About managed gateways

Before enrolling a gateway, do note that there is no support for the following:

• Cisco 1100 Integrated Services Router platforms.

• High Availability (HA) mode.

• Controller or SD-WAN mode (Site Survivability only supports gateways running in Cisco IOS XE Autonomous mode).

• Cisco IOS Voice Gateways, such as VG400, which is fully managed as devices in Control Hub.

The following are the prerequisites for enrolling a gateway:

• Access to Control Hub as an organization administrator.

• IP addresses, usernames, and passwords for the devices that you want to configure.

• Cisco IOS XE Version:

  • Local Gateways—Cisco IOS XE Amsterdam 17.3.4a or later.

  • Survivability Gateways—Cisco IOS XE Cupertino 17.9.3a or later.

• System Requirements:

  • Minimum free memory—256 MB

  • Minimum disk space—2000 MB (This includes 1100 MB for Guestshell container and 500 MB for connector applications). If an SSD (harddisk:) is installed, this will be used for the connector installation. In all other cases, System bootflash: will be used.

If you're using a router with 4GB of bootflash and less than 2GB of available capacity (the minimum capacity), delete all IOS binary (.bin) images, except the one that is currently running. After you delete files, free up additional space. Use the following steps to expand binary image and boot from components:

1. Create a new directory using mkdir bootflash:/image.

2. Expand the IOS binary image using: request platform software package expand file bootflash:/<image>.bin to bootflash:/image.

3. In configuration mode, remove current boot options using: no boot system.

4. Configure new boot statement: boot system bootflash:/image/packages.conf.

5. Exit from configuration mode, save configuration, and reboot.

6. Once the router has restarted, use show version to verify that the router booted from bootflash:/image/packages.conf. If yes:

   1. Verify that the bootflash:/sysboot directory is empty.

   2. Delete the remaining IOS binary image.

   3. Delete any core images using delete /f /r bootflash:/core/*.

   4. Delete tracelog files using delete /f /r bootflash:/tracelogs/*.

   5. If there is still insufficient disk space, review any the remaining files in bootflash: and delete any other non-essential files such as logs and CDRs.

• A supported Cisco router, which is connected to a network with a path to the internet. The basic configuration must have the following:

  • DNS server configured to resolve public domain names.

    To configure the DNS server, use the following commands: ip name-server <IP address>

  • HTTP Proxy server if you want to reach to the internet through a proxy.

    To set a proxy server, use the following commands: ip http client proxy-server <server address> proxy-port <port number> If the proxy server needs authentication, use the following commands to authenticate: ip http client username <username> ip http client password <password>

  • Gateway credentials: Credentials (username and password) with privilege level 15 access that the connector can use to access the gateway through its NETCONF interface.

    To authenticate and authorize NETCONF access, ensure that the default aaa lists are configured as illustrated below. You can use any method option in the default list. However, it's not possible to use a named aaa list to control NETCONF access. If the default lists are not configured correctly, you may see an "invalid method list" error message in the system log.

    aaa new-model
    aaa authentication login default radius local
    aaa authorization exec default radius local if-authenticated
    username test privilege 15 secret <password>
    

  The following are the network prerequisites:

  • The connector IP address must be in the same network as the one chosen for external connectivity. It can be a private network address, but it must have HTTP access to the internet.

  • You must have connectivity to the Control Hub and on-premises devices to complete the enrollment process.

  • URLs that need to be accessed for Webex services

    • *.ucmgmt.cisco.com

    • *.webex.com

    • *.wbx2.com

  • Transport protocols: Transport Layer Security (TLS) version 1.2.

  • Import the IOS public certificate authority bundle. The certificates added to the gateway trust pool are used to verify access to Webex servers. Use the following configuration command to import the bundle.

    crypto pki trustpool import url http://www.cisco.com/security/pki/trs/ios.p7b

Connector states of both management and telemetry connectors are displayed on the connector details page at https://{connector IP address}.

To manage your gateway instance:

1. Under SERVICES, click Calling and then the Managed Gateways tab.

2. For the applicable gateway instance, click the adjacent dots (…) in the Actions column and select the applicable action.

Pause or resume connector

Pause Connector instructs the management connector to stop the telemetry connector. You can use this option to stop the telemetry connector temporarily while troubleshooting any issues with a gateway. When you pause the connector, services such as configuration validation doesn’t work. Use the Resume Connector action to restart the telemetry connector.

Click Pause Connector from the Actions menu to pause your management connector.

To resume the connector that you paused, click Resume Connector in the Actions menu.

Event history

Control Hub records and displays the event history for your managed gateways. You can view the details of an individual gateway or the consolidated details of all your managed gateways. Click Event History in the Calling page for the event details of all your managed gateways.

For event details specific to a gateway, click Event History in the Actions menu for that gateway.

Delete gateway

Click Delete Gateway in the Actions menu to delete any of your gateway instances. Click Confirm.

You can’t delete a gateway instance with assigned services. You must unassign the services first.