Abstract: A downstream network device is booted into a final provisioned state by retrieving a configuration file a first time from an upstream network device, and checking if a currently booted software load of the downstream device matches a first software load (EE) described by the configuration file. If the currently booted software load of the downstream device does not match the EE, the downstream network device checks if the configuration file includes a description of a second software load (NE), and if so, the downstream network device checks if the currently booted software load matches the NE, and if not, the downstream network device downloads the first software load, boots the first software load, and retrieves the configuration file a second time.