Cisco Crosswork Zero–Touch Provisioning Data Sheet

Data Sheet

Available Languages

Download Options

  • PDF
    (435.1 KB)
    View with Adobe Reader on a variety of devices
Updated:May 11, 2021

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Available Languages

Download Options

  • PDF
    (435.1 KB)
    View with Adobe Reader on a variety of devices
Updated:May 11, 2021


Value Statement

Our customer businesses are growing, and their network footprint is expanding at very fast rates.

      This puts an increasing strain on the customer deployment teams as they run into an ever-increasing backlog of work to keep up with all the activity.

      The average truck roll for the provisioning of new equipment costs anywhere from $1200 to $3000.

A key customer request has been to automate the onboarding of new devices into their network, therefore reducing the need to send deployment teams on site for provisioning and onboarding and increasing the speed at which the equipment becomes available for use.

Cisco Crosswork Zero-Touch Provisioning (ZTP) allows customers to provision and onboard new Cisco® IOS XR devices automatically. Using a common GUI and API via the Crosswork infrastructure, the network administrator can define policies for the provisioning of new devices. The result is a simplified onboarding process translating to significant time and cost savings by automating the process across many thousands of devices.

Product overview

Network operators are facing challenges to support the exponential growth of network devices. Providing a reliable way to automatically onboard these devices has become crucial to enable them to prepare for rapid expansion for 5G or other deployments. Access devices are often deployed in remote locations, which is often accompanied by the need for a truck roll to complete the provisioning, therefore increasing the need for automation. Cisco IOS XR7 software along with ZTP support enhances the entire customer experience of deploying new hardware and onboarding devices.

The Cisco Crosswork ZTP app provides an integrated turnkey solution to onboard a range of XR devices and enable faster time to deploy new hardware at a lower operating cost.

When a new device is powered up, ZTP provides the automated ability to download and apply the initial software load and configuration to complete the provisioning of this device. After applying the configuration, the app allows for downloading and executing additional scripts on the device. These scripts enable the operator to fetch additional RPMs (Linux binary packages) from the controller. ZTP simplifies the process of deploying a new device with Day 0 configuration and bringing it up to the desired state in an automated manner.

The fully integrated solution combines core capabilities from multiple innovative, industry-leading products—Cisco Network Services Orchestrator (NSO), Cisco Prime Network Registrar, and the Cisco Crosswork suite of applications—with common API and integrates with a common UI, providing control via a single pane of glass.

With the Cisco Crosswork ZTP application, customers can realize these outcomes:

      Bring up the device with customer-certified software or image and obtain its IP address from a DHCP server such as Cisco Prime Network Registrar.

      Download and apply an initial configuration.

      Download and execute a shell script.

      Manage the device family profile, device config, image, and scripts so that they are applied to the onboarded equipment in a unified manner based on customer preference.

      Automatically onboard the new devices to Crosswork Device Lifecyle Manager for Day 1 operation.

      Provide a turnkey automation solution to offer faster deployment of many new devices at machine speed, yielding ever-improving mean time to use as the savings compound across the larger numbers of devices over time.

The result? Increased profitability through faster deployment, optimized investments, and better OpEx utilization.

With release version 2.0, we have implemented Secure ZTP RFC8572. When Secure ZTP is enabled, certificate exchange mechanism is used, where the server and device certificates are validated before the image and configuration are downloaded.

A list of certificates used is shown in the table below:

Certificate name


Certificate type

Cert Manager profile


Owner certificate

Trusted pinned-domain-certificate

SZTP Provisioning

Trust profile

Key store

Pinned-Domain-Certificate (PDC)

Customer domain CA certificate

SZTP Provisioning

Trust profile

Trust store

Owner private key

Intermediate key for signing owner certificate

SZTP Provisioning

Trust profile

Key store

Crosswork TLS certificate

Crosswork CA cert (self-signed with Crosswork as CA)

Secure ZTP TLS

ZTP server profile

Trust store

Cisco M2 CA cert (parent of all device SUDI certs)


Secure ZTP TLS

ZTP server profile

Trust store

Secure ZTP workflow

      The device sends SUDI certificate, and the ZTP server validates the device with SUDI root.

      The server responds with the ownership voucher and PDC.

      The device verifies the ownership voucher and extracts the owner certificate from the PDC.

      This establishes a way to trust the bootstrap data.

      A trusted HTTPS connection is established using the owner certificate.

      ZTP service generates bootstrap response containing onboarding information, which consists of download URL, pre-config, and post-config scripts. All artifacts shared through the secure connection are also encoded with the ownership voucher.

      On receiving the information, the device requests the image, downloads the image, reboots the device, and applies the pre- and post-config scripts.

      This completes the secure ZTP provisioning process, and the status is updated in the Crosswork ZTP server.

Model Based Zero-Touch Provisioning

Figure 1.            

Model Based Zero-Touch Provisioning

Features and benefits



Crosswork ZTP app

  Provides a turnkey solution for Day 0 ZTP of new devices

Image repository

  Provides an image server where images used for provisioning devices are stored

Config repository

  Provides a config repository where device configs for the new devices are stored

Device profile management

  Provides ability to create and manage device profiles consisting of hostname, serial number, and device family and type

Provisioning profile

  Provides ability to create and manage provisioning profile

Single pane of glass

  Crosswork platform provides unified UI for ZTP to manage the entire operation from a single pane of glass

Northbound API

  An open and programmable framework enables network operators to develop their own applications based on API and integration into existing toolset

Flexible consumption

  1-year, 3-year, and 5-year subscription licenses

Platform support: Secure ZTP

Product family

Platforms supported

IOS images (feature sets) supported


8000, 5001, 5002, 5501, 5502, 5504, 5508, 5516, 55A1, 55A2, 540, 1001

XR 7.3.1 or later

Cisco 8000 Series

8800 Fixed Mode supports both Secure ZTP and Classic ZTP


Solution tested using the PNR DHCP server from Cisco

Version 10.1 or later

Platform support: Classic ZTP only

Product family

Platforms supported

IOS images (feature sets) supported


9001, 9901, 9904, 9906, 9912, 9922

XR 6.6.3, 7.0.1, 7.0.2, 7.0.12, or later

Cisco 8000 Series

8800 distributed mode only supports Classic ZTP


Solution tested using the PNR DHCP server from Cisco

Version 10.1 or later


Crosswork ZTP licenses are available via Smart Licensing for a 36- or 60-month term.

License level: ZTP sessions


Product specifications

The Cisco Crosswork ZTP application is designed for simultaneous provisioning of multiple devices and simplifying onboarding of new devices. Please refer to the table below for supported scale and simultaneous sessions

Scale supported


Overall Crosswork scale

For release 4.0, the Crosswork scale is 25,000 devices.

ZTP application scale

ZTP application supports 200 devices for simultaneous image and configuration downloads.

System requirements

The Cisco Crosswork ZTP app follows the same guidelines as the Crosswork Change Automation/Health Insights setup. Please refer to the data sheet for CA/HI.

Ordering information

Contact your Cisco account representative for details on how to order the Cisco Crosswork ZTP app.

Warranty information

The Cisco Crosswork ZTP App is covered by the following warranty:

Cisco environmental sustainability

Information about Cisco’s environmental sustainability policies and initiatives for our products, solutions, operations, and extended operations or supply chain is provided in the “Environment Sustainability” section of Cisco’s Corporate Social Responsibility (CSR) Report.

Reference links to information about key environmental sustainability topics (mentioned in the “Environment Sustainability” section of the CSR Report) are provided in the following table:

Sustainability topic


Information on product-material-content laws and regulations


Information on electronic waste laws and regulations, including products, batteries, and packaging

WEEE compliance

Cisco makes the packaging data available for informational purposes only. It may not reflect the most current legal developments, and Cisco does not represent, warrant, or guarantee that it is complete, accurate, or up to date. This information is subject to change without notice.

Customer Experience (CX) Services

Implementation and optimization services

Drive internal efficiencies and speed to market with Cisco CX Services Crosswork Professional Services. Leverage our implementation experience across multiple customer environments and best practices. Cisco uses an agile delivery methodology to deploy Crosswork ZTP in your environment. Working with your team on acceptance testing, we’ll start making sure your team adopts the use cases. We’ll continue to stand by you, delivering knowledge transfer and upgrade services for the Crosswork ZTP Controller components. This ensures your team understands, adopts, and operationalizes the Crosswork ZTP use cases.

Solution support

Maximize performance, reliability, and ROI of your Cisco Crosswork Zero-Touch Provisioning with Cisco Solution Support. You get access to a team of Cisco solution experts who are your primary point of contact, delivering centralized support across your deployment. Whether you have an issue with a Cisco product or one from another vendor—or are just looking for guidance and assurance on your new solution—simply contact us. We’ll take it from there and remain accountable for your case, from first call to resolution. Note: If issues are identified as being due to third-party vendor devices, we expect you to engage the third-party vendor. Cisco will work with you to provide triage information to the third party.

For more information, visit

Cisco Capital

Flexible payment solutions to help you achieve your objectives

Cisco Capital makes it easier to get the right technology to achieve your objectives, enable business transformation and help you stay competitive. We can help you reduce the total cost of ownership, conserve capital, and accelerate growth. In more than 100 countries, our flexible payment solutions can help you acquire hardware, software, services and complementary third-party equipment in easy, predictable payments. Learn more.

Call to action

For more information on Cisco's network automation portfolio for Service Providers please visit To learn more about Cisco Crosswork Zero-Touch Provisioning or to schedule a demonstration contact your Cisco sales representative.

Document history

New or Revised Topic

Described In


Created data sheet - version 1 (draft)

Data sheet

Mar 13, 2020

Updated data sheet - version 2

Data sheet

Apr 3, 2020

Updated data sheet for Secure ZTP - version 3

Data sheet

Mar 29, 2021




Learn more