Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Add a Device to Paragon Automation

You must be a superuser or network administrator to adopt or onboard a device (router, switch, or firewall).

A superuser or network administrator can adopt a device [both new devices (greenfield) and devices that are already a part of the network (brownfield device)], and manage the device by using Paragon Automation. When you adopt a device that is not associated with a network implementation plan, you (superuser or network administrator) must manually update configurations by using configuration templates, apply licenses, and upgrade software. However, if you use a network implementation plan to onboard devices, you can make the changes to the network implementation plan and publish the network implementation plan for the changes to take effect on the devices included in the plan. You also obtain the granular metrics about the device’s health and performance by using the network implementation plan to onboard a device.

The status of a device that is already installed and connected to the network, but is not managed by the Paragon Automation appears as Disconnected on the Inventory page (Inventory > Devices > Network Inventory). When you adopt a device, the device connects with Paragon Automation and the status of the device changes to Connected, indicating that the device is managed by Paragon Automation.

You can add a device to Paragon Automation by using any of the following methods:

Before you adopt a device, ensure that:

  • The device can reach the gateway.

    Note:

    If a firewall exists between Paragon Automation and the device, configure the firewall to allow outbound access on TCP ports 443, 2200, 6800, 4189, and 32,767 from the management port of the device.

  • The device can connect to Paragon Automation.

Adopt a Juniper Device

To adopt a device:
  1. Navigate to Inventory > Devices > Network Inventory.

    The Inventory page appears.

  2. On the device-type tab, click Add Device.

    The Add Devices page appears.

  3. To add a Juniper Router, click Adopt Router.
  4. Click Select Site to select the site where the device is installed or to be installed.
    The outbound SSH configuration that is required for the device to establish a connection with Paragon Automation appears in the text box at the bottom of the page.
  5. In the Select IP Version drop-down list, select:

    • IPv4 (default) to use IPv4 address for connecting with Paragon Automation.

    • IPv6 to use IPv6 address for connecting with Paragon Automation.

    Paragon Automation provides the outbound SSH commands to connect with Paragon Automation depending on the IP version you select here.

    Note:

    If Paragon Automation cluster uses IPv6 address, the outbound SSH command always uses IPv6 address irrespective of the IP version you select.

  6. (Optional) If you are using RADIUS for device authentication, enter the IP address of this device.
    Note:

    Ensure that the version of the device IP address that you enter here matches with the version of the RADIUS server IP address that you have configured in Paragon Automation.

  7. Click Copy Cli Commands to copy the CLI commands under Apply the following CLI commands to adopt a Juniper Device if meets the requirements and click OK.

    The outbound SSH command listed depends on the IP version that you select in step 5.

  8. Access the device by using Telnet or SSH and log in to the device in configuration mode.
  9. Paste the contents of the clipboard and commit the configuration on the device.
    The device connects to and is managed by Paragon Automation.
  10. After you adopt a device, you can verify the connectivity status by running the following command on the device:

    An output similar to the following indicates that the device is connected to Paragon Automation:

What's Next

Connect to the Paragon Automation GUI and view the status of device onboarding. After the device status changes to Connected on the Inventory page (Inventory > Devices > Network Inventory), you can start managing the device. See Device Management Workflow.

Adopt a Juniper Device Using ZTP

Prerequisites:

  • A network implementation plan should be configured for the device.

  • The device should be returned to zero or in its factory-default settings.

  • A TFTP server reachable from the device

  • A DHCP server reachable from the device, with the ability to respond to the device with the TFTP server and configuration file (script) name

Figure shows the workflow for adopting device using ZTP.

Figure 1: Workflow for Adopting a Device Using ZTP Workflow for Adopting a Device Using ZTP

The steps for the workflow are as follows:

  1. Create an onboarding script (Python or SLAX) with the required SSH configuration by:

    • Connecting to Paragon Automation GUI and copying the onboarding configuration statements. To copy the onboarding configuration from the Paragon Automation GUI:

      1. Navigate to Inventory > Network Inventory.

      2. On the device-type tab, click Add Device.

      3. On the Adopt Router tab of the Add Devices page, click Select site to select the site where the device is installed.

        The outbound SSH configuration that is required for the device to establish a connection with Paragon Automation is displayed.

      4. Click the Copy Cli Commands link to copy the CLI commands under the Apply the following CLI commands to adopt a Juniper Device if meets the requirements section to clipboard and click OK.

      5. Paste the CLI commands in the onboarding script.

    • Adding the SSH configuration statements to the onboarding script.

    See Sample Onboarding Script for Committing SSH Configuration on a Device for a sample of the onboarding script.

  2. Upload the onboarding script to the TFTP server.
  3. Configure the DHCP server with the onboarding script filename and path to the onboarding script in the TFTP server.
  4. Install the device, connect it to the network, and power on the device.

    For information about installing the device, see the respective installation guide on the Product Documentation website.

  5. After the device is powered on, the factory-default settings in the device trigger a built-in script (ztp.py). The script obtains the following from the DHCP server:

    • IP address for the management interface

    • IP address of the default gateway

    • IP address of the DNS server and TFTP server

    • Path to the onboarding script on the TFTP server

  6. The device configures its management IP address, static default route, and the DNS server address, based on the values from the DHCP server.
  7. The device downloads the onboarding script, based on the values from the DHCP server, and executes it, resulting in the onboarding configuration statements to be committed.
  8. The device opens an outbound SSH session with Paragon Automation based on the committed onboarding configuration.
  9. Paragon Automation configures management and telemetry parameters including gNMI by using NETCONF. Paragon Automation also configures the interfaces and protocols based on the configurations defined in the network implementation plan associated with the device, by using NETCONF.

Sample Onboarding Script for Committing SSH Configuration on a Device

The following is a sample of the onboarding script that is downloaded from the TFTP server to the device:

What's Next

Connect to the Paragon Automation GUI and view the status of device onboarding on the Inventory page (Inventory > Devices > Network Inventory). After the device status changes to Connected , you can start managing the device. See Device Management Workflow.

Add a Non-Juniper Device

Note:

In this release, among non-Juniper devices, only Cisco Systems devices are supported. For a list of supported Cisco Systems devices, see Supported Hardware.

To add a non-Juniper device to Paragon Automation:
  1. Navigate to Inventory > Devices > Network Inventory.

    The Inventory page appears.

  2. On the Router tab, click Add Device.
    The Add Devices page appears.
  3. On the Add a Device tab, enter values referring to table Table 1.
  4. Click + Add Device to add more devices.
  5. Repeat steps 3 and 4 to add more non-Juniper devices.
  6. Click OK.
    The device connects to Paragon Automation. You can now manage the device by using Paragon Automation.
  7. (Optional) View the status of device onboarding on the Inventory page (Inventory > Devices > Network Inventory). After the device status changes to Connected, you can start managing the device. See Device Management Workflow.
Table 1: Add a Non-Juniper Device

Field

Description

Device Name

Enter the device hostname.

Address/GRPC Port

Enter the IPv4 address and gRPC port configured on the device.

MAC

Enter the MAC address of the device.

Site

Click the drop-down list to select a site where the device is deployed.

Vendor

Click the drop-down list to select the vendor of the device.

Model

Enter the device model. For example, Cisco NCS-57C3,

Operating System Name

Enter the name of the operating system (OS) deployed on the device. For example, IOS XR.

Version

Enter the version of the operating system. For example 7.10.1.

Timeout (in minutes)

Enter the time (in minutes) of inactivity after which the device disconnects with Paragon Automation.

Retry Delay (in minutes)

If the device is unable to connect with Paragon Automation, enter the time (in minutes) after which the device retries to connect with Paragon Automation.

Authorization

Insecure

This option is disabled by default and the connection between the device and Paragon Automation is secure (encrypted and/or authenticated).

Enable this option when TLS is disabled on the device so that the connection between the device and Paragon Automation is established without any encryption.

The insecure connection is vulnerable to man-in-the-middle attacks and other security threats. We recommend that you use an insecure connection between the device and Paragon Automation only during local development and in testing environments where security is not a concern.

Skip Verify

This option is disabled by default and Paragon Automation verifies the device when the device establishes a connection with Paragon Automation.

Enable this option when TLS is enabled on the device and Paragon Automation should skip verifying the device's identity when the device establishes a connection. This option is useful when you have a self-signed certificate that cannot be verified against a certificate authority, so that device verification is skipped.

When you skip verifying the device's identity, the connection is vulnerable to man-in-the-middle attacks. Therefore, this option should be enabled only during development or testing the connection between the device and Paragon Automation.

Certificates—Use this option to enter the username and password for the device to authenticate with Paragon Automation.

Certificate

Click Browse to upload the TLS certificate for the device.

Key Certificate

Click Browse to upload the TLS certificate key for the device.

Certificate Authority

Certificate Authority: Click Browse to upload the TLS root certificate from the certificate authority.

Credentials—Use this option to enter the username and password for the device to authenticate with Paragon Automation.

Username

Enter a username of the device for Paragon Automation to connect with the device.

Password

Enter the password for the username.

See Also