Re: [Netconf] send 'version' in zerotouch url?

[Kent Watsen <[e-mail]>]

Another follow-up on this thread, regarding also defining a 'os-name' query param.

Both Radek and Dean raised a point about white-boxes on top of which software is installed to give it a personality.  For instance, a generic white-box might be a vendor-x router, or a vendor-y firewall, or a vendor-z switch.   This means is that the white-box's serial-number alone doesn't uniquely identify the device or, more specifically, what configuration to send it.  Of course, an inventory-tracking system should know which software was installed, but doing so isn't convenient.  Better would be to have a query parameter called something like "os-name" to indicate what software is install. Thoughts?

A related consideration to this regards the IDevID certificate.  In the case of a white-box, the IDevID certificate would presumably be set by the white-box manufacturer.  This isn't a problem, per se, as the bootstrap-server can also trust the white-box manufacturer's trust anchor cert, and thus still be assured that it's connected to the actual device.  However, it might be desirable if, at the time of installing software on the white-box, an LDevID certificate is configured and used instead.  There's no security issue here, the only issue is that the draft current only supports IDevID certs (a minor tweak is needed).  Any comments on this?

Thanks,
Kent