Deployment and Provisioning
What this domain covers
Deployment and Provisioning tests the onboarding workflow: tenant and licensing prerequisites, site and link definition, edge registration, zero-touch activation, templates, and HA. The exam expects you to know what must exist before an edge can come online and how configuration reaches the device.
Core rules
- Prerequisites: a tenant, valid licenses, a network domain, a site, and WAN link definitions. An edge must be assigned to a site before site-scoped policy applies.
- Registration: add the edge by serial number and model, or claim it through the orchestrator. The edge needs outbound HTTPS (TCP 443) to the orchestrator; no inbound port forwarding is required for zero-touch.
- Activation: on first boot the edge obtains an address (DHCP or static), resolves the orchestrator, authenticates with its certificate or activation identity, and pulls its configuration.
- WAN links: configure interface type (DHCP, static, PPPoE), speed, ISP, and role. Link speed must match reality because QoS shaping and path metrics depend on it.
- Templates: device and site templates standardize interfaces, routing, and policy. Changes are staged in the orchestrator and committed; the edge must be online to receive them.
- HA: dual edges or dual links provide redundancy; verify failover and return path, not just tunnel state.
Worked example
A new branch has ISP-A on DHCP and ISP-B on a static /30. In the orchestrator you create the site, define two WAN links with correct speeds, add the edge serial, assign it to the site, and attach a template that sets LAN DHCP, a default route, and a voice QoS policy. The edge boots, gets DHCP on WAN1, reaches the orchestrator over 443, and downloads the config. You verify both links are up, tunnels are established, and the voice policy is applied. If WAN2 stays down, check the static IP, gateway, and upstream NAT before changing the template.
Traps
Forgetting to assign the edge to a site; entering ISP speed as line rate but shaping incorrectly; overlapping LAN subnets; assuming zero-touch needs inbound firewall rules; committing a template before the edge is online; and treating link up as proof that the overlay tunnel and policy are working.