Kaspersky SD-WAN

Automatic configuration of CPE (ZTP) devices

Each CPE device has a unique DPID (Datapath Identifier). It is a 64-bit number that is generated based on a unique characteristic of the CPE device, such as the MAC address of the WAN0 interface or a serial number.

To use a CPE device, you must first create an entry for it in the web interface, and then connect the device itself to the orchestrator. Alternatively, you can connect the device to the orchestrator (in this case, it is displayed in the web interface with the Unknown status) and then create an entry. In both cases, the entry is associated with the device based on its DPID.

Two main scenarios exist for registering CPE devices: Zero Touch Provisioning (ZTP) or with additional configuration. Additional configuration includes, for example, assigning static IP addresses and creating routes, uploading security certificates, and generating tokens.

The CPE device is configured as follows:

1. If additional configuration is needed, URL activation is used.
2. The CPE device receives IP addresses of WAN interfaces and DNS servers as well as default routes from the service provider via DHCP.
3. The CPE device uses the FQDN or IP address of the orchestrator to connect to it, passes its own DPID, and obtains the public IP addresses of the SD-WAN Controller and SD-WAN gateways (if any). Certificates are also uploaded to the CPE device.
4. The CPE device establishes a TLS connection with the SD-WAN controller over the IP network using the service provider's network or the internet.
5. The SD-WAN Controller programs the CPE device to create links from each WAN interface.

To automatically configure a CPE device over the internet, you must configure public IP addresses of the orchestrator, controller, and SD-WAN gateways. NAT is supported for the following interfaces as an alternative to public IP addresses:

• tcp 443, 81 for the orchestrator
• tcp 6653 to 6656 for the SD-WAN Controller
• udp 4800 to 4803 for SD-WAN gateways