Zero-Touch Provisioning: Image and VM User Data Bring-Up, the Config File & Automated Onboarding

Overview

Every ISE node starts life at the same console prompt, asking the same set of questions: hostname, address, gateway, DNS, NTP, time zone, credentials. Typed by hand, that wizard is where a transposed octet or an unreachable NTP server stops an install that then has to be corrected and run again.

Zero-touch provisioning (ZTP) moves those answers into a file that the node reads by itself. This lesson covers what that file holds, the two ways ISE can find it, and what the node checks before it trusts it — then builds the course’s third ISE node that way.

Terminology: What ZTP Replaces

The console setup wizard is the manual path. Its answers are the node’s identity on the network: hostname and domain; IP address, netmask and default gateway; a primary name server and NTP server, with optional extras of each; the time zone; whether SSH is on; and the admin username and password.

ZTP, available from ISE 3.1, takes the same answers from a configuration file called ise-ztp.conf. It also does things the wizard does not:

• Installs a patch and hot patches from a repository, in the same unattended run
• Turns on services such as ERS, OpenAPI and pxGrid
• Adds an SSH public key for the admin account

Design Choice: Two Ways to Hand ISE the File

ISE looks for its configuration in one of two places.

Enlarge figure: ZTP delivery: a config file (ise-ztp.conf) becomes either a ZTP image labelled ISE-ZTP in a CD/DVD drive or VM user data, the base64 guestinfo.ise.ztp value on an ESXi VM; the node reads it at boot, runs the gateway, DNS and NTP checks, then completes setup, patches and services on its own

Cisco publishes the script that builds the image, create_ztp_image.sh, in the ISE 3.5 Installation Guide’s ZTP section. It runs on RHEL, CentOS or Ubuntu. In short, it:

1. Creates a 1,440 KB empty file
2. Formats it as ext4 with the label ISE-ZTP
3. Loop-mounts it and copies your file in as ise-ztp.conf

The loop mount needs root privileges — run it with sudo.

For Hyper-V, Cisco says to use an .iso and a Generation 2 VM rather than an .img.

Design Choice: Which Drive Gets the Image

Where the image goes depends on what else is booting the node:

Enlarge figure: Three panels: a fresh ISO install puts the install ISO in the primary drive and the ZTP image in the secondary; a pre-installed OVA puts the ZTP image in the primary drive; an SNS appliance maps the install ISO and the ZTP image through CIMC virtual media, image first

The logic is the same in every row: the install media, if any, takes the primary drive, and the configuration image takes what is left; on an appliance, Cisco asks for the image to be mapped first. A node that was already installed and is sitting at the setup prompt can also be finished by ZTP: power it off, map the image, power it on.

Terminology: The Configuration File

ise-ztp.conf is plain key=value text. Cisco’s installation guide lists the required settings by name — hostname, IP address, netmask, default gateway, DNS domain, primary name server, NTP server, time zone, SSH, username and password — but not the key spellings. Those come from the sample in the Cisco Community ZTP article, and they are the keys this course’s lab file uses:

No single Cisco page gives both halves of that table — it reconciles the installation guide’s setting names with the Community article’s key spellings.

Optional keys group into four kinds:

• Networking — a second and third name server or NTP server, and IPv6
• Access — public_key, for the SSH behaviour below
• Repository and patching — repository_name, repository_protocol, repository_server_name, repository_path, a patch, and a comma-separated list of hotpatches
• Services — ers, openapi, pxgrid, pxGrid_Cloud, and, on ISE 3.5, management_interface, which selects the management interface on SNS 3700 and 3800 appliances

Getting a key’s spelling right is not the same as getting its value right. Three rules catch people:

• patch is singular and hotpatches is plural — the community article warns the patch installation fails if either is misspelled
• The repository protocol is lowercase http, not HTTP, or the patch files cannot be downloaded
• Repositories must allow anonymous access — TFTP, HTTP, HTTPS or NFS with no username or password — and the repository ZTP creates is not visible in the GUI afterwards

Engine Behavior: The Pre-Checks, and How ZTP Fails

Once the node has brought its interface up with the settings from the file, and before setup completes, it tests the network it has just been given: it pings the gateway and the name server, and it has to synchronise with the NTP server. These are the checks the wizard runs too.

Enlarge figure: All three pre-checks passing continues the install; any one failing prints the fixed failure screen and stops until the file or network is corrected and the node reboots

A failed check stops the run on the console with a fixed shape:

==============================================================================
                       Cisco ISE Installation Failed
==============================================================================
Error: Gateway setup failed.
Check the setup details in your configuration image and reboot Cisco ISE 
with proper ZTP configuration.
==============================================================================

That is from this course’s lab, captured on the serial console of a node whose ZTP run had keystrokes typed into it part-way through. The fix is the one the screen gives: correct the file, or the network, and reboot so ZTP runs again.

Each check can be switched off — SkipIcmpChecks, SkipDnsChecks, SkipNtpChecks, each false by default. Use them for an isolated lab only. Cisco’s setup guidance is explicit that an install with no NTP reachability can leave a node unusable until it is re-installed.

Engine Behavior: What Changes After a ZTP Install

One security behaviour is on by default for a node built by ZTP, and a second applies when the file carries a public key:

• First-login password change — the password sat in plain text in the file, so by default the GUI requires a new one on first login
• Public-key login — if public_key is set, password login over SSH is disabled; Cisco documents no service sshd PubkeyAuthentication as the way to revert

After the services start, unmount the image from the CD/DVD drive. A left-behind image is a plain-text password sitting wherever the image is stored.

🔬 See It in the Lab: Build ISE-03 From a File

This builds ISE-03 (10.82.22.167), the node the next lesson registers into the deployment, without typing a single answer on its console. AD-01 (10.82.22.160) answers the node’s DNS and NTP checks. Starting state:

• ✅ AD-01 (10.82.22.160) resolves ise-03.securitylessons.lab to 10.82.22.167 and back, and answers NTP
• ✅ ISE-03 exists as a VM that has never been powered on, with a serial port for its console
• ✅ You can reach the hypervisor that runs it, to attach a disk image and open the VM console

Step 1 — write the file. The course’s copy is configs/SISE/sise-zero-touch-provisioning/ise-ztp.conf; the password line holds the lab password:

hostname=ise-03
ipv4_addr=10.82.22.167
ipv4_mask=255.255.255.0
ipv4_default_gw=10.82.22.1
domain=securitylessons.lab
primary_nameserver=10.82.22.160
primary_ntpserver=10.82.22.160
timezone=UTC
ssh=true
username=admin
password=<lab password>
ers=true
openapi=true

Step 2 — build the image with Cisco’s script. Copy create_ztp_image.sh from the installation guide, then run it as root, and check the label it wrote:

$ sudo ./create_ztp_image.sh ise-ztp.conf ise-03-ztp.img
Image created ise-03-ztp.img
$ blkid ise-03-ztp.img
ise-03-ztp.img: LABEL="ISE-ZTP" UUID="32b81d8c-f264-420f-995f-9151d3c26778" BLOCK_SIZE="4096" TYPE="ext4"

Step 3 — attach it and power on. In this lab, attach the image to ISE-03 as a second virtual disk before its first power-on (on Cisco’s OVA, map it to the primary CD/DVD drive instead), then start the VM and open its console. About two and a half minutes after power-on, the setup program appears and answers itself — every line below was typed by ZTP from the file, not by a person:

Press 'Ctrl-C' to abort setup
Enter hostname[]: ise-03
Enter default DNS domain[]: securitylessons.lab
Enter IPv4/IPv6 address[]: 10.82.22.167
Enter IP netmask[]: 255.255.255.0
Enter IP default gateway[]: 10.82.22.1
Do you want to configure IPv6 address? Y/N [N]: N
Enter primary nameserver[]: 10.82.22.160
Add secondary nameserver? Y/N [N]: N
Enter NTP server[time.nist.gov]: 10.82.22.160
Add another NTP server? Y/N [N]: N
Enter system timezone[UTC]: UTC
Enable SSH service? Y/N [N]: Y
Enter username[admin]: admin
Enter password: 
Enter password again: 
Bringing up network interface...
Pinging the gateway...
Pinging the primary nameserver...
Testing VM disk I/O performance...
Average I/O bandwidth writing to disk device: 398 MB/second 
Average I/O bandwidth reading from disk device: 639 MB/second 
I/O bandwidth performance within supported guidelines

That is the proof of the Key Insight at the top of this lesson: ZTP does not skip the wizard, it answers it. The two Pinging lines are the gateway and name-server checks, followed by a disk performance test; the NTP synchronisation isn’t printed at this stage. From here the node installs the ISE application exactly as a hand-built one does — just under an hour in this lab — so do not touch the console while it runs; keystrokes typed during a ZTP run go into the same setup program.

Step 4 — confirm ZTP did it. Once SSH answers, log in to ISE-03 and read ZTP’s own entries in the system log. The output also repeats each line with a short timestamp and prints three long getty status lines between the third and fourth lines below; those are left out here:

ise-03/admin#show logging system ade/ADE.log | include ZTP
2026-09-26T10:11:37.124325+00:00 ise-03 root[865]: ZTP configuration image found
2026-09-26T10:11:37.214141+00:00 ise-03 root[892]: ISE Installation configured with ZTP
2026-09-26T10:12:37.447890+00:00 ise-03 root[1779]: ZTP: allow_setup_autologin.sh
2026-09-26T10:12:37.660245+00:00 ise-03 root[1820]: ZTP: allow_setup_autologin.sh completed
2026-09-26T17:15:49.166557+00:00 ise-03 root: Unmapping ZTP config Image
2026-09-26T17:45:09.732545+00:00 ise-03 root: info:[application:operation:cpminitialsetup.sh] ISE ZTP config file exists.Hence Triggering patch , hotpatch installations configured

Read it top to bottom: the image was found, the install was switched to ZTP, and allow_setup_autologin.sh is how ZTP gets at the setup program — it logs the console in automatically and runs setup there. The last line is the initial application setup checking the same file for patches and hot patches to install. The first timestamps are seven hours behind the rest, which is consistent with the node’s clock being corrected once it synchronised.

Step 5 — check the result. The configuration the node ended up with is the file’s. The first lines of show running-config:

ise-03/admin#show running-config
interface GigabitEthernet 0
 ip address 10.82.22.167 255.255.255.0
 ipv6 enable
 ipv6 address autoconfig
!
ntp server 10.82.22.160
hostname ise-03
icmp echo on
ip domain-name securitylessons.lab
ip default-gateway 10.82.22.1
ip name-server 10.82.22.160

Further down the same output carry service sshd enable and clock timezone UTC, from ssh=true and timezone=UTC.

Step 6 — log in to the GUI. Browse to https://ise-03.securitylessons.lab/admin/ and log in as admin with the password from the file. ISE doesn’t let you in yet:

That’s the first-login password change Cisco enables by default for ZTP installs, because the password sat in plain text in the file. In this lab ISE also refused the old password as the new one, so ISE-03’s GUI admin password now differs from the lab’s standard one.

🎥 [Video: the setup wizard and the typo it invites; ise-ztp.conf; the ISE-ZTP image against guestinfo.ise.ztp and which wins; which drive the image goes in for an ISO, an OVA and an appliance; the pre-checks and the failure screen on the serial console; patches, services and the forced password change; ISE-03 built with nothing typed. Matches video.script_outline. Runtime: ~8 minutes]