Before you begin
- A Atlas AVD plan. The Integrations hub is not available on Community
- The Administrator role in Atlas to connect, configure or disconnect a connector. Integrations appears under Administration only for administrators
- A tenant selected in the tenant picker. Credentials are stored encrypted per tenant, so each tenant you manage connects its own account
- A Catalyst Center user with the read-only OBSERVER-ROLE, or a custom role that can read sites and network devices
- Catalyst Center reachable at a public https address with a certificate from a public certificate authority (the built-in self-signed certificate is not accepted)
- To sync into Vault: a Vault admin and at least one asset template (the Network Device template is a good fit)
What you can do
- Document every switch, router, wireless LAN controller and access point in a Catalyst Center site as an Atlas Vault asset, with no manual data entry.
- Map each Catalyst Center area, building or floor to the customer company it belongs to. A site includes everything under it.
- Keep the documentation current: every hour Atlas adds new devices, updates changed details and archives devices that are no longer in the site.
- See what changed and when: hostname, serial number, model, role, management IP, software version, site and an access point's controller, each with the previous value kept.
- Ask Atlas Advisor about documented equipment, for example "list our wireless LAN controllers".
Step 1: Create a read-only user
- In Catalyst Center, go to System → Users & Roles → User Management and add a user.
- Give it the built-in OBSERVER-ROLE, or a custom role that can read sites and network devices. A dedicated user is best, so you can see Atlas's sign-ins and change its password without affecting anyone else.
Step 2: Give Catalyst Center a trusted certificate
Catalyst Center ships with a self-signed certificate, and Atlas does not accept it: Atlas checks every certificate and only connects to public addresses. Install a certificate from a public certificate authority under System → Settings → Certificates, or publish Catalyst Center through a reverse proxy that presents one, at a public https address.
An address that resolves to a private or internal network, or that is not served over https with a publicly trusted certificate, is refused. Nothing is stored until the connection succeeds.
Step 3: Connect in Atlas
Once connected, the card shows Manage, which opens Atlas Vault → Assets, and Disconnect. The password is stored encrypted and is never shown again.
- Select the tenant in the tenant picker.
- Go to Administration → Integrations and click Connect on the Cisco Catalyst Center card.
- Enter the Catalyst Center address, for example https://catalyst-center.example.com. You can paste the address of any Catalyst Center page; Atlas keeps the address and drops the rest.
- Enter the username and password of the read-only user.
- Click Connect. Atlas signs in and counts your devices before saving anything; if the sign-in or address is rejected, nothing is stored.
Step 4: Map each site to a company
Add one sync per customer site. Each site can be mapped only once in an Atlas tenant, and a site already includes the buildings and floors under it, so map each customer once rather than an area and its buildings. When your customers live in separate Atlas tenants, connect Catalyst Center in each tenant.
- Open Atlas Vault → Assets → RMM & PSA sync and click Add sync.
- Source: Cisco Catalyst Center.
- Device type: pick a site. Sites are listed by kind and full path, for example Area: Global/US/Contoso or Building: Global/US/Contoso/HQ. Pick the area or building that holds one customer's network.
- Template: pick Network Device. Atlas fills in the field mappings for you: Name, Type (from the device family), Manufacturer, Model, Serial Number, Management IP, MAC Address, Firmware Version and Location (the site path). You can change or add any mapping.
- Company: the customer this site belongs to.
- Leave Sync automatically every hour on, click Save Changes, then click Run now to document it straight away.
What gets documented
- Identity: hostname, serial number, product ID (model), family, series and role.
- Type: the Catalyst Center device family fills the Network Device template's Type: Switch, Router or Access Point, and Other for a wireless LAN controller.
- Network: the management IP address and MAC address.
- Software: the software type and version.
- Operational: whether Catalyst Center can reach the device.
- Placement: the site the device is assigned to, its SNMP location, and an access point's controller.
Each device is matched by its serial number, which Catalyst Center reads from the hardware. Renaming a device, moving it to another site, or removing and rediscovering it in Catalyst Center updates the same asset. A switch stack is one asset that carries every member's serial number; adding or replacing a member documents the stack again as a new asset. Interfaces, clients, topology, configuration and assurance data are not documented.
Your own documentation is kept
Atlas only fills the fields you map. Notes, attachments, custom fields and anything else you add in Vault are yours and are never touched. If you edit a mapped field by hand, Atlas keeps your value; if Catalyst Center later reports something different, the field is flagged under Drift to review so you can choose which to keep. A device that leaves the site is archived, not deleted, and comes back automatically if it returns. Atlas archives a device only after a complete read, so an outage or a rejected sign-in never empties your documentation.
Change history
Open an asset's ⋯ menu and choose History to see what changed: when the device was first documented, a new hostname, serial numbers, model, role, management IP, software type or version, site or controller (each with the previous and new value), when it was no longer in the site, and when it came back. Reachability changes are not recorded. The same entries appear on the Operations Timeline.
Ask Atlas Advisor
Atlas Advisor answers questions from the documented assets, read-only and limited to what you can see in Vault, with or without an AI provider. For example: "Which Catalyst Center devices are unreachable?", "list our wireless LAN controllers" or "Is Catalyst Center connected?".
What the integration does not do
- It is read-only. It never creates, changes or deletes anything in Catalyst Center; it only signs in and reads.
- It does not document interfaces, clients, topology, configuration or assurance data.
- It does not accept Catalyst Center's self-signed certificate, or connect to a private address.
- It syncs every hour or when you click Run now; the interval cannot be changed.
- It connects one Catalyst Center per Atlas tenant. Credentials cannot be edited in place: disconnect and connect again with the new password.
GCC High tenants
On a tenant or deployment in Azure Government (GCC High), calls to Cisco Catalyst Center are blocked by default, because they can carry VM, host-pool and tenant names to a service outside the Government boundary. Connect fails with an Azure Government (GCC High) egress boundary message and nothing is stored, and pages that read from Cisco Catalyst Center stay empty. The operator who runs your Atlas deployment can approve Cisco Catalyst Center as a destination that is allowed to receive that data; once approved, the connector works normally. Running in Azure Government does not by itself make a third-party integration GCC High or CMMC compliant.
Disconnecting
Click Disconnect on the card and confirm. Atlas deletes its stored copy of the password and pauses every Atlas Vault sync from Catalyst Center. The documented assets and their history stay in Vault; turn the syncs back on after you reconnect. Nothing changes in Catalyst Center. Remove the user there too if you no longer need it.
Troubleshooting
- The connection test says Catalyst Center rejected the credentials: the username or password is wrong, the user is locked, or its role cannot read the inventory.
- The connection test says the server URL is not allowed: the address resolves to a private or internal address, or is not https. Publish Catalyst Center at a public https address.
- The connection test cannot connect: check the address is right and that Catalyst Center presents a certificate from a public certificate authority, not its self-signed one.
- A site is missing from the Device type list: the user's role cannot read it. Give the role access, then add the sync again.
- A sync fails for one site: Catalyst Center could not return its devices, for example because it was unreachable or busy. The documentation is kept until the next successful sync.
- A sync reports the integration is not configured: Catalyst Center was disconnected. Connect it again, then turn the sync back on.