -keyout [Link] -out [Link] -sha256 -
days 365
• Note: A [Link] and [Link] will be created

2. Login to [Link] using CEC credentials

3. Click on the green “New Request” button in the top right corner

4. The Pinned Key Certificate will be the [Link] that was just generated

5. The Serial Number is associated with a single Cisco device

6. For IOS XE, a Platform Key Certificate is not needed

7. Toggle the OS type to IOS XE and note that Platform Key Certificate is grey-ed
out

8. Make any other changes as desired and then request the cert

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 62
 YANG Models

-
 IETF SZTP YANG data model:
get-bootstrapping-data

This YANG model reflects the

bootstrapping data that the
All inputs are optional! bootstrapping server will
provide.

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 64
 IETF SZTP YANG data model outputs
reporting-level

The reporting level is used for

processing onboarding
information and is not sent
when:
1. Processing redirect info
2. The bootstrapping server
is untrusted

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 65
 IETF SZTP YANG data model outputs
conveyed-information

The conveyed information

includes any scripts and binary
files that are needed to
onboard the device
successfully.

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 66
 IETF SZTP YANG data model outputs
ownership-certificate

The ownership certificate

validates the signature of the
conveyed information.

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 67
 IETF SZTP YANG data model outputs
ownership-voucher (OV)

The ownership voucher is used

to ensure that the one trying to
onboard the device is in fact
the owner of the device.

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 68
 IETF SZTP YANG data model: Trust Anchor Certs
Trust Anchor cert must contain:
• The chain of X.509 certs to authenticate cert presented to device
• A single chain of certs, where the last is the issuer for the device’s cert
• A self-signed root cert (can be the same as the issuer cert above)

[Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 69
 Resources

-
 Secure ZTP Blog

[Link]
-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 71
 Secure ZTP Guide
This in-depth SZTP tutorial provides an overview of SZTP with Catalyst devices including the
components needed, how to create them, and the workflows required to prepare a bootstrapping
server.

[Link]
-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 72
 ZTP in Action
Start the hands-on lab for Day 0

write erase
ping
reload

[Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 73
 Open Programmable Infrastructure (OPI) SZTP
Ready to create your own bootstrapping server, consider the OPI one to
get started

[Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 74
 Cisco Catalyst Programmability Sessions at Cisco
Live EMEA 2025
Sunday Feb 9 Monday Feb 10 Tuesday
May 2017
Feb 11 Wednesday
June 2017
Feb 12 Thursday Feb 13

Session Levels: 3:30 PM 10:00 AM 11:30 AM 11:00 AM

Beginner DEVNET-1249 Secure DEVLIT-2062 Getting DEVNET-2385 CISCOU-1043
Intermediate Zero Touch Provisioning Started with Secure Atomic Config Replace Maximizing Cisco IOS XE
(SZTP) with Cisco Zero Touch Provisioning with Cisco Catalyst 9000 Efficiency with YANG
Catalyst Switches Suite
11:00 AM 1:30 PM
DEVLIT-2083 DEVSKL-1110
Automate Cisco IOS XE Configure IOS XE Using
Device Configuration the CLI
Using Terraform
2:30 PM
2:00 PM
DEVSKL-1111
DEVWKS-2008 Configure IOS XE Using
Automation
NetDevOps 3,2,1,
Action! Reduce the
Attack Surface of IOS XE
with Ansible

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 75
 Programmability Website
The one-stop-shop for Cisco IOS XE Programmability resources including videos, white papers, labs and more!

• Community Forum
• IOS XE FAQ
• White Papers
• Code Exchange
• IOS XE Docs & Guide
• Learning Tracks and Labs
• Sandboxes
• … and more !

[Link]
-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 76
 Cisco YANG Suite

YANG API Testing and Validation Environment

Construct and test YANG based APIs over

NETCONF, RESTCONF, gRPC and gNMI
[Link]/yangsuite
IOS XE / IOS XR / NX OS platforms
Get hands-on using the new learning lab! [Link]/CiscoDevNet/yangsuite
[Link]
Docker container innovation 1 container

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 77
 [Link]

API White Paper

Website: [Link]
PDF: [Link]
Webinar with live demos & examples: [Link]
[Link]
-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 78
 Model Drive Telemetry (MDT) White Paper
The Model Driven Telemetry White Paper includes examples, use cases and tooling related to telemetry.
This paper is now available online and in PDF form!

Website

PDF

View online: [Link]

View as PDF: [Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 79
 dCloud Programmability
[Link]
“Cisco Catalyst 9000 IOS XE Programmability & Automation Lab v1”
[Link]

Model Driven Telemetry

Use Cases: Telemetry configuration with CLI and YANG Suite
EVPN: Collection with TIG_MDT container and tooling
Ansible with CLI deployment of EVPN solutions
EVPN management over RESTCONF/YANG with
Postman YANG Programmability
Declarative EVPN fabric management with Terraform YANG Suite tooling and integrations to YANG API’s
Ansible integrations

Tooling and Integrations Ubuntu VM Details:

YANG Suite Syslog receiver from all switches
• NETCONF/RESTCONF/gNMI API TFTP config backup
• Ansible integration See slide
• NETCONF/gNMI Dial-In Telemetry
• gRPC Dial-Out Telemetry receiver
Windows VM Details
Telemetry VS Code
• TIG stack in Docker Terraform @ folder
• Grafana dashboard for device health Ansible @ folder VLAN1
c9k-spine
Chrome browser IP: [Link]
Postman / RESTCONF YANG Suite, Grafana developer / C1sco12345
• EVPN fabric API calls Bash/PS/Cmd shells c9k-leaf1
SSH into C9K or Ubuntu IP: [Link]
Terraform/RESTCONF developer / C1sco12345
Postman c9k-leaf2
• Declarative EVPN fabric management Workspace for EVPN IP: [Link]
developer / C1sco12345
Ansible c9kvdd-1 - unconfigured
C9K VM’s
• EVPN solution enablement using CLI
c9kvdd-7 - unconfigured

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 80
 Cisco IOS XE - Reservable Virtual Sandbox
This DevNet reservable sandbox has IOS XRv + N9Kv + IOS XE
The Catalyst 8000V within the DevBox is enabled for Day 0/ZTP usecases

[Link]
“IOS XE on Cat8kv”
[Link]

The “Enterprise Networking” Learning Labs contains guides for the supported usecases
[Link]

Sandbox Capabilities:
TIG_MDT Telemetry
YANG Suite API
Terraform + Ansible
ZTP & Guest Shell
… and more

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 81
 Cisco IOS XE - Always On Virtual Sandbox
The “IOS XE on Cat8kv Always On” virtual sandbox requires no reservation
The c8kv can be accessed with SSH, NETCONF, and RESTCONF
Hostname: [Link]
Username: admin Password: C1sco12345
SSH port 22, NETCONF port 830, RESTCONF HTTPS
[Link]
[Link]
[Link]
The “Enterprise Networking” Learning Labs contains guides for the supported usecases
[Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 82
 Cisco University (Cisco U) part of L&D
[Link]
[Link]

Direct link to Tutorial, requires login to [Link] first:

1. [Link]
2. [Link]
3. [Link]
4. [Link]

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 83
 Webex App
Questions?
Use the Webex app to chat with the speaker
after the session

How
1 Find this session in the Cisco Events mobile app

2 Click “Join the Discussion”

3 Install the Webex app or go directly to the Webex space

4 Enter messages/questions in the Webex space

Webex spaces will be moderated

by the speaker until February 28, 2025.

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 84
 Fill Out Your Session Surveys

Participants who fill out a minimum of 4 session

surveys and the overall event survey will get a
unique Cisco Live t-shirt.
(from 11:30 on Thursday, while supplies last)

All surveys can be taken in the Cisco Events

mobile app or by logging in to the Session Catalog
and clicking the ‘Participant Dashboard’

Content Catalog

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 85
 • Visit the Cisco Showcase
for related demos

• Book your one-on-one

Meet the Engineer meeting

Continue • Attend the interactive education

your education with DevNet, Capture the Flag,

and Walk-in Labs

• Visit the On-Demand Library

for more sessions at
[Link]/on-demand.
Sessions from this event will be
available from March 3.

-
DEVNET-1249 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 86
 Thank you

-
-