Zero-touch provisioning (ZTP) is a way of deploying network equipment so that a new device configures itself when it is powered on and connected, instead of an engineer configuring it by hand on site. The device reaches a provisioning or management service, proves its identity, and downloads its software and configuration. ZTP is widely used in SD-WAN rollouts and by managed network providers to bring up branch sites quickly and consistently.
Not to be confused with imaging and zero-touch deployment, which sets up company laptops and other computers with a standard configuration and enrolls them in device management.
At a glance
- ZTP removes on-site configuration work, not the physical work of installing and cabling the device.
- The device is usually registered in advance by serial number or certificate, then shipped directly to the site.
- On first boot it reaches a cloud or on-premises provisioning service and pulls its configuration.
- It is common in SD-WAN, wireless and branch networking, and support varies by vendor and model.
- It typically depends on the site having working connectivity, often internet with automatic addressing.
What problem it solves
Rolling out a network at many locations used to mean either sending a skilled engineer to each site or preconfiguring every device at a staging center and shipping it out. Both are slow and expensive, and hand-built configurations drift from one site to the next. Replacing a failed router at a remote branch could mean waiting for an engineer to travel.
ZTP lets the central team define configurations in templates, assign them to devices by serial number, and ship devices straight from the distributor. Someone at the site, such as an office manager or a field technician, plugs it in. The device comes online with the intended configuration, and the central team can confirm it from a dashboard.
How it works
Registration. The device’s serial number, certificate or other identity is registered with the vendor’s or provider’s provisioning service and linked to a site and configuration template.
First boot. When powered on, the device looks for network connectivity, commonly by requesting an address automatically through DHCP on its WAN port. Some devices can use cellular or other fallback connections.
Discovery. The device contacts a known provisioning address, often built into its software, or learns one from the network. It authenticates, usually with a certificate installed at the factory.
Configuration and software. The service sends the device its configuration and, where needed, a software update. The device applies them and connects to the central management platform.
Ongoing management. Once provisioned, the device is usually managed centrally, so later changes can also be pushed without a site visit. Details depend on the platform; some on-premises equipment uses older script-based methods that fetch a file from a server on the local network.
Managed providers often handle registration and templates for you; our Managed Network Services page covers how those services are structured.
When it matters for buyers
- Multi-site rollouts. Retail chains, clinics, branch offices and franchise networks benefit most, because savings grow with the number of sites.
- Choosing SD-WAN or customer premises equipment. Check how ZTP works on the specific models offered, not just whether the brochure mentions it.
- Sites with unusual connectivity. Static IP addressing, proxies or a locked-down upstream network may need a manual step before ZTP can work.
- Spares and replacements. ZTP can shorten the time to replace a failed device, as long as spares are registered and stocked.
Questions to ask vendors
- What does someone at the site need to do, step by step, and what skills do they need?
- What connectivity must be in place before the device can provision itself?
- How is the device authenticated, and how is the configuration protected in transit?
- Who registers devices and builds the templates: us, you, or a reseller?
- What happens if provisioning fails, and how is that escalated?
- How are replacement devices registered and shipped after a failure?
How it differs from SD-WAN
SD-WAN is a way of building and managing a wide area network that steers traffic across several links. ZTP is a deployment method: how a device gets its initial configuration. SD-WAN products made ZTP familiar because they are managed centrally and installed at many sites, but ZTP is also used for switches, access points, firewalls and customer premises equipment outside SD-WAN. Buying SD-WAN does not by itself mean every rollout will be zero-touch; confirm what the vendor’s process actually requires at your sites.