What Is Zero Touch Provisioning (ZTP)? | Palo Alto Networks
Zero Touch Provisioning (ZTP) is a provisioning mechanism which allows unconfigured devices to automatically load deployment files upon power-on, including system software, patch and configuration files.
ZTP eliminates the need for onsite, manual configuration and deployment, which reduces labor costs and improves deployment efficiency.
Zero touch provisioning can be found in network devices including:
- Firewalls
- Wireless access points
- Routers
- Network switches
Why Is ZTP Important?
Whether a business has one location or hundreds, deploying devices and tools can be challenging – especially when done manually. Manually installing, configuring and deploying firewalls, for example, across multiple locations often requires technical staff at each location. This consumes valuable time and resources, which negatively impacts the bottom line.
Zero touch provisioning, or ZTP, eliminates manual intervention and automatically configures network devices. This allows businesses to scale device deployment across multiple locations.
Figure 1. Zero-touch provisioning process using a Dynamic Host Configuration Protocol (DHCP) server
For ZTP to function, it is necessary that the device is in its factory default configuration. This means that the device is booted with the preinstalled software and configuration settings that were set by the manufacturer:
- Upon powering on, a device with ZTP capability executes a boot file that configures the device's configuration parameters.
- The device then requests an IP address from a DHCP server.
- Device receives additional network configuration information such as the location of a TFTP server, the gateway address, and the domain name.
- The device uses this information to connect to a file server or cloud service where it retrieves the latest operating system image and configuration files.
- The ZTP server authenticates the device and allows it to download the files, which the device then installs and executes.
ZTP makes the initial configuration of network devices fast and efficient, allowing for streamlined deployment at scale.
There are different ways to deploy ZTP, but the DHCP option is the most popular. This allows the network device to connect to the DHCP server that assigns it an IP address and provides the location of the server from where the device can download the configuration. The DHCP server can be configured to provide not only the IP address but other details like DNS and TFTP server information to the device.
Other methods to deploy ZTP include USB and email-based, but DHCP is the most widely used because it simplifies the process and allows for centralized management of the network.
How Does Zero Touch Provisioning Work on Palo Alto Networks Appliances?
Figure 2. Palo Alto Networks ZTP onboarding process
Consider a fast-growing organization that needs to deploy firewalls all over the world as part of their firewall rollout. They want to add each firewall to Panorama, the Palo Alto Networks centralized management console, to ensure consistent security across their data center perimeter and branch locations with a centralized management solution at the company headquarters.
- The network administrator registers Panorama with the ZTP service. This allows the firewall to be drop-shipped directly to the stores.
- To complete the onboarding, each store representative simply opens the box, plugs in the firewall, and registers it using the serial number and claim key provided in the shipment. No special skills are required, and no visit from IT is needed, all while securely onboarding your firewall.
- Each registered firewall appears on Panorama where the network administrator can view and manage all firewalls from a single interface.
ZTP can be thought of as an easy button for provisioning and protecting branches across all Palo Alto Networks Next-Generation Firewalls.
Benefits of ZTP
By automating the configuration process, ZTP offers a range of benefits for businesses looking to manage their networks more efficiently, including:
- Faster deployment
- Consistent configuration
- Improved security
- Centralized management
- Scalability
ZTP automates the configuration process, which means that network devices can be deployed quickly and efficiently. This can save businesses time and money by reducing the need for on-site technicians and manual configuration.
ZTP ensures that every device is configured to the same standard. This reduces the risk of human error and makes it easier to manage the network.
By automating the configuration process, ZTP reduces the risk of security breaches caused by misconfigurations or human error. This is especially important for businesses that handle sensitive data or operate in highly regulated industries.
ZTP allows for centralized management of the network, making it easier to monitor and control the configuration of devices across the entire organization.
ZTP can scale to meet the needs of businesses of all sizes, from small startups to large enterprises. This makes it a flexible solution that can grow and adapt to meet changing business needs over time.
ZTP vs. One Touch Provisioning
Zero touch provisioning (ZTP) and one touch provisioning (OTP) are both methods of automating the configuration of network devices. ZTP is an automated process that configures a network device without requiring any interaction from the user, except for physically connecting the device to the network and powering it on. It uses DHCP and DNS to locate the specific configuration server and retrieve the necessary configuration information. ZTP is ideal for scenarios where many network devices need to be configured or updated.
OTP is also an automated process, but it requires one point of interaction from the user, such as resetting the factory default password or entering specific credentials. OTP is often used in situations where ZTP would need additional configuration, such as for VLAN or static IPv4 addresses configuration.
It is important to note that not all ZTP implementations are truly zero touch, and some devices may require minimal touch or one touch provisioning. Additionally, some vendors offer cloud based services to support the ZTP process, allowing the devices to be fully configured and managed via the cloud.
Zero Trust Provisioning FAQs
Zero Touch Provisioning (ZTP) is designed to simplify and automate the on-boarding of new network devices.
Specific to Palo Alto Networks, zero touch provisioning (ZTP) is designed to simplify and automate the on-boarding of new firewalls to the Panorama™ management server. ZTP streamlines the initial firewall deployment process by allowing network administrators to ship managed firewalls directly to their branches and automatically add the firewall to the Panorama™ management server after the ZTP firewall successfully connects to the Palo Alto Networks ZTP service. This allows businesses to save on time and resources when deploying new firewalls at branch locations by removing the need for IT administrators to manually provision the new managed firewall.
