Add an On-Premise Spoke Site with Next Generation Firewall and LAN Capabilities

Site Name

Enter a unique name for the firewall site. You can use alphanumeric characters and hyphen (-); the maximum length is 32 characters.

Site Capabilities

LAN Capabilities

Select the LAN capability as LAN for the site.

Street Address

Enter the street address of the site.

State/Province

Select the state or province where the site is located.

Country

Select the country where the site is located.

You can click the Validate button to verify the address that you specified:

• The site address verification successful message is displayed if the address can be verified. You can click the View location on a map link to see the address location.

• If the address cannot be verified, the Site address could not be validated message is displayed .

Email

Enter the e-mail address of the contact person for the site.

Advanced Configuration

NTP Server

Enter the fully qualified domain names (FQDNs) or IP addresses of one or more NTP servers. Example: ntp.example.net The site must have DNS reachability to resolve the FQDN during site configuration.

Serial Number

Enter the serial number of the firewall device. Note that the serial numbers are case-sensitive.

Activation Code

If the Auto Activate feature is disabled, enter the activation code to manually activate the device. The activation code is provided by the administrator who adds the site.

Boot Image

When the Zero Touch Provisioning field is enabled, select the boot image from the drop-down list to upgrade the image on the firewall device to a version that supports Phone-Home client.

The boot image is the device image that was previously uploaded to the image management system. The boot image is used to upgrade the device when the CSO starts the ZTP process. If the boot image is not provided, then the device skips the automatic upgrade procedure. The boot image is populated based on the device template that you have selected while creating a site.

By default, the Use Image on Device option is selected.

Firewall Policies

Select the firewall policy that you want to deploy to the standalone firewall site. The firewall policy list is populated from the Configuration > Firewall > Firewall Policy page.

Default: Factory_Default_Fw_Policy

Import Configuration

Click the toggle button to automatically import firewall policies and NAT policies from a next generation firewall device to CSO. By default, this field is disabled.

Note: This field is available only when Zero Touch Provisioning is disabled.

Configuration Templates List

Select one or more configuration templates from the list. This list is filtered based on the device that you select.

Configuration templates are stage-2 templates that are added by your OpCo administrators or SP administrators or Tenant administrators.

Note: You must set the parameters of the configuration templates that you have selected before you move to the LAN section.

Procedure

1. After you select one or more configuration templates, click Set Parameters.

   The Device Configurations page appears. This page consists of two tabs—Configure and Summary

2. In the Configure tab fill in the attributes for each of the configuration templates.

   (Optional) View the CLI commands in the Summary tab.

3. Click OK.

   You have added and set the parameters for the configuration templates that are part of the site template that you are creating.

Switch Devices

Displays the switches that you have added to the site.

• To add a switch, click the + icon on the top right corner of the Switch Devices table. You can add multiple switches only to an SD-LAN site.

  The Add New Switch page appears. See Table 60 for details.

• To edit details of a switch, select the switch and click the Edit icon on the top right corner of the Switch Devices table. The Edit Switch Details page appears, displaying the same parameters that you configured while adding a switch.

  Modify the parameters as needed and Click OK. The changes that you made for the switch are saved and the updated parameters appear on the Switch Devices table.

• To delete one or more switches, select the switches and click the Delete icon on the top right corner of the Switch Devices table.

• To manage the configuration of one or more switches added to the site, select the switches from the list and click Configuration.

  The Switch Configuration page appears. See Table 62 for details.

Device Profile

Device Type

Select the type of switch—EX2300, EX3400, EX4300, EX4600, and EX4650.

CPE Settings

Switch Management Subnet

Specify the subnet that the DHCP can use to assign IP addresses. The DHCP server runs on the following ports:

• Trunk ports to provide DHCP information to all devices connected to the switch and to the in-band management port, switch management port, and LAN ports on the CPE.

• Out-of-band management port on the CPE to provide DHCP information to the management port on the switch.

• LAN ports on the CPE to provide information to the devices connected to the CPE LAN ports.

Example: 192.0.2.0/24

Virtual Chassis

This toggle button is disabled for a site with NGFW and LAN capabilities.

You can add a Virtual Chassis only to an SD-LAN site.

Auto Activate

Click the toggle button to enable or disable automatic activation of the switch. When you enable this field, zero-touch provisioning of the switch is automatically triggered when the device communicates with CSO.

Note: You must physically connect the switch to the CPE device (firewall) and power it on for the switch to be automatically activated when you enable this option.

Zero Touch Provisioning

Click the toggle button to enable or disable zero-touch provisioning (ZTP) of the switch through ZTP.

If you disable ZTP, you must manually copy and paste the Stage-1 configuration on the switch during site activation. See Step-by-Step Procedure for details.

Note:

• Only EX Series switches running 18.4R2.7 or 18.4R3.3 firmware support ZTP.

• EX4600 and EX4650 switches do not support Phone-Home client. You must disable ZTP and manually configure the stage-1 configuration on the switches.

Access Profiles

Displays the list of access profiles available in CSO. The list is populated from the Access Profiles page (Configuration > SD-LAN > Access Profiles).

You can also click the Search icon to search for a specific access profile in the list.

For details of the fields displayed on the Access Profiles table, see About the Access Profiles Page.

Optional: You can select an access profile from the list to assign it to the switch.

Configuration Templates

Displays the list of configuration templates. This list is filtered based on the device that you select.

Configuration templates are predefined stage-2 templates that are added by your OpCo administrators or SP administrators.

Procedure

1. After you select one or more configuration templates, click Set Parameters.

   The Device Configurations page appears. This page consists of two tabs—Configure and Summary

2. In the Configure tab fill in the attributes for each of the configuration templates.
3. (Optional) View the CLI commands in the Summary tab.
4. Click OK.

   You have added and set the parameters for the configuration templates.

Add LAN Segment

VLAN ID

Enter the VLAN ID for the LAN segment.

Range: 2 through 4093

DHCP

For directly connected LAN segments, click the toggle button to enable DHCP. DHCP is disabled by default.

You enable DHCP if you want to assign IP addresses by using a DHCP server. You disable DHCP if you want to assign a static IP address to the LAN segment.

Note: If you enable DHCP, fields related to DHCP-related parameters appear and must be configured.

Address Range Low

Enter the starting IP address in the range of IP addresses that can be allocated by the DHCP server to the LAN segment.

Maximum Lease Time

Specify the maximum duration (in seconds) for which a client can request for and hold a lease on a DHCP server.

Range: 0 through 4,294,967,295.