The value in the HREF attribute is used in the follow-up requests to the RESTCONF server, for example, when href=’/restconf_root’ is received, the header for the get-bootstrapping-data RPC is POST /restconf_root/operations/ietf-sztp-bootstrap-server: get-bootstrapping-data HTTP/1.1 The device receives a plain XML file, and the fields in the file are Base64 encoded. The device runs Base64 decoding before extracting the information and attempting to recognize its structure. The decoded structure format can either be JSON or XML. DHCP Options for Secure ZTP DHCP redirect Options 136 (DHCPv6) and 143 (DHCPv4) are supported for Secure ZTP.
These options are used to provision a client with one or more Uniform Resource Identifiers (URIs) for bootstrap servers. A device in the Zero-Touch Provisioning mode carries out a DHCP discovery to find a DHCP server, and to receive the IP address and other information. When the DHCP client receives Options 136 and 143, the Secure ZTP procedures are started, and the Secure ZTP handling functions are invoked. If the Secure ZTP handling functions fail, the handling procedure is repeated indefinitely, until it is either successful, or is interrupted by the user. Bootstrapping Servers A bootstrap server is a RESTCONF server that uses the HTTPS data transport protocol.
A bootstrap server can be a redirect server or an onboarding server. A redirect server sends a list of bootstrapping servers to a device. The device can attempt bootstrapping from any server in the list. Each server entry has a server address, a server port, and a trust anchor (X.509 certificate) that verifies the server’s certificate presented during the TLS handshake. The trust anchor is accepted only if the redirect information is signed, or if the current redirect server is trusted. Otherwise, all the trust anchors received from the redirect server are discarded. An onboarding server is a server that sends the actual bootstrapping data.
The bootstrapping data contains the following types of information: • Required updated image that the device must run: The required version, URLs for downloading the image, and information about how to validate the downloaded image. • Preconfiguration script: A Python script that must be run before the initial device configuration is applied. • Configuration: The initial device configuration. This configuration can be in the Cisco IOS CLI format of a NETCONF edit-config format. • Postconfiguration script: A Python script that must be run after the initial device configuration is applied. A bootstrapping server can be trusted or untrusted.
A trusted server can send bootstrapping data that is not necessarily signed. A trusted server can be demoted into an untrusted server if the server certificate it sends during the TLS handshake fails to validate the server-trust anchor on the device. Zero-Touch Provisioning DHCP Options for Secure ZTP Zero-Touch Provisioning 6