Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

ZTP Onboarding Process for NGPE Satellite Devices

Zero Touch Provisioning (ZTP) allows you to onboard NextGen Port Extender (NGPE) satellite devices from the aggregation device, requiring minimal user input. ZTP is supported in Junos OS Release 25.4R1-S2 and later.

Prerequisites

You will need to ensure the following requirements are met prior to implementing ZTP.

  1. The satellite device to be onboarding must be factory-defaulted or zeroized prior to starting the ZTP process. Either method should be completed using console access to avoid loss of connectivity to the device.
    Factory Default - https://www.juniper.net/documentation/us/en/software/junos/cli/topics/topic-map/junos-factory-default.html
    Zeroize - https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/command/request-system-zeroize-security.html
    1. ZTP is supported on the QFX5120 Series switches as satellite devices. EX Series switches as satellite devices require the manual onboarding process.
  2. Confirm the following files exist in the specified locations on the aggregation device:
    ngpe_event.py in /var/db/scripts/event
    ngpe_commit.py in /var/db/scripts/commit
    ztp_ngpe_sd_template.py in /var/db/scripts/commit
  3. Create an ftp user acccount.
    1. You can confirm the user account creation with this command:
  4. You will need to set read-write-exectute permissions on the /var/home/ftp/ directory:
    Enter shell mode:
  5. Change directory to /var/home/.
  6. Change permission on /var/home/ftp/:
    1. Confirm the change. The folder should now have rwxrwxr-x permissions.
    2. Return to operational mode.
  7. You can supply a Junos image for the satelite device by uploading the image to the /var/home/ftp directory. The software image must be in place prior to starting the ZTP process.

ZTP Onboarding Process

Configure Elements for ZTP Onboarding

  1. Configure the required parameters on the AD, under the port-extender stanza.
    Configure the management loopback address used by the AD. This loopback is for management traffic only and is a required parameter.
  2. Configure the data loopback address used by the AD. This is a required parameter.
    This address is for data traffic only.
  3. Enable the EVPN-VXLAN fabric.
  4. Define the satellite model for this SD instance. You can use any name you prefer for <satellite-name>. You may onboard one satellite device at a time. ZTP does not support onboarding multiple satellites simultaneously.
  5. Add the interfaces which will become the cascade and uplink ports.
    Note the interfaces are differentiated in this example by the "ad" or "sd" identifier. This example includes 4 interfaces per device. You may configure between 1 and 4 interfaces, although we recommend at least 2 per device. Configure the necessary number of interfaces for your deployment.
  6. Configure ztp under the edit services port-extender satellite satellite-name hierarchy.
  7. You will see a message similar to this if you attempt to onboard a satellite device which doesn't support ZTP.

Verification

Verify Satellite Onboarding

Once the ZTP process has started, you can monitor progress via live console access or using the tail command on /var/log/jnu/ztp.log.

The following commands can be used to further confirm satellite onboarding.

  • show chassis jnu role: displays whether a device is a controller or satellite.

  • show chassis jnu satellites: displays the status of a single satellite or all satellites.

  • show chassis port-extender: displays each virtual SD slot number, along with its IP address, MAC address, and cascade port number.

  • show interfaces terse: displays the up/down status of interfaces; useful for confirming the NGPE fabric is up.

  • show lacp interfaces: check the status of aex participating in LACP

  • show interfaces vtep: check the status of VTEP interfaces.

  • show l2-learning vxlan-tunnel-endpoint remote: check the status of remote VTEP interfaces

  • show bfd session device-list [satellite-name(s)]: check the status of BFD sessions

  • request jnu satellite sync: needed if the SD failed to initially sync, meaning the SD is configured and working, yet it isn't associated with the AD.

  • show configuration | display set: displays the active configuration on the device, where you can view all of the auto-generated NGPE configuration

  • show configuration services port-extender satellite satellite-name| display set: here you can confirm that the ztp configuration knob is no longer present on this statement

  • show log jnud: use this command to either monitor the progress of a satellite onboarding, or use after onboarding to check for any errors.