Add and Manage a Router in Cisco Configuration Professional (CCP)

Learn how to prepare a Cisco router for CCP access, enable HTTP or HTTPS management, add the router to a community, verify discovery, and troubleshoot enrollment.

Cisco Configuration Professional (CCP) is a graphical router-management application used to monitor and configure supported Cisco routers. CCP runs on a workstation and connects to a router through the network, using the router's management IP address and IOS web-management services.

A router cannot normally be added successfully until it has been prepared for web-based management. The general workflow is:

1. Configure the router prerequisites, including a reachable IP address, HTTP or HTTPS service, local authentication, and a privilege level 15 user.
2. Verify reachability and management-service access from the workstation running CCP.
3. Launch CCP and open the community selection and management interface.
4. Create or select a community, enter the router details and credentials, and choose the discovery behavior.
5. Confirm that CCP discovers the router and can retrieve its inventory and configuration information.

Router Readiness Requirements

Before adding a device, confirm that the router is powered on, has completed booting, and has an IP address on an active interface. The address must be reachable from the workstation running CCP. The router and its IOS image must also support the installed CCP version and the management features being enabled.

Use the address of a routed interface that the workstation can reach. This may be a dedicated management interface, a loopback address, or another correctly routed interface, depending on the network design.

Enable HTTP and HTTPS Management Services

The IOS HTTP server provides web-based management over HTTP. HTTPS provides the same general type of service over an encrypted connection. HTTP commonly uses TCP port 80, while HTTPS commonly uses TCP port 443.

HTTPS may require cryptographic support or additional IOS capabilities. Older platforms and software images can differ, so verify feature support before relying on HTTPS. Enabling HTTPS does not automatically make the network path reachable; ACLs, firewalls, and host security controls must also permit the service.

Configure Local Authentication for CCP

Local authentication means that IOS checks the supplied username and password against accounts configured on the router itself. Create a dedicated administrative account with privilege level 15. Privilege level 15 is the highest standard IOS privilege level and normally grants full administrative access.

A secret-based password is preferred to an older reversible password form. The secret keyword stores the credential using a protected IOS mechanism, while the older password keyword can expose a weaker, reversible representation in the configuration.

Example Router Preparation

The following example prepares R1 for local CCP web-management access. Replace the placeholder with a strong, unique secret.

R1(config)# ip http server
R1(config)# ip http secure-server
R1(config)# username administrator privilege 15 secret <strong-secret>
R1(config)# ip http authentication local

The router must also have correctly configured addressing and an active interface. Those interface commands depend on the topology and are not part of the minimum web-management configuration shown above.

Verify Reachability Before Launching CCP

Test IP connectivity before attempting enrollment. A successful ping is useful evidence that addressing, routing, and basic reachability are working, but a failed ping does not prove that HTTP or HTTPS is unavailable: ICMP may be filtered while TCP 80 or TCP 443 remains permitted.

Use both an IP test and a service-specific test when possible. From a Windows workstation, a permitted PowerShell test can check a TCP port:

Test-NetConnection <router-management-IP> -Port 443
Test-NetConnection <router-management-IP> -Port 80

Equivalent tools may be available on other operating systems. Use the protocol and port selected for CCP. On the router, useful verification commands include:

R1# show ip http server session-module
R1# show running-config | include ^ip http|^username
R1# show ip interface brief
R1# ping <CCP-workstation-IP>

Use platform-appropriate alternatives if command output differs. Check interface status, IP addressing, HTTP and HTTPS settings, and the intended local username.

Network Access Considerations

Several controls can prevent a correct CCP configuration from working:

• An incorrect management IP address or missing route.
• An administratively down interface, an unplugged link, or an incorrect VLAN assignment.
• An ACL or firewall blocking TCP 80 or TCP 443.
• A host firewall on the CCP workstation blocking the connection.
• Different routing or security policy in the return direction.
• HTTP or HTTPS disabled on the router.

Management access should be restricted to a trusted management network where possible. Do not expose the router's web-management service broadly when a narrower ACL or firewall policy can be used.

CCP Communities

A community is a logical CCP grouping of managed routers. Organizations might group devices by branch, site, lab, or administrative domain. The community is an organizational object; it does not replace IP routing or create connectivity between devices.

When CCP starts, or when communities are managed, it presents a Select/Manage Community window. This is where you choose an existing community or create a new one before adding devices.

Add a Router to a Community

1. Launch CCP and open the Select/Manage Community window if it is not already displayed.
2. Select an existing community or create one that represents the site or administrative group.
3. Start the device-add process in that community.
4. Enter the router's reachable management IP address or routed interface address.
5. Enter the local username and password configured for CCP. The account should have privilege level 15.
6. Choose the discovery behavior. Select the Discover all devices option when you want CCP to search for additional reachable, manageable devices associated with the specified router or discovery context.
7. Confirm the entries and allow CCP to attempt authentication and discovery.

The exact labels and dialog arrangement can vary between legacy CCP releases. The important controls are the community selector or creator, the device address fields, the username and password fields, the discovery option, and the confirmation control.

What “Discover all devices” Does

Discover all devices is a CCP enrollment option that tells CCP to look beyond the explicitly entered router for other devices it can identify and manage in the relevant discovery context. Discovery still depends on routing, access controls, compatible devices, available credentials, and the behavior supported by that CCP release. It is not a guarantee that every router in the network will be found.

If you only want to add the specified router, leave broad discovery unselected when that option is available. If you select it, review the results rather than assuming that every discovered device is authorized for management. A single CCP community supports a maximum of 10 devices. When that limit is reached, add devices to another appropriate community or manage the existing membership.

Confirm Successful Device Addition

After enrollment, inspect the Community Information area. This area displays the devices belonging to the selected community and their details.

• Confirm that the router's IP address or hostname is correct.
• Check that the displayed identity corresponds to the intended router.
• Review the connection or status information for an online or successfully connected state.
• Open the device view and verify that CCP can retrieve router inventory and configuration information.

Do not use CCP configuration workflows until authentication and discovery succeed. A device that appears in a community but cannot provide inventory or configuration data still has an unresolved management problem.

HTTP Versus HTTPS Security

HTTP sends web-management traffic without encryption. HTTPS protects the connection in transit, although it does not remove the need for strong credentials, access restrictions, or correct certificate and platform support.

• Use HTTPS rather than HTTP whenever the platform, IOS image, and CCP version support it.
• Use a unique strong local administrative secret instead of a simple training password.
• Restrict management access to trusted networks and permit only the required TCP service.
• Disable unused HTTP or HTTPS services when CCP administration is no longer needed.
• Treat privilege level 15 credentials as highly privileged administrative secrets.

Troubleshooting CCP Enrollment

Practical Example: Add a Branch Router

Suppose a workstation must manage branch router R1 at its reachable management address. An administrator enables HTTP and HTTPS, creates the local administrator account at privilege level 15, and configures local HTTP authentication:

R1(config)# ip http server
R1(config)# ip http secure-server
R1(config)# username administrator privilege 15 secret <strong-secret>
R1(config)# ip http authentication local

The administrator then verifies the router's interface status and tests reachability and TCP 443 from the workstation. In CCP, the administrator opens Select/Manage Community, creates a community for the branch, enters R1's management IP address and the local credentials, selects Discover all devices only if related-device discovery is desired, and confirms. The final check is the router entry and connection status in Community Information, followed by opening the device view to confirm that inventory and configuration data can be retrieved.

Exam-Relevant Notes

• CCP is a graphical management application; the router still requires IOS-side preparation.
• A reachable management IP address is necessary, but a failed ICMP ping alone does not prove that TCP management access is impossible.
• ip http server enables HTTP, while ip http secure-server enables HTTPS.
• ip http authentication local makes the web service use locally configured usernames.
• The CCP account should normally be privilege level 15 for full device discovery and management.
• A community groups managed routers and supports up to 10 devices.
• Discover all devices requests broader CCP discovery, but results depend on reachability, credentials, compatibility, and CCP release behavior.
• HTTPS is preferred over unencrypted HTTP whenever supported.

For related study, review Cisco Configuration Professional router management alongside IOS management-plane security, ACLs, SSH, and local versus AAA authentication.