APIC-EM Hub/Spoke

After deploying the APIC-EM in ESXi, Could access the controller from management IP, wanted to install CSR1000v in ESXi . Connected to 4331 to LAN . what needed to be configured on the 4331 to make it a HUB router before configuring the HUB site in APIC-EM OR is it plug and play.

 1. configure PKI on CSR1000v and also make this as MC.

2. configure HUB router with zero touch deployment. or configure LAN and WAN interfaces and then define hub site in APIC-EM.

3. How can I configure branch router (zero touch deployment).

1) PKI is configured automatically.  APIC-EM has a PKI Certificate server built-in.  You can select the MC as a check box on the topology for the HUB site.

2) You do not configure the HUB router with PnP.  It is assumed you have two HUB routers deployed.  They only need to have connectivity to the WAN services. APIC-EM is responsible for all of the IWAN Config on the HUB routers:  DMVPN, PfR, QoS, AVC etc.

3) The spoke routers are deployed using PnP.  The spoke will contact APIC-EM and then you indicate which interface is LAN and WAN services and the controller deploys the full configuration to the spoke.  There are a variety of different mechanisms the spoke can use to discover the APIC-EM, all of which are documented in the PnP solution guide Solution Guide for Cisco Network Plug and Play - Cisco (DNS, DHCP, iPhone, USB, and soon a cloud service)