Cisco SD-WAN. Edges licensing and onboarding.

Cisco SD-WAN. Edges licensing and onboarding.

  • Post category:SD-WAN

In this post we generate and install the necessary licenses for Edge devices and then connect them to the controllers. This is the second part from Cisco SD-WAN On-boarding series on building a self hosted SD-WAN lab. For first part click here.

At first we need to obtain the necessary licenses from the Cisco site. That’s why we need a Smart Account that includes a Virtual one. Go to, from the Administration area select Manage Smart Account:

Cisco software page

then, select Virtual Accounts

Manage Smart Account

next, select New Virtual Account

Virtual accounts

fill the form with the name of the new Virtual Account and save.

Create new virtual account

Next step is to add a vBond profile. Go back to Software Central page and from the Network Plug and Play area, choose Plug and Play Connect.

Cisco software page

From the top right drop-down menu select the virtual account created before.

switch virtual account

Next, select Controller Profiles, then select Add Profile button.

add profile to virtual account

For the controller type, VBOND must be selected.

add controller profile step 1

In the next page, fill the required fields and pay attention to Organization Name (this defines the OU to match in the Certificate Auth Process and must be consistent across the Viptela domain) and Primary Controller (this name/address will be used for vBond), then Submit.

add controller profile step 2

To add Virtual edges (vEdge or cEdge) devices, from the Plug and Play Connect page, select Devices link.

controller listed

then select Add Software Devices button

add software devices

To add a vEdge, in the Identify Device window, enter VEDGE-CLOUD-DNA in the Base PID field.

device base pid vedge

For cEdge, the Base PID is CSR1KV and for ISRv is ISRV.

device base pid properties for CSR1K

After finishing adding devices, click Next, then check Review and Submit, and Done

devices added

Now devices are added, for a few minutes they will be on Pending for publish state

license pending

Once the status become Provisioned, we can go to Controller Profiles and select the check box in front of Profile Name and then Provisioning File link, to download the provisioning file.

licese provisioning file

In the Download Provisioning File dialog, select Controller Versions 18.3 and newer and download the file.

download provisioning file

Transfer the downloaded file to the docker node, if you don’t know how, look on EVE-NG Cookbook section 13.2 and you will find how.

Navigate to Configuration > Devices and select Upload vEdge List to upload provisioning file downloaded from Cisco website. On the page are displayed several unused device licenses being successfully added to the system.

device licenses added to vManage

Onboarding Edge nodes

First step in configuring vEdge is applying the following template:

 host-name vEdge
 system-ip <vEdge system IP>
 site-id 1
 organization-name "pocvlab sdwan"
 clock timezone Europe/Bucharest
 vbond <VPN0 VBOND IP>
vpn 0
 interface ge0/0
  ip address <VPN0 IP address/netmask>
  ipv6 dhcp-client
   encapsulation ipsec
  no shutdown
 ip route <VPN0 gateway address>

Verify connection with vBond (, vManage ( and vSmart ( using ping.

Now, we have to copy/paste CA certificate content from docker node to a file on vEdge. Open a terminal on Docker and cat CA.crt, select and copy content.

On vEdge go to linux shell using vshell command, type vim CA.crt to open a empty file in vim editor. Press i key to start inserting text and paste the previous copied content. Use <Esc>wq to write the file and quit. Type exit to go back in vEdge CLI. Now we can import root CA certificate:

vEdge# request root-cert-chain install /home/admin/CA.crt 
Uploading root-ca-cert-chain via VPN 0
Copying ... /home/admin/CA.crt via VPN 0
Updating the root certificate chain..
Successfully installed the root certificate chain

In vManage interface, navigate to Configuration > Devices and select unused vEdge entry, click on the three dots on the right side and select Generate bootstrap configuration. Accept the defaults and click OK. From the new window open we need UUID code and OTP. Go to vEdge console and insert UUID and OTP in the following command:

request vedge-cloud activate chassis <UUID> token <OTP>
example bellow:
request vedge-cloud activate chassis-number ebad1856-1b4a-c89c-d120-25ed7d6945b5 token 58b4fb93b34a13dbfdb8a0c2f29d4fad

in about a minute you can use show control local-properties to check certificate status on vEdge CLI, it should be Installed.

vEdge connected

Because we have to copy root certificate from Docker node to cEdge bootflash, at first we configure only basic system properties and IP address for Ge0/0 interface, using following template:

hostname cEdge
 system-ip <cEdge system IP> 
 site-id 2
 organization-name "pocvlab sdwan"
 vbond <VPN0 VBOND IP>
interface GigabitEthernet1
 no shutdown
 ip address <VPN0 IP address/netmask>

on the Docker node, edit /etc/ssh/sshd_config and permit ssh root login, restart sshd service (not recommended in production environment). Next step is to copy CA root certificate file from Docker to cEdge bootflash, using next command:

cEdge#copy scp://root@ bootflash:                 
Address or name of remote host []? 
Source username [root]? 
Source filename [root/CA.crt]? /root/CA.crt
Destination filename [CA.crt]? 

once file is copied, we can proceed to install certificate:

cEdge#request platform software sdwan root-cert-chain install bootflash:CA.crt
Uploading root-ca-cert-chain via VPN 0
Copying ... /bootflash/CA.crt via VPN 0
Updating the root certificate chain..
Successfully installed the root certificate chain

now we can go ahead and finish configuration for cEdge:

interface Tunnel0
 no shutdown
 ip unnumbered GigabitEthernet1
 tunnel source GigabitEthernet1
 tunnel mode sdwan
 interface GigabitEthernet1
   encapsulation ipsec
   color default

Activate cEdge manually, using chassis number and OTP from Bootstrap Configuration. This is generated from vManage web, Configuration > Devices, select unused CSR1000v line.

request platform software sdwan vedge_cloud activate chassis-number <UUID> token <OTP>
example bellow:
request platform software sdwan vedge_cloud activate chassis-number CSR-6170246D-E8C4-1D4A-A972-5EF144184AB9 token c448da2783609afcc3e9a7a7a17f1dfd

After one minute or so, Tunnel0 interface should go up and certificate installation done, you can check status of control connections on cEdge CLI with show sdwan control connections.

From vManage web interface Configuration > Device we can see the state of WAN Edges:

vManage license status

and in the main Dashboard status of all connected nodes:

vManage main dashboard

Ok, here is the end of this long post. I hope it will be useful.

Lab Resources

Plug and Play Support Guide for Cisco SD-WAN Products

This Post Has 27 Comments

  1. user

    Brilliant article, really detailed and helped me get my lab up and running in no time!

    1. alin.iorguta

      I’m so glad to hear that.

  2. Leonard

    Hello, I’m having some troubles to get the csr1000v-ucmk9.16.11.1a-serial.qcow2 to work.

    I’m trying two things:

    1. Convert it to Vmware VMDK but for some reason the VM keep’s reloading and just give me two option for boot – Package.conf and GOLDEN IMAGE.

    2. I’m trying to run it in eve-ng but the .qcow2 don’t start, it’s like the image is not recognize.

    Do you have any tip to bring this up?

    Thanks a lot

    1. alin.iorguta

      Hi Leonard, you don’t have to convert the image to any other format, it just have to be renamed and placed in a specific directory. Please follow next steps:
      Step 1. SSH to EVE and login as root, from cli create directory for CSRv:
      mkdir /opt/unetlab/addons/qemu/csr1000vng-universalk9.SDWAN.16.11.1a

      Step 2. Upload the downloaded csr1000v-ucmk9.16.11.1a-serial.qcow2 image to the /opt/unetlab/addons/qemu/csr1000vng-universalk9.SDWAN.16.11.1a using FileZilla or WinSCP.

      Step 3. Go to image location and rename uploaded image to virtioa.qcow2 (you can rename using FileZilla or WinSCP):
      cd /opt/unetlab/addons/qemu/csr1000vng-universalk9.SDWAN.16.11.1a
      mv csr1000v-ucmk9.16.11.1a-serial.qcow2 virtioa.qcow2

      Step 4. Fix EVE permissions:
      /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

      After that you can add the vCSR (cEdge) to your topology using template named Cisco CSR 1000V (XE 16.x).

      Good Luck!

  3. Ahmad Khwider

    Hi there !

    It’s really great blog; thanks so much.

    Just a quick question, under Plug and Play Connect (there is a message asking to accept Cisco Universal Cloud Agreement (UCA) for PnP Connect), is it safe to accept it? I’ve read about it, but couldn’t figure out what is it.


    1. alin.iorguta

      Hi, yes no problem with that. Thx.

  4. NKK


    I got error for this

    vEdge# request root-cert-chain install /home/admin/CA.crt
    Uploading root-ca-cert-chain via VPN 0
    Copying … /home/admin/CA.crt via VPN 0
    Error: Not a valid certificate
    Failed to install the root certificate chain !!

    What can cause it? need advice

    1. alin.iorguta

      Check CA.crt from vEdge node, it has to be the same as CA.crt from Docker. You have to go in vshell and cat CA.crt, check if is the same like CA.crt that you generated on Docker node.

  5. Rahul Singh


    Not able to use #Conf t …. giving command not supported on CSR1000v, although loved the image and …. asked for user is Pswd admin/admin …… but not able to get in global configuration mode to install the Evaluation License

  6. Rahul Singh

    Loaded image ….. router booted with user is and pswd…… but not able to enter global configuration mode ……#conf t ….. command not supported

    Pls help to sort out

  7. alin.iorguta

    you have to use config-transaction to enter in configuration mode and don’t forget to use commit when you finish entering your commands.

  8. BB

    Thank for your posting.
    In my lab, Vsmart/Vbond/CSR1KV have already added to Vmanage. But in dashboard VManage, only Vsmart and Vbond are up. CSR1KV (WAN Edge) is down (although I can ping CSR1KV and Vmanage together).
    Let me know if you have any advice. Thanks!

    1. Alin Iorguta

      BB, go in vManage Configuration>Certificates>WAN Edge List and check if the State is green (Certificate installed) for your CSR1K.

  9. NKK

    i did until this step, wait for sometime but license didn’t show install. :/

    request vedge-cloud activate chassis-number xxx token xxx

    Do i need to do anything else?

    1. Alin Iorguta

      Probably you have a problem with vEdge certificate. Check vManage Configuration>Certificates.

      1. NKK

        You are right, i not yet valid the certificate, once i click valid it, it work, i can see vEdge in the dashboard, but the system IP is showing unreachable.

        1. Alin Iorguta

          @NKK Probably is better to start from scratch again.

  10. MSF

    I am getting a real hard time in copying CA certificate content from docker node to a file on vEdge.

    Can you guide as to how to copy from notepad to VIM? Have tried a tonne of methods. thanks

    1. Alin Iorguta

      Look in Docker GUI>Accessories is a text editor called Pluma, it will help you dealing with text files.

  11. Faisal

    Excellent blog
    Going good. I am stuck at the last step. When I do show control local-properties
    on vedge, the certificate status keep on showing not-installed.

    any pointers?

    1. Alin Iorguta

      Go in vManage Configuration>Certificates>WAN Edge List and check if the State is green (Certificate installed) for your vEdge node.

      1. Faisal

        I had to do ‘Send to controllers’ to get it up. once again, thanks for your wonderful blog.

        From here onwards, what do you recommend to further work on SD-WAN? If you can refer some resources, will be great.


        1. Alin Iorguta

          I am glad that you found useful stuff here. You can look at Cisco SD-WAN course on, but i think is the most comprehensive.

  12. Taha

    I dont have the plug and play option or the .viptela file to upload, is there any other manual way of adding the vedges ?

    1. Alin Iorguta

      I’m not sure at which step you’re stuck. Please give more details,

      1. Taha

        I’m stuck on the “WAN Edge” part..
        “From vManage web interface Configuration > Device we can see the state of WAN Edges:”

        I dont have a cisco smart account so that is why couldn’t continue.

        Is there any other way besides uploading the .viptela file to add the vedges to our WAN Edge list?

        1. Alin Iorguta

          As far i know this is the only way you can do this. Try to contact you Cisco local representative, i hope they can help you.

Comments are closed.