CCNA Security online course

Add and Manage a Router in Cisco Configuration Professional (CCP)

Learn how to prepare a Cisco router for Cisco Configuration Professional, configure web management and local privilege-15 access, and add the router to a CCP community.

Cisco Configuration Professional (CCP) is a graphical application for configuring and monitoring supported Cisco routers. Instead of performing every task through the IOS command-line interface, an administrator can use CCP to manage supported router features through a graphical interface.

Before CCP can manage a router, the router must be running, reachable from the administrator workstation, and prepared to accept web-based management connections. You add the router to a CCP community, which is an organizational grouping of managed routers.

What Cisco Configuration Professional Requires

CCP needs two types of readiness: network reachability and router management access. The workstation must be able to reach a router interface, and the router must provide an enabled HTTP or HTTPS management service that can authenticate the supplied local account.

The address entered into CCP is the router's management IP address. This is a reachable IP address configured on a router interface. It does not have to be a special interface named “management”; any suitable, reachable interface can serve this purpose.

Key terms

  • Cisco Configuration Professional (CCP): Cisco's graphical application for managing supported router features and configurations.
  • Community: A CCP device grouping used to organize routers by site, department, lab, or another administrative purpose.
  • Community Information: The CCP area that lists devices added to the selected community.
  • HTTP server: The Cisco IOS web-management service enabled with ip http server. HTTP traffic is unencrypted.
  • HTTPS secure server: The Cisco IOS web-management service enabled with ip http secure-server. HTTPS encrypts the management connection.
  • Local authentication: Authentication against usernames and passwords stored in the router's local database.
  • Privilege level 15: The highest standard Cisco IOS privilege level. It provides full administrative access.
  • Device discovery: CCP's process for locating and identifying devices associated with a community.

Router Prerequisites Before Adding It to CCP

Complete these checks before opening the add-device workflow:

  1. The target router is powered on and running.
  2. The router has an IP address configured on an interface that is reachable from the CCP workstation.
  3. The relevant router interface is operational and not shut down.
  4. The workstation has IP connectivity to the router management address.
  5. The HTTP server, HTTPS secure server, or both are enabled.
  6. HTTP and HTTPS authentication use the router's local username database.
  7. A local administrator account exists with privilege level 15.
  8. You know the exact username and corresponding secret to enter in CCP.

CCP cannot compensate for a missing Layer 3 path, an inactive interface, disabled web services, or invalid credentials. Resolve those conditions before attempting to add the router.

CCP Router Onboarding Requirements

Requirement — Why It Is Needed — How to Verify

Router powered on — IOS must be running to accept management connections — Check console access, device status, and normal IOS operation.

Reachable management IP address — CCP uses this address to contact the router — Verify the address on the router and test it from the workstation.

HTTP service enabled — Provides unencrypted web-management connectivity when required — Check for ip http server.

HTTPS service enabled — Provides encrypted web-management connectivity — Check for ip http secure-server.

Local HTTP authentication enabled — Makes the local username database the source of credentials — Check for ip http authentication local.

Local privilege-15 account configured — Gives CCP a full administrative identity — Verify the username has privilege 15.

CCP workstation network connectivity — Allows the workstation to reach the router's management service — Test with ping and review workstation addressing and routing.

Configure Router Web Management Access

Use the router CLI to enable the web-management service and create the local administrator account. The following example prepares router R1:

R1> enable
R1# configure terminal
R1(config)# ip http server
R1(config)# ip http secure-server
R1(config)# username administrator privilege 15 secret cisco
R1(config)# ip http authentication local
R1(config)# end

The sample password cisco is included only to show command syntax. Use a long, unique secret in a real deployment.

What each command does

Command — Purpose — Notes

ip http server — Enables the plain HTTP management service — HTTP traffic is unencrypted.

ip http secure-server — Enables the HTTPS secure management service — HTTPS provides encrypted management transport.

username <name> privilege 15 secret <password> — Creates a local administrator account — The account must have privilege level 15; use a strong secret.

ip http authentication local — Selects the router's local username database for HTTP and HTTPS authentication — This allows the configured local administrator to authenticate through CCP.

If both services are available, prefer HTTPS. HTTP sends management traffic without encryption, so credentials and administrative data may be exposed to someone able to observe the connection. Enabling HTTPS does not remove the need for correct authentication and network access controls.

Verify Reachability and Access Readiness

Verify the router and the workstation separately before starting CCP. On the router, inspect interface addressing and state:

R1# show ip interface brief

Confirm that the intended interface has the expected IP address and is in an operational state. An interface that is administratively down, physically disconnected, or assigned to the wrong network cannot provide a reachable management address.

From the CCP workstation, test the router address:

ping <router-management-ip>

A successful ping confirms basic IP reachability, although it does not prove that the web-management service or credentials are correct. If ping fails, check the following:

  • The IP address entered is the router's current address.
  • The workstation has a correct IP address, mask, and default gateway where a gateway is required.
  • The router interface is up and has the expected address.
  • Routing exists between the workstation and the router if they are on different networks.
  • A firewall or access-control policy is not blocking the management connection.

Also verify the relevant configuration and account information on the router. For example:

R1# show running-config | include ^username|ip http

Confirm that the output reflects the intended HTTP or HTTPS service, local authentication, and a privilege-15 username. Avoid exposing secrets in shared screenshots or documentation.

CCP Communities

A CCP community is an organizational grouping of managed routers. A community might represent a headquarters site, a branch-office group, a department, a classroom lab, or a geographic region.

Item — Guidance

Definition of a community — A CCP grouping that organizes managed routers.

Suggested grouping methods — Group by site, department, lab, geographic location, or administrative purpose.

Maximum devices per community — One community supports a maximum of 10 devices.

Where to confirm added devices — Review the Community Information area for the selected community.

A router is added to the selected community; it does not simply appear in a global CCP inventory without an organizational context. Choose a community whose purpose matches how you plan to administer the device.

Add a Router During Initial CCP Startup

When CCP starts for the first time, it displays the Select/Manage Community prompt. This prompt is used to select an existing community or create a new one and then add managed devices.

  1. Start Cisco Configuration Professional.
  2. At the Select/Manage Community prompt, select the appropriate existing community, or create a new community with a meaningful name.
  3. Enter the target router's reachable management IP address.
  4. Enter the local username configured with privilege level 15.
  5. Enter the matching password or secret.
  6. Select the option to Discover all devices if CCP should automatically discover other eligible devices associated with that community.
  7. Confirm the addition.
  8. Allow CCP to connect to the router and complete its discovery process.

The credentials entered in CCP must match the local account configured on the router. A console or privileged EXEC password alone is not a substitute for the local privilege-15 username expected by the web-management authentication process.

Adding only the intended router

If you are onboarding one known router and do not want CCP to search for other devices, leave automatic discovery disabled when the workflow provides that choice. If you want CCP to identify other eligible devices in the community, enable Discover all devices and review the results carefully.

Confirm Successful Router Addition

After CCP finishes connecting and discovering the device, open or review the selected community's Community Information area.

Confirm all of the following:

  • The router appears in the selected community.
  • The displayed device identity corresponds to the intended router.
  • The displayed management address matches the address entered during onboarding.
  • The device status indicates successful communication or an equivalent healthy state.

CCP must successfully authenticate and communicate with the router before configuration and monitoring tasks can begin. Seeing an entry alone is not enough if the device is shown as unreachable or authentication has not completed.

Practical Examples

Prepare router R1 for CCP management

An administrator wants to manage R1 from a workstation running CCP.

  1. Ensure R1 has a reachable management IP address and that the relevant interface is operational.
  2. Enable HTTP, HTTPS, or both according to the management policy.
  3. Create a local administrator with privilege level 15.
  4. Set HTTP authentication to use locally configured usernames.
  5. Test reachability from the CCP workstation to R1.
  6. Start CCP and add R1 by entering its IP address and local administrator credentials.
  7. Check Community Information to confirm the router was added.

Organize routers by location

A small organization manages routers at two offices. Create one community for headquarters routers and another for branch-office routers. Add each reachable router to the community matching its physical location, while keeping each community at or below 10 devices.

Use device discovery while adding a router

An administrator wants CCP to identify other eligible devices associated with a community. Enter the initial router's management IP address and credentials, enable Discover all devices, allow discovery to complete, and review the resulting device list under Community Information.

Troubleshooting CCP Router Addition

CCP cannot contact the router at the entered IP address

Likely causes: The address is incorrect, there is no Layer 3 path, the interface is shut down or disconnected, or the workstation has incorrect addressing, gateway, or routing.

  • Verify the IP address entered in CCP.
  • Ping the address from the workstation.
  • Check the router interface address and operational state.
  • Correct addressing or routing before trying again.

CCP reaches the router but authentication fails

Likely causes: The username or password is incorrect, local authentication is not selected, or the account does not have privilege level 15.

  • Verify the configured username and secret.
  • Confirm ip http authentication local is present.
  • Confirm the account has privilege 15.
  • Re-enter the corrected credentials in CCP.

CCP cannot establish web-management communication

Likely causes: Both web services are disabled, the required service is unavailable, or an access-control policy or firewall blocks the connection.

  • Enable ip http server and/or ip http secure-server as appropriate.
  • Prefer HTTPS for secure management.
  • Review filtering and firewall rules between the workstation and router.

The router does not appear after being added

Likely causes: The wrong community is selected, discovery did not complete, connectivity or credentials failed, or the community already contains 10 devices.

  • Return to Select/Manage Community and verify the selected community.
  • Confirm the community has no more than 10 devices.
  • Repeat the add process with the verified IP address and credentials.
  • Check Community Information after discovery completes.

Exam-Relevant Notes

  • CCP is a graphical management application for supported Cisco routers; it still depends on correct IOS and network preparation.
  • The router must have a reachable IP address before it can be added.
  • ip http server enables HTTP, while ip http secure-server enables HTTPS.
  • ip http authentication local tells the web-management service to use the router's local username database.
  • The CCP administrator account must be configured at privilege level 15.
  • HTTPS is preferred over HTTP because it encrypts the management connection.
  • A CCP community organizes devices and supports a maximum of 10 devices.
  • Successful addition is confirmed in Community Information by checking the device identity and management address.

For related preparation, review the CCP overview, CCP installation, and secure router administration with SSH.