324
1.877.877.2269
BLACKBOX.COM
NEED HELP?
LEAVE THE TECH TO US
LIVE 24/7
TECHNICAL
SUPPORT
1.877.877.2269
CHAPTER 16: ADVANCED CONFIGURATION
16.16.2 EXAMPLE ISC DHCP SERVER CONFIGURATION
The following is an example ISC DHCP server configuration fragment for serving an .opg configuration image:
option space Black Box code width 1 length width 1;
option Black Box.config-url code 1 = text;
class "Black Box-ztp" {
match if option vendor-class-identifier ~~ "^Black Box/";
vendor-option-space Black Box;
o
ption Black Box.config-url "https://example.com/opg/$
{class}.opg";
}
For other DHCP servers, please consult their documentation on specifying vendor specific option fields.
We use sub-option 1 to hold the URL text.
16.16.3 SETUP FOR AN UNTRUSTED LAN
If network security is a concern and a user can insert a trusted USB flash drive into the Black Box device during provisioning, then
follow the steps listed next for deploying configuration in an untrusted network:
Generate an X.509 certificate for the client. Place it and its private key file onto a USB flash drive (concatenated as a single file, client.
pem).
Set up a HTTPS server that restricts access to the .opg or .xml file for HTTPS connections providing the client certificate.
Put a copy of the CA cert (that signed the HTTP server's certificate) onto the USB flash drive as well (ca-bundle.crt).
Insert the USB flash drive into the Black Box device before attaching power or network.
Continue with the steps above, but using only an https URL.
16.16.4 HOW IT WORKS
This section explains in detail how the Black Box device uses DHCP to obtain its initial configuration.
First, a Black Box console manager is either configured or unconfigured. ZTP needs it to be in an unconfigured state, which is only
obtained in the following ways:
Firmware programming at factory.
Pressing the Config Erase button twice during operation.
Selecting Config Erase under System > Administration in the web UI, and rebooting.
Creating the file /etc/config/.init and then rebooting.
When an unconfigured Black Box device boots, it performs these steps to find a configuration:
The console server transmits a DHCP DISCOVER request onto its primary Network Interface (WAN).
This DHCP request carries a Vendor Class Identifier of the form Black Box/model-name (for example, Black Box/LES1203A-M) and its
parameter request list will include option 43 (Vendor-Specific Information).
