15.2 Cisco Catalyst Center Device Onboarding & Software Image Management (SWIM)
Key Takeaways
- Cisco Network Plug-and-Play (PnP) automates Day 0 provisioning for switches, routers, and APs using discovery mechanisms including DHCP Option 43 (sub-option format '5A1N;B2;K4;I<IP>;J<port>'), DNS ('pnpserver.<domain>'), and Cisco Cloud PnP Connect via hardware SUDI 802.1AR certificates.
- Brownfield device discovery supports CDP/LLDP neighbor table crawling from a designated seed device, CIDR subnet scans, and discrete IP ranges using centralized CLI, SNMPv2c/v3, and NETCONF credential profiles.
- Software Image Management (SWIM) enforces Golden Image compliance, pre-stages software binaries to flash storage, executes comprehensive pre-checks (flash space, NTP, stack consistency, boot register), and performs staged reloads or In-Service Software Upgrades (ISSU).
- Catalyst Center templates support both Apache Velocity Template Language (VTL) and Python Jinja2 engines, enabling dynamic configuration generation with conditional logic, loops, site hierarchy CAD variables, and automated IPAM bindings.
- Post-upgrade validation automatically verifies control plane stability, routing protocol adjacencies (OSPF/EIGRP/BGP), MAC address tables, and link states, triggering automated rollbacks if operational discrepancies occur.
15.2 Cisco Catalyst Center Device Onboarding & Software Image Management (SWIM)
Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topic 4.5 (Cisco Catalyst Center configuration, monitoring, and management workflows) requires candidates to design, configure, and operate automated device onboarding workflows, Software Image Management (SWIM), and configuration templates within Cisco Catalyst Center. Key competencies include mastering the Network Plug-and-Play (PnP) state machine, DHCP Option 43 formatting, DNS and Cisco Cloud PnP Connect redirection, brownfield discovery methods, Golden Image tagging, In-Service Software Upgrades (ISSU), and Apache Velocity / Jinja2 template engineering.
Manual, box-by-box device deployment (console cables, manual TFTP image staging, and copy-pasted CLI configurations) is error-prone, labor-intensive, and unscalable in enterprise networks. Cisco Catalyst Center provides a centralized, policy-driven automation framework that streamlines the complete infrastructure lifecycle from initial factory unboxing (Day 0), through baseline configuration and image standardization (Day 1), to ongoing policy management and compliance updates (Day N).
+---------------------------------------------------------------------------------------------------+
| DEVICE LIFECYCLE AUTOMATION PHASES |
+---------------------------------------------------------------------------------------------------+
| |
| [ DAY 0: ONBOARDING & BOOTSTRAP ] |
| - Unbox factory-default switch, router, or AP; connect power and uplinks. |
| - Zero-touch discovery via DHCP Option 43, DNS, or Cisco Cloud PnP Connect. |
| - Secure Unique Device Identifier (SUDI) 802.1AR mutual cryptographic trust establishment. |
| - Download bootstrap IP configuration and register with Catalyst Center controller. |
| |
| [ DAY 1: PROVISIONING & STANDARDIZATION ] |
| - Site hierarchy assignment (Global -> Area -> Building -> Floor). |
| - Software Image Management (SWIM): Upgrade/Downgrade to site "Golden Image" baseline. |
| - Apply standardized Day 1 configuration templates (VLANs, AAA, OSPF/BGP, SNMP, NTP, Syslog). |
| |
| [ DAY N: ASSURANCE, COMPLIANCE & TEMPLATE UPDATES ] |
| - Continuous Model-Driven Telemetry (MDT) streaming and Health Score monitoring. |
| - Automated configuration drift detection and compliance auditing. |
| - Push security patches (SMUs), Access Point Service Packs (APSP), and template updates. |
+---------------------------------------------------------------------------------------------------+
1. Cisco Network Plug-and-Play (PnP) Onboarding Architecture
Cisco Network Plug-and-Play (PnP) is a zero-touch onboarding subsystem built into Cisco IOS-XE devices and Catalyst Center. When an unconfigured device boots without a startup-config file, the internal PnP Agent initializes and executes an automated discovery sequence to locate the enterprise Catalyst Center PnP server.
+---------------------------------------------------------------------------------------------------+
| PNP DISCOVERY MECHANISM HIERARCHY |
+---------------------------------------------------------------------------------------------------+
| |
| Fresh Device Boots (No startup-config in NVRAM) |
| | |
| v |
| [ 1. DHCP DISCOVERY ] |
| - Requests IP address, Subnet Mask, Default Gateway, DNS Server (Option 6), |
| DNS Domain Name (Option 15), and DHCP Option 43 (PnP Controller String). |
| | |
| +---> [ Found Option 43? ] ===== YES ====> Connect to Catalyst Center IP / Port |
| | |
| NO |
| v |
| [ 2. DNS RESOLUTION ] |
| - Queries local DNS server for hostname: 'pnpserver.<learned-domain-name>' |
| (e.g., 'pnpserver.corp.internal' or 'pnpserver.cisco.com'). |
| | |
| +---> [ DNS Resolves IP? ] ===== YES ====> Connect to Resolved IP on HTTPS Port 443 |
| | |
| NO |
| v |
| [ 3. CISCO CLOUD PNP CONNECT ] |
| - Connects outbound to Cisco Cloud gateway: 'devicehelper.cisco.com' over HTTPS (Port 443). |
| - Authenticates via factory-installed Secure Unique Device Identifier (SUDI X.509 cert). |
| - Cloud queries customer's Smart Account / Virtual Account and returns redirection profile. |
| | |
| +---> [ Redirection Received? ] == YES => Redirect to On-Prem Catalyst Center IP/FQDN |
| | |
| NO |
| v |
| [ 4. USB / MANUAL / MOBILE APP ] |
| - Fallback: Connect USB flash drive containing bootstrap config or use PnP Mobile App. |
+---------------------------------------------------------------------------------------------------+
DHCP Option 43 Syntax & Sub-Option Architecture
DHCP Option 43 provides vendor-specific information to the PnP Agent. In Cisco IOS-XE PnP, Option 43 must be configured with a precise sub-option string format:
+---------------------------------------------------------------------------------------------------+
| DHCP OPTION 43 SUB-OPTION FIELD SPECIFICATION |
+---------------------------------------------------------------------------------------------------+
| Field Code | Field Name | Description & Allowed Values |
| :----------- | :------------------ | :----------------------------------------------------------- |
| **5A** | Sub-Option Type Code| Identifies Cisco PnP sub-option format. |
| **1** | Sub-Option Length | Length of the sub-option format header (always 1). |
| **N** | Value Encoding | `N` = ASCII string format (default and standard). |
| **B2** | Transport Protocol | `B1` = HTTP (cleartext, port 80).<br/>`B2` = HTTPS (TLS, port 443).|
| **K4** | Key / Trust Type | `K4` = Public Key / Certificate Trust validation. |
| **I<IP>** | Controller IP | `I` followed immediately by IPv4 address of Catalyst Center. |
| | | Example: `I10.100.20.50` |
| **J<Port>** | Server Port Number | `J` followed immediately by TCP port number. |
| | | Example: `J443` (HTTPS) or `J80` (HTTP). |
+---------------------------------------------------------------------------------------------------+
! Example DHCP Server Configuration for Cisco PnP (Cisco IOS-XE DHCP Server):
ip dhcp pool BRANCH_PNP_POOL
network 10.100.20.0 255.255.255.0
default-router 10.100.20.1
dns-server 10.100.1.10 10.100.1.11
domain-name corp.internal
! Option 43 configured as ASCII string pointing to Catalyst Center (10.100.20.50:443):
option 43 ascii "5A1N;B2;K4;I10.100.20.50;J443"
Cryptographic Trust Establishment (SUDI X.509 Certificate)
To prevent rogue controllers or man-in-the-middle attacks during onboarding, Cisco devices feature a hardware-embedded Secure Unique Device Identifier (SUDI):
- The SUDI is an IEEE 802.1AR compliant X.509 certificate burned into the tamper-proof Trust Anchor module (TAm) chip at the Cisco factory.
- It contains the device's exact serial number, Product ID (PID), and public key, signed by the Cisco Manufacturing Root Certificate Authority.
- During PnP discovery, Catalyst Center and the device perform mutual TLS (mTLS) authentication. Catalyst Center validates the device's genuine Cisco hardware identity, and installs the enterprise root CA certificate onto the device for future encrypted communications.
PnP Device Lifecycle State Machine
+---------------------------------------------------------------------------------------------------+
| PNP DEVICE LIFECYCLE STATES |
+---------------------------------------------------------------------------------------------------+
| State | Description & Operational Context |
| :-------------- | :------------------------------------------------------------------------------ |
| **Unclaimed** | The device has contacted Catalyst Center, presented its serial number and PID, |
| | and is registered in the PnP database, but has not yet been assigned to a site. |
| **Claimed** | The device is mapped to a specific site, a Golden Software Image, and a |
| | configuration template, ready for automated provisioning. |
| **In Progress** | Catalyst Center is actively pushing software images or executing CLI templates. |
| **Provisioned** | The image has been validated, configuration applied, telemetry initialized, and |
| **(Success)** | the device successfully added to active inventory. |
| **Error** | Provisioning failed due to image transfer error, template syntax failure, or |
| | reachability timeout. Details are logged in the PnP History log. |
+---------------------------------------------------------------------------------------------------+
2. Brownfield Discovery Options & Profiles
For existing networks containing pre-configured devices (Brownfield Deployments), Catalyst Center provides automated discovery engines to sweep, identify, and ingest network elements into inventory.
+---------------------------------------------------------------------------------------------------+
| BROWNFIELD DISCOVERY METHOD COMPARISON |
+---------------------------------------------------------------------------------------------------+
| Discovery Method | Operational Mechanism | Best Use Case |
| :---------------------- | :----------------------------------------- | :-------------------------- |
| **CDP / LLDP Sweep** | Starts at a **Seed Device** (e.g., Core | Fully interconnected campus |
| **(Neighbor Crawling)** | Switch) and recursively queries CDP/LLDP | networks with active link |
| | neighbor tables up to a configured hop count| discovery protocols. |
| **Subnet Scan** | Sweeps an entire CIDR network block | Discovering devices on a |
| | (e.g., `10.50.0.0/24`) via ICMP/SNMP probes| specific management subnet. |
| **IP Range Scan** | Sweeps a contiguous range between a Start | Targeted discovery across a |
| | IP and End IP (e.g., `10.1.1.50`–`10.1.1.99`)| subset of static addresses. |
+---------------------------------------------------------------------------------------------------+
Discovery Credential Profiles
To successfully ingest and manage discovered devices, Catalyst Center requires a pre-configured Credential Profile containing:
- CLI Credentials: SSHv2 (preferred) or Telnet username, password, and enable secret.
- SNMP Credentials: SNMPv2c Read/Write community strings, or SNMPv3 User credentials (Authentication protocol SHA/MD5, Encryption AES-128/256 or DES).
- HTTPS / NETCONF Credentials: Port 443 / Port 830 credentials for model-driven programming.
Once discovered, devices are assigned to the Site Hierarchy (Global $\to$ Area $\to$ Building $\to$ Floor), which determines which policies, image baselines, and configuration templates the device inherits.
3. Software Image Management (SWIM)
Software Image Management (SWIM) automates software maintenance across enterprise switches, routers, and controllers. SWIM ensures uniform software versions, validates hardware readiness, and minimizes downtime during upgrades.
+---------------------------------------------------------------------------------------------------+
| SWIM IMAGE MANAGEMENT ARCHITECTURE |
+---------------------------------------------------------------------------------------------------+
| |
| [ 1. IMAGE REPOSITORY ] |
| - Synchronizes directly with Cisco.com (CCO) or accepts manual `.bin`, `.pkg`, `.tar` uploads. |
| - Stores base IOS-XE images, Software Maintenance Upgrades (SMUs), and AP Service Packs (APSP). |
| |
| [ 2. GOLDEN IMAGE TAGGING ] |
| - Network architects tag a specific image version as **Golden** for a device family, model, |
| device role (Access/Core/Border), and site hierarchy level. |
| - Catalyst Center automatically audits active inventory and flags all non-compliant devices. |
| |
| [ 3. IMAGE DISTRIBUTION (FLASH PRE-STAGING) ] |
| - Pre-stages the golden image file to device flash memory via secure SCP / HTTPS. |
| - Executes automatic MD5 / SHA-512 cryptographic checksum verification. |
| - Can be scheduled days in advance during normal hours without causing device reboots. |
| |
| [ 4. DEVICE READINESS CHECKS (PRE-CHECKS) ] |
| - Automated pre-flight validation: |
| * Free Flash Space: Verifies sufficient flash memory (auto-purges unused inactive images). |
| * Hardware & Bootloader Compatibility: Verifies ROMMON version and RAM capacity. |
| * NTP Synchronization: Ensures synchronized clocks for cryptographic certificate validation. |
| * Stack Consistency: Verifies all stack members are online and healthy. |
| * Configuration Register: Verifies config-register is set to `0x2102` (standard boot). |
| |
| [ 5. ACTIVATION & STAGED RELOAD ] |
| - In-Service Software Upgrade (ISSU): Zero/sub-second packet loss upgrade on dual-supervisor |
| modular switches (Catalyst 9400/9600) and StackWise Virtual pairs. |
| - Staged Sequential Reloads: Upgrades access switch stacks sequentially across maintenance |
| windows to prevent simultaneous building-wide network outages. |
| |
| [ 6. POST-UPGRADE VALIDATION (POST-CHECKS) ] |
| - Automatically compares pre-upgrade vs post-upgrade operational snapshots: |
| * Routing protocol neighbor counts (OSPF / EIGRP / BGP peerings). |
| * MAC address table size, STP topology state, and link operational states. |
| * If discrepancies occur, alerts the administrator or initiates automated rollback. |
+---------------------------------------------------------------------------------------------------+
4. Device Provisioning & CLI Templating: Velocity vs. Jinja2
Catalyst Center features a robust Template Programmer that allows engineers to construct parameter-driven configuration templates. Catalyst Center supports two industry-standard templating engines: Apache Velocity Template Language (VTL) and Python Jinja2.
+---------------------------------------------------------------------------------------------------+
| APACHE VELOCITY (VTL) VS. PYTHON JINJA2 SYNTAX |
+---------------------------------------------------------------------------------------------------+
| Language Element | Apache Velocity (VTL) | Python Jinja2 |
| :--------------------- | :-------------------------------- | :----------------------------------- |
| **Variable Reference** | `$hostname` or `${interface_name}`| `{{ hostname }}` or `{{ intf.name }}` |
| **Conditional IF** | `#if ($role == "CORE")` | `{% if role == 'CORE' %}` |
| **ELSE / ELSEIF** | `#elseif ($role == "DIST")` | `{% elif role == 'DIST' %}` |
| | `#else` | `{% else %}` |
| **End Conditional** | `#end` | `{% endif %}` |
| **Loop FOR** | `#foreach ($vlan in $vlan_list)` | `{% for vlan in vlan_list %}` |
| **End Loop** | `#end` | `{% endfor %}` |
| **Comments** | `## This is a comment` | `{# This is a comment #}` |
| **Variable Filters** | Custom Velocity Tools | `{{ hostname | upper }}` |
| | | `{{ ip | default('10.1.1.1') }}` |
+---------------------------------------------------------------------------------------------------+
Variable Binding Sources
Templates can bind variables dynamically from three distinct sources:
- Form-Based Variables: Prompted interactively to the administrator during the device provisioning workflow in the Catalyst Center web GUI.
- Site-Level CAD Variables: Automatically inherited from the device's assigned Site Hierarchy properties (e.g.,
$SITE_DNS_SERVER,$SITE_NTP_SERVER,$SITE_AAA_SERVER). - IPAM (IP Address Management) Integration: Automatically requested and assigned from integrated IPAM platforms (Infoblox, BlueCat, or Catalyst Center Internal IPAM pools).
5. Configuration CLI & Template Implementation Examples
1. Production Apache Velocity (VTL) Provisioning Template
## Apache Velocity Template: Enterprise Access Switch Provisioning
hostname $DEVICE_HOSTNAME
!
sntp server $SITE_NTP_SERVER
ip domain name $SITE_DOMAIN_NAME
!
vlan $MGMT_VLAN
name MANAGEMENT_VLAN
!
#foreach ($vlan in $ACCESS_VLANS)
vlan $vlan.id
name $vlan.name
#end
!
interface GigabitEthernet1/0/1
description Uplink to Distribution Core
switchport mode trunk
switchport trunk allowed vlan $TRUNK_ALLOWED_VLANS
no shutdown
!
#if ($DEVICE_ROLE == "POE_ACCESS")
interface range GigabitEthernet1/0/2-48
switchport mode access
switchport access vlan $DATA_VLAN
switchport voice vlan $VOICE_VLAN
spanning-tree portfast
spanning-tree bpduguard enable
power inline auto
#else
interface range GigabitEthernet1/0/2-48
switchport mode access
switchport access vlan $DATA_VLAN
spanning-tree portfast
spanning-tree bpduguard enable
#end
2. Production Python Jinja2 Provisioning Template
{# Python Jinja2 Template: Enterprise Access & Uplink Provisioning #}
hostname {{ device_hostname | upper }}
!
ip name-server {{ site_dns_primary }} {{ site_dns_secondary }}
ntp server {{ site_ntp_server }}
!
{% for vlan in access_vlans %}
vlan {{ vlan.id }}
name {{ vlan.name }}
{% endfor %}
!
{% for intf in uplink_interfaces %}
interface {{ intf.name }}
description Uplink to {{ intf.neighbor_switch }}
switchport mode trunk
switchport trunk allowed vlan {{ intf.allowed_vlans }}
switchport nonegotiate
no shutdown
{% endfor %}
!
{% if enable_8021x | default(true) %}
aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
dot1x system-auth-control
{% endif %}
3. Cisco IOS-XE PnP and SWIM Verification Commands
Switch-1# show pnp tech-support
------------------ PnP Status ------------------
PnP State : Connected
Discovery Phase : DONE
Discovery Protocol : DHCP
Controller Server : 10.100.20.50:443
Transport Protocol : HTTPS
Trustpool Status : Installed (Cisco Enterprise Root CA)
Device Serial Number : FDO2435A01B
Device PID : C9300-48P
Certificate Status : SUDI Verified
Last Sync Status : SUCCESSFUL (Image & Day 1 Config Applied)
Switch-1# show version | include System image
System image file is "flash:packages.conf"
Switch-1# show boot
BOOT variable = flash:packages.conf;
Configuration register is 0x2102
A network engineer is configuring a Microsoft Windows DHCP Server to support zero-touch Cisco Network Plug-and-Play (PnP) for new Catalyst 9300 switches. The Cisco Catalyst Center controller is reachable at IP address 192.168.10.50 using secure HTTPS on TCP port 443 with certificate trust validation. Which string must be configured as the value for DHCP Option 43?
An enterprise unboxes 50 new Cisco Catalyst 9200 access switches at a branch office. The local network does not have DHCP Option 43 or internal DNS PnP records configured, but the branch router provides direct outbound Internet connectivity. How do the factory-default switches automatically locate their corporate on-premises Cisco Catalyst Center controller?
A network administrator is preparing a Software Image Management (SWIM) campaign in Cisco Catalyst Center to upgrade a modular Cisco Catalyst 9606R core switch equipped with redundant Supervisor engines. The administrator must ensure that client traffic experiences zero packet loss during the software upgrade. Which activation method and pre-upgrade check should the administrator select?
A network automation engineer is authoring a configuration template in Cisco Catalyst Center to provision access ports on newly onboarded switches. The engineer wants the template to inspect a variable named 'DEVICE_ROLE'. If the role is 'VOIP_ACCESS', the switchport should configure both data and voice VLANs; otherwise, it should configure only the data VLAN. Which templating language directive and syntax correctly accomplishes this logic in Apache Velocity (VTL)?