SZTP: Secure ZTP

You can use secure zero-touch provisioning (secure ZTP) to provision devices from a central location over the Internet. In addition to the secure ZTP software, you can use other components to provide security: 

• A device ID (DevID) added to the Trusted Platform Module (TPM) 2.0 helps the device provide its authenticity to the phone-home, bootstrap, or redirect server. 
• The device uses vouchers to verify the authenticity of the bootstrap information that it receives from the bootstrap server. 
• The device also uses vouchers to verify the trust anchors that the redirect server sends. 

Here's the secure ZTP workflow: 

1. The device requests a TLS session with the bootstrap server. 
2. The bootstrap server responds to the device and requests the DevID certificate, DevID private key, and verification that Juniper or another certified vendor issued the DevID certificate. 
3. The device signs the session data with the DevID private key. 
4. The device sends the signature and the DevID certificate to the bootstrap server. 
5. The bootstrap server uses the DevID certificate to verify the signature and that the DevID certificate uses a Juniper-issued trust anchor. 

On the DHCP server, enable DHCP option 143 to provide redirect server information and the name of the DNS server.