This article explains what zero touch provisioning (ZTP) is, how it works, and how IT professionals in charge of the IT infrastructure for large enterprises and education organizations leverage it for streamlined deployment, consistent configurations, security, and scalability.
What is zero touch provisioning (ZTP)?
Zero touch provisioning specifically refers to the remote automated configuration of network devices such as routers, firewalls, switches, and access points. It does not refer to the automated configuration of user devices such as phones, tablets, laptops, and workstations (which is instead referred to as zero touch enrollment).
The purpose of ZTP is to automate the initial setup and configuration of network devices, removing the need for manual configuration (i.e., the IT professional in charge of provisioning does not have to physically interact with the device, hence “zero touch”), which can be time-consuming, especially when deploying larger numbers of network devices across multiple locations. Configuring devices using zero touch provisioning also reduces the chance for mistakes and errors, ensuring that the same configuration is deployed to every device.
ZTP services often provide a user interface for creating the configuration that will be deployed and usually also include a server that the device will contact to retrieve this configuration once they are connected.
How ZTP works
The term ZTP refers to a method, not an official standard. Hence, the implementation of zero touch provisioning may differ between devices and vendors; however, they generally include the following steps:
- The networking device to be provisioned is plugged into the network and powered up in its factory default state (either out of the box or an existing device that has been factory reset)
- The device receives an IP address and gateway information via DHCP
- The device contacts a server or third-party service to download its configuration file or initialization script, the details of which are either provided by DHCP or a preconfigured URL set by the vendor
- This configuration provides information on where the device can download the full configuration or software updates from the ZTP service
In some cases, the initial configuration file may be provided on a physical storage device like a USB stick that contains the network details and ZTP server information. This may be applicable where DHCP is not in use or in other specific scenarios.
Benefits of zero touch provisioning
IT departments deploy zero touch provisioning for the following reasons:
- Efficiency: The time and cost of deploying new network devices is greatly reduced by employing ZTP
- Reduces misconfigurations: Having an IT team member manually configure multiple devices can lead to mistakes that go unnoticed. For example, forgetting to add a firewall rule or mistyping an IP address
- Consistency: Automating the deployment means each device gets the exact same configuration
- Scalability: Being able to bring new network devices (and the devices that will connect through them) online as quickly as possible is important for scaling organizations
- Security and compliance: Consistent configurations and improved scalability ensure that you can maintain the highest security on your network to protect your business and ensure compliance with data protection laws
ZTP automation use cases and scenarios
The utility of zero touch provisioning can be demonstrated with a few common use cases.
Large organizations provisioning a new network will need to roll out potentially hundreds of devices, including both network hardware like switches and Wi-Fi access points, as well as user devices like PC workstations. With ZTP, technicians can simply unbox devices straight from the vendor and plug them in, then deploy their configuration automatically – rather than having to plug each device into a console or having to access each individually to configure them using a web interface.
Many growing organizations also maintain multiple locations that are all connected using technologies like VPNs or SD-WAN. Rather than sending an engineer out to configure a new network device (for example, replacing a faulty switch at a remote work site), the new device can simply be shipped out and plugged in by existing on-site staff, with configuration taking place automatically and requiring no special knowledge.
ZTP considerations
A bad configuration could knock all the targeted devices offline. Because of this, it is important that all configurations are thoroughly checked before deployment. Otherwise, you may find yourself having to travel to the location of each device to resolve the issue.
The broad impact ZTP can have on your network configuration also means that ZTP tools must be thoroughly secured. If an attacker gained access to your ZTP, they could easily deploy a bad configuration or leave themselves back doors for later access. Secure encrypted connections and signed configurations can help secure ZTP.
If you require specific configuration options via ZTP, you should first check what your devices support before purchasing them as implementations do vary.
Tools and vendors supporting ZTP
There are several popular platforms that are considered to be the industry standards for zero touch provisioning functionality:
- Cisco Zero Touch Provisioning automates the process of deploying software images and configuration to Cisco devices
- Juniper ZTP allows for the initial setup of Juniper devices without manual intervention using a configuration file or script
- Arista Zero Touch provides ZTP for Arista network switches
- Ubiquiti came to prominence due to their outstanding ZTP and configuration functionality, which quickly made their products popular with IT professionals
There are ongoing efforts to formally standardize zero touch provisioning, for interoperability and consistency between vendors.
The role zero touch provisioning plays in remote monitoring and management for enterprise
Zero touch provisioning only handles the initial setup stages for network devices. Ongoing monitoring is required to ensure that security is maintained and that everything is functioning optimally. NinjaOne combines network monitoring with endpoint management and remote access tools, providing a single interface for both ensuring the quality of your network infrastructure and the productivity of your end users.
