Zero Touch Provisioning for XDR

Zero Touch Provisioning (ZTP) automates initial switch configuration at boot time. It uses DHCP to discover a JSON configuration file that instructs the switch on image installation, configuration, connectivity checks, and custom scripts.

Prerequisites

• A DHCP server (v4 or v6) reachable from the switch management interface

• A provisioning server (HTTP/SFTP/SCP/TFTP) hosting the ZTP JSON file and any referenced files (images, configs, scripts)

• A prepared ztp.json configuration file

Step 1 — Prepare the ZTP Configuration File

Create a JSON file (e.g. ztp.json) with the sections you need. Sections execute in lexical order — use a numeric prefix to control ordering:

{
  "ztp": {
    "01-image": {
      "install": {
        "url": "http://<server>/images/nvos.bin"
      }
    },
    "02-startup-file": {
      "url": "scp://user:password@<server>/configs/config.yaml",
      "clear-config": true,
      "save-config": true
    },
    "03-connectivity-check": {
      "ping-hosts": ["<gateway-ip>", "<spine-ip>"]
    }
  }
}

Available sections:

Step 2 — Host the Files on a Provisioning Server

Upload ztp.json and all referenced files (OS image, config files, scripts) to your provisioning server. Supported protocols: HTTP, HTTPS, TFTP, SCP, SFTP.

Step 3 — Configure the DHCP Server

Configure your DHCP server to return the URL of ztp.json to the switch.

DHCPv4 — use Option 67 (bootfile-name):

option bootfile-name "http://<server>/ztp.json";

DHCPv6 — use Option 59 (bootfile-url):

option dhcp6.bootfile-url "http://[<server-ipv6>]/ztp.json";

Step 4 — Boot the Switch

1. Power on or reboot the switch with no saved startup configuration (ZTP is enabled by default when no startup config exists).

2. The switch sends a DHCP request on all management interfaces.

3. The DHCP server responds with the ztp.json URL.

4. ZTP downloads and processes each section in order.

5. If the image section triggers an install with a reboot, ZTP resumes after the reboot.

6. Once all sections complete successfully and configuration is saved, ZTP is disabled.

Step 5 — Verify ZTP Status

nv show system ztp

Re-running ZTP

To re-trigger ZTP on a previously configured switch:

• Option A (recommended): Run reset factory — clears all config and reboots into ZTP.

• Option B: Run nv action run system ztp — restarts ZTP flow if no configuration exists. The configuration must be cleared separately, or reset factory should be used.

Key Notes

• save-config: true in the startup-file and commands-list sections will save the configuration and disable ZTP at the end of the session

• If a section fails and restart-ztp-on-failure is true (default), ZTP retries up to 10 times

• Commands in commands-list must be non-interactive (use -y flags to avoid prompts)

• Do not include system reboot in a commands-list — it will cause a boot loop

• Provisioning scripts must include a shebang (e.g. #!/bin/bash) and exit with code 0 on success

For a detailed step-by-step guide on implementing Zero-Touch Provisioning, see NVOS User Manual - Zero-Touch Provisioning

Last updated: October 22, 2026