Guide to use ZTP in GNS3 SONiC DataCenter v2.1.0

Robert Strakulski
Updated

[stordis-toc]

Introduction

Welcome to the STORDIS Guide for Zero Touch Provisioning (ZTP) for the SONiC DataCenter environment.

This guide focuses on the "Day-0" preparation of the Ansible management server to act as a ZTP node. By using ZTP, new SONiC devices in the fabric can automatically acquire IP addresses, download public SSH keys, execute post-installation scripts, and load a base configuration without manual intervention.

Prerequisites

  • Running GNS3 project containing the Spine-Leaf topology. You can download it HERE by filling out the form.
  • Access to the Ansible server (Ubuntu)

Ansible Server / ZTP Node Overview

The Ubuntu Server in this project serves a dual role: an Ansible control node for Day-1/Day-2 operations, and a ZTP provisioner for Day-0 operations.

For ZTP to function, the server is preconfigured with:

  • DHCP Server: To assign temporary management IPs and provide the URL for the ZTP boot file via DHCP options.
  • HTTP Server: To host the ZTP configuration files, scripts, and security keys.

Main ZTP directory structure (located within the Web Server root):

/var/www/html/sonic/
                  └── ztp/
                  ├── authorized_keys  # Public SSH keys to be pushed to devices
                  ├── baseconfig.json  # Minimal initial SONiC configuration
                  ├── post-install.sh  # Bash script for system tuning after installation
                  └── ztp.json         # The main ZTP orchestration file definition

Access to Ubuntu Server

Log in to the management server:

Credentials:

  • Login: administrator
  • Passwd: ZAQ2wsx

Note: The server interface ens3 has a static IP configured. If changes are needed, manually edit /etc/netplan/50-cloud-init.yaml and apply.

DHCP Server Configuration (dhcpd.conf)

The DHCP server identifies booting switches and points them to the web server to fetch the ZTP orchestration file. The configuration is located at /etc/dhcp/dhcpd.conf.

Key ZTP Elements:

Option 67 (bootfile-name): This is the crucial ZTP option. It specifies the HTTP URL from which the SONiC device will download the ztp.json file.

Host Declarations: Specific switches (Spines, Leafs, etc.) are identified by their MAC addresses (hardware ethernet) and assigned fixed IP addresses within the management VLAN 124.

Web Server (HTTP) Directory Structure

The HTTP server (IP 192.168.124.223 in this example) hosts all necessary files in the path indicated by the DHCP server.

Below is the verification of the file structure within the Ubuntu server's web root:
(ansible-venv) stordis@ansiblerobert:/$ cd var/www/html/sonic/ztp/
(ansible-venv) stordis@ansiblerobert:/var/www/html/sonic/ztp$ ls -l
total 16
-rw-r--r-- 1 root root  400 May 15 10:00 authorized_keys
-rw-r--r-- 1 root root  250 May 15 10:00 baseconfig.json
-rw-r--r-- 1 root root  650 May 15 10:00 post-install.sh
-rw-r--r-- 1 root root  530 May 15 10:00 ztp.json

ZTP Files overview

This is the main orchestration file downloaded by the SONiC device. It defines a sequential workflow.

ZTP Orchestration (ztp.json)

Workflow defined in this file:

01-download: Downloads the authorized_keys key file from the HTTP server and places it in .ssh directory:
/home/admin/.ssh/authorized_keys

02-provisioning-script: Downloads and executes post-install.sh.

03-configdb-json: Downloads baseconfig.json and applies it as the starting configuration DB. "clear-config": "false" ensures default factory settings are merged, not totally overwritten, while "save-config": "true" persists the configuration.

Post-Installation Script (post-install.sh)

This Bash script performs necessary system adjustments on the SONiC device immediately after system installation but before the final reboot.

Script Actions:

  • Disable SSH timeout: Comments out ClientAlive settings in sshd_config to prevent management sessions from dropping during automation tasks.
  • Password Management: Ensures the default admin password does not expire (specifically required for Broadcom SONiC flavors).
  • Security Permissions: Set correct ownership (admin:admin) and restrictive permissions (700 for directory, 600 for file) on the newly downloaded .ssh folder and authorized_keys file.

Base Configuration (baseconfig.json)

This file provides the minimal "Day-0" SONiC configuration required to make the device manageable via the network. Day-1 configuration (routing, interfaces, VLANs) is intended to be applied later via Ansible playbooks.

SSH Key Management (authorized_keys)

The authorized_keys file in /var/www/html/sonic/ztp/ must contain the public key of the Ansible server (or network administrator).

How to prepare new public key:

  1. On the Ansible server, generate a key pair if one doesn't exist: ssh-keygen -t rsa

  2. Copy the contents of the resulting public key (usually ~/.ssh/id_rsa.pub).

  3. Paste that content into /var/www/html/sonic/ztp/authorized_keys.

When ZTP runs, this key is downloaded to the switch. This allows the Ansible server to log in to the newly provisioned SONiC devices via SSH without a password to perform Day-1 configuration.

ZTP Architecture and Concepts

The ZTP environment in this project is designed to reflect real-world DataCenter automated deployment practices. It follows the standard SONiC ZTP logic flow:

  1. Boot: New SONiC switch boots with factory default settings. ZTP service is enabled by default.
  2. Discovery: The switch sends DHCP requests on its management interface.
  3. IP & Option Assignment: The DHCP server (Ubuntu) offers an IP address and DHCP Option 67, containing the URL http://<Server_IP>/sonic/ztp/ztp.json.
  4. Execution: The switch downloads ztp.json via HTTP and executes the workflow:
    • It downloads SSH keys to allow Ansible access.
    • It runs post-install.sh to tune system settings (SSH timeouts, permissions).
    • It loads baseconfig.json into the ConfigDB.
  5. Completion: Upon successful execution of all stages, the ZTP process completes, and the device reboots if required, ready for Day-1 configuration via Ansible.

Do You have more questions?

If you have any questions, encounter issues, or if any part of the configuration is unclear, please contact STORDIS Technical Support.

Our team will be happy to assist you.

You can reach us via the support portal:

https://support.stordis.com/hc/en-us

For more free resources, visit: https://stordis.com/free-resources/

Comments 0

Articles in this section