What is ZTP?

Zero-Touch Provisioning (ZTP) is an automated process that activates and configures a new network device – a router, switch, or SD-WAN appliance – without an on-site technician manually keying in settings. The device powers on, calls home to a staging server, authenticates itself, and receives its configuration automatically.

Key takeaways

• ZTP activates and configures devices automatically, with no manual setup.
• The device calls home to a staging server as soon as it powers on.
• PKI certificates, often stored in a TPM chip, authenticate the device.
• Versa supports global, URL-based, CLI, USB, and cloud-init ZTP methods.
• ZTP replaces truck rolls and manual CLI configuration at remote sites.

On this page: Why it matters · How it works · Types · ZTP & Versa · FAQ

Why is ZTP important?

Provisioning a device by hand – a console cable, an IP address, routing and security settings entered one field at a time – does not scale past a handful of sites. Enterprises rolling out SD-WAN or SASE appliances to hundreds of branches cannot send an engineer everywhere, and manual entry invites typos and delays that leave a site offline for days.

ZTP removes the person from the critical path. A device ships straight from the manufacturer to a branch, where anyone plugs in power and a WAN cable and the device configures itself against centrally defined policy. That collapses rollout time from days to minutes, removes the risk of pre-loading credentials onto hardware before it ships, and lets one operations team activate unlimited sites in parallel.

What is ZTP?

Stripped of vendor detail, ZTP follows the same handshake everywhere. A device powers on with no configuration beyond factory defaults, requests an address over DHCP, and reaches out – a “call home” – to a provisioning server rather than waiting for someone to reach it. The server identifies the device, usually by a preregistered serial number or a manufacturer-installed certificate, and decides which network it belongs to, which management node it reports to, and which software it needs.

The server pushes that configuration, and if required a software image, down to the device, which applies it and joins the production network without a keystroke typed locally. The model’s security rests on that identity check: because the device is bootstrapping onto a network it doesn’t yet trust, authentication must happen before configuration is accepted.

Types of ZTP

ZTP implementations vary mainly in how a device finds its provisioning server and proves its identity. DHCP/bootstrap-file ZTP is the oldest pattern: DHCP options point a freshly booted device at a location to fetch a startup configuration, common on enterprise LAN gear. Cloud call-home ZTP has the device dial a vendor-hosted cloud service at boot; the service validates it by serial number and redirects it to the right provisioning node – the model most SD-WAN and SASE branch appliances use. Standards-based secure ZTP formalizes the handshake cryptographically: the IETF’s SZTP (RFC 8572) and BRSKI (RFC 8995) use signed vouchers so a device proves its identity before accepting configuration. Local/manual-trigger ZTP keeps the zero-configuration-entry property but still needs someone on site, where the internet is unreachable unassisted.

ZTP & Versa

Versa VOS devices support ZTP through several methods. Global ZTP activates a device automatically at power-on: it calls home to a Versa Networks cloud staging server, which validates the serial number and redirects it – first through prestaging, then to the staging Controller node – over an IPsec session authenticated with a Versa-signed certificate whose private key lives in the device’s TPM chip. URL-based ZTP lets an administrator finish activation from a laptop or phone via an emailed link, decoupling the device from a specific branch. CLI-based staging runs the staging.py script on the device, and USB-based staging reads a staging.params file from an inserted drive. For virtual instances, cloud-init combines installation, configuration, and onboarding into one boot sequence. Devices, device groups, and Controllers come from initial VOS configuration.

Frequently asked questions

What is the difference between global ZTP and URL-based ZTP?

Global ZTP activates automatically the moment a device powers on and reaches the internet, using a preregistered serial number. URL-based ZTP needs a site administrator to click an emailed activation link, which decouples the physical device from a specific branch.

Does ZTP require an on-site technician?

No – that’s the point. Global ZTP and cloud-init need no local action beyond powering the device on. URL-based, CLI, and USB-based ZTP still need someone on site, but that person only clicks a link or inserts a drive, not configures the device.

How does a ZTP device prove its identity to the network?

Most implementations rely on a manufacturer-installed certificate, often backed by a Trusted Platform Module, or a preregistered serial number checked against a vendor inventory. Standards like SZTP and BRSKI formalize this with signed vouchers, authenticating the device before it accepts configuration.

Can ZTP provision virtual or cloud-based devices?

Yes. Virtual network devices use cloud-init, an industry-standard cross-platform initialization method supported by every major public cloud and virtualization platform, to automatically install software, apply configuration, and complete onboarding the first time the instance boots, with no manual staging step.

What happens if a ZTP device’s configuration has already been changed?

It won’t onboard correctly, because ZTP expects the device to still hold its untouched factory-default configuration. A device whose configuration was already modified must first be reset to defaults from the local CLI, after which the ZTP activation process can complete normally.

More on ZTP

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about ZTP, these are worth looking at next.