Cisco Smart License Configuration For IOS-XE And NXOS

Welcome to my blog where i am going to configure Cisco Smart Licensing on Multipe Cisco operating system. This blog will take you through the detailed steps of configuration.
These configurations were performed in real environments, and the results may VARY depending on your environments.
For more details please visit https://cisco.com/go/licensingguide

I Used USB In Offline Method where the USB should be FAT32 All Cisco Devices support FAT32 USB.

Cisco Smart License Configuration For IOS-XE And NXOS

Prerequisites

Before enabling or migrating to Smart Licensing, ensure:

1. Smart Account: Create and access a smart account at the Cisco Smart Software Manager portal OR used to create users who organize licenses according to company requirements.
2. Device Registration: Register your device using the generated token from CSSM.
3. Smart Licensing: Manage the software license.
4. Cisco Smart Software Manager (CSSM): It is active and manages Cisco licenses.
5. Connectivity: Configure Layer 3 connectivity to the CSSM satellite.

Restrictions for Smart Licensing

1. Connectivity: Only works if routers connect directly to CSSM or a satellite server.
2. Browsers: Use Chrome 32.0, Firefox 25.0, Safari 6.0, or later, with JavaScript enabled.
3. Platform Limitations: DLC not supported on ASR 1000 RP2 with non-universal K9 images. Use IOS XE 16.3, 16.6, or 16.9 before upgrading to 16.10.1a.
4. Unsupported Releases: Do not use Smart Software Manager satellite versions earlier than 4.1.0, 6.0.x, or 6.1.x.
5. Call Home Profile: Cisco does support using IP addresses in Call Home profiles, so the restriction may depend on the deployment setup. Clarify based on specific conditions.
6. Communication: Use HTTPS to communicate with CSSM.
7. IOS XE 17.2.1: Re-register licenses if switching between autonomous and controller modes.
8. Web UI: Cannot configure SLP commands on Cisco CSR1000V or ISRv versions 17.3.x and earlier.

Deployment Method

Direct

Direct Connection: Devices directly connected to the cloud via Cisco Cisco Smart Software Manager (CSSM).

ON-Premises

Windows Server or Any Server is Accessing the cloud with Cisco Smart Software Manager (CSSM).

Offline Mode

Offline access through License Reservation.

Smart Licensing configuration of IOS-XE Devices

Cisco Enterprise Routing Platforms

If you want to learn more about licensing for the enterprise routers running on Cisco IOS XE Release 17.4.1 or later, more on Smart Licensing Using Policy for the Cisco Enterprise Routing Platforms

Cisco Smart Licensing Using Policy (SLP)

SLP simplifies license management by removing the need for recurring registration every 30 days, while ensuring that products operate seamlessly after setup.

• Easy Setup and Maintenance: Products work right away without an evaluation phase.
• No Registration: No need to check in with Cisco every 30 days.
• Automatic Compatibility: Supported by specific versions of Cisco’s software (e.g., IOS XE17.3.2, IOS XR 24.1.1, NX-OS 10.2(1)).

Cisco Smart Software Manager (CSSM)

Cisco Smart Software Manager (CSSM) is a centralized portal for managing all your Cisco software licenses.

• Manage Licenses: Create, manage, or view virtual accounts and transfer licenses.
• Product Instances: Transfer, remove, or view product instances.
• Run Reports: Generate reports on your virtual accounts.
• Notifications: Modify email notification settings.
• Account Overview: View overall account information.

Access CSSM at software.cisco.com. Navigate to the License tab and click the Smart Software Licensing link.

1.Direct License Management

• Simple: Devices report usage automatically via the internet or proxy.

2. On-Premises License Management

• Secure: Devices stay within the local network, sync with CSSM via a server.

3.Disconnected License Usage

• High Security: Fully offline, manual license management.

Cisco Smart License Utility (CSLU)

Cisco Smart License Utility (CSLU) is a Windows-based tool for managing licensing workflows, both online and offline. Key functions include:

• Trigger Workflows: Can be triggered by CSLU or the product instance.
• Collect and Upload Reports: Collects usage reports from product instances and uploads them to Smart or Virtual Accounts.
• Authorization Codes: Generate and exchange authorization codes to and from CSSM for license validation.

Implementation Options for CSLU

1. Connected to CSSM: Install on Windows to use CSLU as a connected tool.
2. Disconnected Mode: Install on Windows to use CSLU offline, suitable for air-gapped networks.
3. Embedded: Included in controllers like Cisco DNA Center.
4. Linux Deployment: Install on a Linux machine (laptop or desktop).

CSLU supports Windows 10 and Linux. Always use the latest version available on the Software Download page.

Note: CSLU is not supported in Cisco SD-WAN (Cisco vManage) and cannot report license usage for routing product instances managed by Cisco vManage.

Controller

Controller support information, including required software versions for Cisco DNA Center and Cisco vManage, and their compatible product instances.

• Support Information for Controller: Cisco DNA Center
• Support Information for Controller: Cisco vManage

SSM On-Prem

SSM On-Prem is an asset manager that allows local administration of products and licenses, with specific software version requirements for Smart Licensing.

Managed Service License Agreement (MSLA)

MSLA is a post-paid license program for Service Providers that tracks and bills usage via Smart Accounts, with specific Cisco IOS XE version requirements for Catalyst 8000V software.

License enforcement types:

• Unenforced: No pre-use authorization required; terms are per EULA.
• Enforced: Requires an authorization code before
• Export-Controlled: Requires authorization due to export restrictions; may be pre-installed with hardware.

Durations

• Perpetual: No expiration date.
• Subscription: Valid until a specified end date.

Smart Licensing Authorization Code

The Smart Licensing Authorization Code (SLAC) is essential for activating and using export-controlled or enforced licenses, such as HSECK9 and MRP Client/Manager. It is also required for encrypted throughput exceeding 250 Mbps on specific Cisco products. Existing SLACs, or licenses like HSECK9, SLR, or PAK, may suffice for these needs.

• Cisco 1100 Routers and 4000 Service Gateway are Encrypted throughput greater than 250 Mbps
• Cisco 1100 ISR Router and 8000v Catalyst Series Edge Platfroms are Encrypted throughput greater than 250 Mbps OR Encrypted and unencrypted throughput (combined) greater than 250 Mbps

NOTE: When upgrading to Smart Licensing Using Policy:

SLR Authorization Code: Supported after the upgrade.
AK-Fulfilled License: Follow guidelines in “Snapshots for PAK Licenses” to continue use.
PLR Authorization Code: Refer to “Permanent License Reservation in the Smart Licensing Using Policy Environment” for continued use.

Policy

A policy provides the product instance with the following reporting instructions

• License Usage Report Acknowledgement (ACK): Specifies if CSSM requires acknowledgment of the license usage report.
• First Report Requirement (days): Defines the number of days within which the first report must be sent; zero means no report is required.
• Reporting Frequency (days): Determines how often subsequent reports must be sent; zero means no further reports are needed unless there is a usage change.
• Report on Change (days): Specifies the days within which a report must be sent if there is a change in license usage; zero means no report is required for usage changes.

Note: To view the policy applied, use the show license all command. For customized policies, contact Cisco Global Licensing Operations via Support Case Manager.

RUM Report and Report Acknowledgement

• RUM Report: A license usage report generated by the product instance, which records and tracks license usage and changes. Open RUM reports are periodically closed, and new ones are created. Closed reports are then sent to CSSM.
• RUM Acknowledgement (ACK): A response from CSSM confirming receipt and processing status of a RUM report. Once an ACK is available, the corresponding RUM report can be deleted.

Trust Code

• Used to Sign RUM report for authentication and data integrity.

Obtaining a Trust Code:

• Factory-installed Trust Code: Available from Cisco IOS XE Cupertino 17.7.1a for new orders, but cannot be used for communication with CSSM.
• Via CSSM: Generate an ID token in the CSSM Web UI to request and install a trust code. This overwrites any factory-installed trust code.
• Automatic Acquisition: From Cisco IOS XE Cupertino 17.7.1 and later, a trust code is automatically obtained based on the network topology (direct connection, air-gapped network, or CSLU-initiated data retrieval).

Usage:

• Factory-installed Codes: Automatically overwritten by the new trust code.
• Installation Confirmation: The show license status command will show the updated timestamp under "Trust Code Installed."

SLP Configuration — No Connectivity to CSSM and No CSLU (Offline Mode)

Activating Traditional License in IOS-XE

NOTE: IOS-XE 17.06.3a Doesn’t support Traditional Formats.

In my Case i have an ISR 4331 Router (Hardware) where i have activated the License in Traditional format using the given .lic files

First Copy the Given .lic files to the Router or switch whatever way you can via USB or TFTP.

Copy USB Command

Router#copy usb1/usb0: flash:
Source filename [ ]? uck9_license.lic
Destination filename [uck9_license.lic]?
[OK - 1161 bytes]

Copy TFTP Command

Router#copy tftp flash:
Address or name of remote HOST [ ]? 10.0.0.1
Source filename [ ]? uck9_license.lic
Destination filename [uck9_license.lic]?
Accessing tftp://172.20.244.138/uck9_license.lic...
Loading uck9_license.lic from 172.20.244.138 (via GigabitEthernet1/0/1): !
[OK - 1161 bytes]
1161 bytes copied in 0.059 secs (19678 bytes/sec)

Note: while the show flash: command now lists the file in the flash, it has NOT yet been installed. The license install command must be used to install the license.

Installing Licenses in ISR 4331 Router

Router#license install flash:uck9_license.lic
Installing licenses from "flash:uck9_license.lic"
Installing...Feature:uck9...Successful:Supported
1/1 licenses were successfully installed
0/1 licenses were existing licenses
0/1 licenses were failed to install
At this point of time, the license is installed in the SYSTEM. However, it is not enabled yet..
To enable the technology package license(datak9, uck9, securityk9 or securityk9_npe), please reload the SYSTEM if the technology package is NOT yet enabled.
To disable ANY technology package license, please issue the following configuration command, save configuration and reload the SYSTEM.
Router(config)#license boot module  technology-package  disable

Increasing Thougthput level or Active the Boot Performance License with the given command

Check the Througthput levels it will show you in numbers.

show platform hardware throughput level
show platform hardware throughput level boost 

If its doesn’t show anything that means the throughput is not activated Now you have to activate using the given command and it will tell you to reload the Router/device to active the license.

platform hardware throughput level boost

Save the changes

Device # copy running-config startup-config
Device # reload
Device # confirm

Check the License summary

sh lice summary 
License Usage:
  License                 Entitlement Tag               Count Status
  -----------------------------------------------------------------------------
  booster_performance     (ISR_4431_BOOST)                  1 IN USE

Now its shows that the Boot Performance License its activated and the Router is BOOSTED with the Depending amount of MB Throughput.

OFFLINE METHOD

Note: In this , I used a Cisco ISR Router to activate the BOOT Performance License. This process is universal for all devices, such as the Cisco Catalyst 9300 Switch, where you also need to activate the DNA and Essentials licenses, among others and more…

Offline Mode

1.Set the Transport mode off and Save the configuration

Device(config)# license smart transport off
Device(config)# exit
Device# copy running-config startup-config

All communication to and from the product instance is disabled. To report license usage, you must save RUM reports to a file (on your product instance) and upload it to CSSM (from a Laptop that has connectivity to the internet, and Cisco website. Save the usage of licenses on a text file inside of the bootflash and extract it out of the router.

Device# license smart save usage all file bootflash:all_rum.txt 
Device# copy bootflash:all_rum.txt tftp://X.X.X.X/all_rum.txt

2. Uploading Usage Data to CSSM and Downloading an ACK

Upload usage data to CSSM: Uploading Usage Data to CSSM and Downloading an ACK.

Copy the RUM.txt File from Router to Laptop.

On the Cisco software central under smart management >> select the organization >> select the virtual account >> navigate to Reports >> choose Usage Data Files and upload the usage data file created by the router.

Report Location

Uploading the Router Given RUM file to Cisco Smart Manager.

Uploading RUM

After Uploading the RUM File Wait for 5–7 Mintues (The CSSM will Process and generate the reponse as per the RUM file).

And Download the Acknownledge Report (ACK).

Received the RUM File Acknowledgment.

Now upload the ACK.RUM.txt file back to the router as needed.

i Used USB Method.

Router#copy usb1/usb0: flash:
Source filename [ ]? all_rum.txt
Destination filename all_rum.txt
[OK - 1161 bytes]
OR:
Router#copy tftp flash:
Address or name of remote HOST [ ]? 10.0.0.1
Source filename [ ]? all_rum.txt
Destination filename all_rum.txt
Accessing tftp://172.20.244.138/all_rum.txt...
Loading uck9_license.lic from 172.20.244.138 (via GigabitEthernet1/0/1): !
[OK - 1161 bytes]

Verify that the file is present in the router’s directory.

Device#dir flash:/
OR
Device#dir

3. Installing a File on the Device

Device# dir [see the file is there and copy the file name ]
Device# license smart import bootflash:ack_usage.txt 
Import Data Successful

Validation

In CSSM navigate to Inventory >>> Product Instance >>

License Activated

License Used

From the router point we can check it by using the below commad in Usage Report section

#show license all
Router END:
Usage Reporting:
  Last ACK received: May 15 10:17:19 2023 UTC
  Next ACK deadline: May 14 10:17:19 2024 UTC
  Reporting push interval: 30  days
  Next ACK push check: <none>
  Next report push: May 15 09:59:06 2023 UTC
  Last report push: <none>
  Last report file write: <none>

License Usage
=============

booster_performance (ISR_4431_BOOST):
  Description: booster_performance
  Count: 1
  Version: 1.0
 Status: IN USE
  Export status: NOT RESTRICTED
  Feature Name: booster_performance
  Feature Description: booster_performance
  Enforcement type: NOT ENFORCED
  License type: Perpetual


#sh lice summary 

License Usage:
  License                 Entitlement Tag               Count Status
  -----------------------------------------------------------------------------
  booster_performance     (ISR_4431_BOOST)                  1 IN USE

You can used Sync command to resync again if any issue occur.

Device(config)#license smart sync all

NXOS Offline Mode Configuration

In this, I used a Nexus 9300 hardware switch where I activated the ACI Base License for 10G+ Leaf XF. This ACI Base License is a foundational license on the Nexus switch, while the advanced features are covered under the DCN licenses on Version 10.3.04a

1. Login Into the CSSM and check the availability of licenses.

ACI Base License for 10FG+ Leaf XF

2. Generating RUM Report.

NOTE: Basic configurations like inter-VLAN routing won’t use the ACI or DCN licenses initially. First, you need to enable certain features. I used OSPF and generated an RUM report.

Device(config)#license smart transport mode off
Device(config)#feature ospf
Device(config)#license smart save usage all bootflash:<NAME_ALL_rum>.txt
Device(config)#copy running-config startup
Device(config)#copy bootflash: usb0:
Enter Source Filename:FILENAME_ALL_rum.txt

Generating RUM Report

Upload the Nexus Generate RUM Report to CSSM at Report >>> Usage Data Files >> Upload Usage Data >> Select the File and Upload Data.

Select the Virtual Account (VA):

Selecting VA

After Uploading the RUM File Wait for 5–7 Mintues (The CSSM will Process and generate the reponse as per the RUM file).

After that download the Acknowlegde report (ACK.RUM).

Downloading Report

Now Uploaded the ACK.RUM.txt File back to the Nexus as per your needs. i Used USB Method.

Transfer the ACK file to USB for offline upload to the Nexus device.

Validating that the license is not active yet in the Trust code there is none.

Device(config)#show license status

Checking Trust Code

Uploading The ACK.RUM to Nexus switch

Device(config)#dir usb1:
Device(config)#copy usb1: bootflash:
Enter Source Filename:ACK.FILENAME_ALL_rum.txt

Uploading ACK.RUM Report to Nexus Switch

Importing the ACK.RUM Report to Nexus Switch.

Device(config)#license smart import bootflash:ACK.FILENAME_all_rum.txt
Device(config)#show license summary

Importing the ACK.RUM Report

You can see the ACI Base License for 10G+ Leaf XF is increase by +1 Now the Total is 2.

Reflect and Increased BY +1

Show commands

show license all
show license status
show version
show license summary
show run

You can used Sync command to resync again if any issue occur.

Device(config)#license smart sync all

Direct Connceted To CSSM

ONLINE MODE

Online Mode

Cisco Smart Licencing Port Allow on Firewall.

Ensure the following ports are properly configured in your firewall for uninterrupted communication with CSSM:

• User Interface: HTTPS (port 8443)
• Product Registration: HTTPS (port 443), HTTP (port 80)
• Communication to CSSM: HTTPS (tools.cisco.com, api.cisco.com, clousso.cisco.com), port 443.

Smart Account Set-Up → Product Instance Configuration → Trust Establishment with CSSM → Authorization Code Installation

1. Smart Account Set-Up.

Where task is performed: CSSM Web UI, https://software.cisco.com/

Ensure that you have a user role with proper access rights to a Smart Account and the required Virtual Accounts.

2.Product Instance Configuration.

Where tasks are performed: Product Instance

Set-Up product instance connection to CSSM

• Setting Up a Connection to CSSM

Step 1: Configue the Name server for DNS querys.

{ ip| ipv6} name-server server-address 1 …server-address 6]

Device(config)# ip name-server 8.8.8.8,1.1.1.1
Device(config)#ip domain lookup

Step 2: Domain Name.

Device(config)#ip domain name example.com

Step 3: Interface and Routes Configuration.

interface <fa/gig/tengig> 
ip address 192.168.1.0 255.255.255.0

ip routes 
0.0.0.0 0.0.0.0 next hops

ntp server 
timezone IST +5 30

Step 4: Check the Reachebility to CSSM.

telnet tools.cisco.com 443 /ipv4

Step 5: Transport Mode.

If the transport mode is set to license smart transport smart , and you configure license smart url default , the Smart URL (https://smartreceiver.cisco.com/licservice/license) is automatically configured. Remember to save any changes to the configuration file:

Device(config)# license smart transport smart
Device(config)# license smart url default
Device(config)# exit
Device# copy running-config startup-config

Step 7: Generating a New Token for a Trust Code from CSSM

Step 7.1:

• Log in to the CSSM Web UI at https://software.cisco.com, and click Manage licenses.
• Log in using the username and password provided by Cisco. The Smart Software Licensing page is displayed.

Step 7.2: Click the Inventory tab.

Step 7.3: From the Virtual Account drop-down list, choose the required virtual account

Step 7.4: Click the General tab.

Step 7.5: Click New Token. The Create Registration Token window is displayed.

Generating Token

Step 7.6: In the Description field, enter the token description

Step 7.7: In the Expire After field, enter the number of days the token must be active.

Step 7.8: (Optional) In the Max. Number of Uses field, enter the maximum number of uses allowed after which the token expires.

NOTE: If you enter a value here, ensure that you stagger the installation of the trust code during the next part of the process. If you want to simultaneously install the trust code on a large number of product instances, we recommend that you leave this field blank. Entering a limit here and simultaneously installing it on a large number of devices causes a bottleneck in the processing of these requests in CSSM and installation on some devices may fail, with the following error: Failure Reason: Server error occurred: LS_LICENGINE_FAIL_TO_CONNECT.

Step 7.9 : Click Create Token.

Generating Token

Step 7.10 : You will see your new token in the list. Click Actions and download the token as a .txt file or copy the code.

Trust Token

Step 8 : Making Trust with an ID Token

Step 8.1 : Enter the token in the license smart trust command.

license smart trust idtoken id_token_value{ local| all} [ force]

Example:
Device# license smart trust idtoken <insert token here > all force

Step 8.2 : Verfiy the Trust Code has been Installed

show license status
Example:
<output truncated>
Trust Code Installed:
  Active: PID:C9500-24Y4C,SN:CAT23####23H
    INSTALLED on Sep 04 01:01:46 2020 EDT
  Standby: PID:C9500-24Y4C,SN:CAT23###4GJ
    INSTALLED on Sep 04 01:01:46 2020 EDT

Used #show license udi
to get the Serail Number.

Serial Number

On CSSM Navigate to the Product Instances tab and confirm the Serial Number that belongs to listed.

License Types and advanced uses.

From this the licenses MAY VARY as per your Bill of Quantities.

1. C8000-HSEC

• U.S. Export Restriction Compliance license for C8000 series
• This license ensures compliance with U.S. export regulations, allowing you to confidently use and distribute your Cisco C8000 Series products.

2. T 0

2.1: DSTACK-T0-A

• Cisco DNA Advantage Stack — upto 25M (Aggr, 50M)
• Cisco DNA Advantage is a cloud-based service that provides insights into the performance of applications and the Catalyst SD-WAN network infrastructure

2.2: NWSTACK-T0-A

• Cisco Network Advantage Stack — upto 25M (Aggr, 50M)
• The Cisco Network Advantage Stack is a software license that provides advanced network management and security features for Cisco enterprise networks. It’s suitable for networks with a capacity of up to 200 Mbps (aggr, 400 Mbps), making it ideal for medium to large-scale enterprises

3. T 1

3.1: DSTACK-T1-A

• Cisco DNA Advantage Stack — upto 200M (Aggr, 400M)
• Cisco DNA Advantage Stack is its ability to provide up to 200 Mbps of bandwidth on aggregation links and 400 Mbps of bandwidth on access links

3.2: NWSTACK-T1-A

• Cisco Network Advantage Stack — upto 200M (Aggr, 400M).
• The 200 Mbps in Tier 1 enables 400 Mbps of aggregate bandwidth, which can be used in any upload/download ratio.

4. T 2

• Its on 2GB.

Note: There are many more as i am not aware of that.

Configuration of T Licenses change the Number as PER the Requirements.

Device(config)#license boot level network-advantage addon dna-advantage T0
OR
Device(config)#license boot level network-advantage addon dna-advantage T1

NOTE: The Device Asked for RELOAD to Activate.

Configuration of HSEC Licenses.

First, activate the feature

Device(config)#license feature hseck9
Device(config)#license smart authorization request add hseck9 all
Device(config)#write memeory
Device(config)#platfrom hardware throughput crypto T0
OR
Device(config)#platfrom hardware throughput crypto T1

Note: The Device Asked for RELOAD to Activate.

Output Example:

Miscellaneous:    
Custom Id: <empty>    
Usage Reporting:    
Last ACK received: Oct 04 10:07:25 2023 UTC    
Next ACK deadline: Jan 02 10:07:25 2024 UTC    
Reporting push interval: 30  days    
Next ACK push check: Oct 04 10:07:23 2023 UTC    
Next report push: Oct 04 10:36:29 2023 UTC    
Last report push: Oct 04 10:02:25 2023 UTC    
Last report file write: <none>    
Trust Code Installed: Oct 04 08:57:19 2023 UTC    
Authorizations:    
Router US Export Lic. for DNA (DNA_HSEC):    
Description: U.S. Export Restriction Compliance license for DNA based Routers    
Total available count: 1    
Enforcement type: EXPORT RESTRICTED    
Term information:    
Active: PID:C8300-1N1S-4T2X,SN:FDO2712M0JP    
Authorization type: SMART AUTHORIZATION INSTALLED    
License type: PERPETUAL    
Term Count: 1    
DC4-RTR-2#show licen summary    
License Usage:    
License                 Entitlement Tag               Count Status    
network-advantage_10M   (ESR_P_10M_A)                     1 IN USE    
dna-advantage_10M       (DNA_P_10M_A)                     1 IN USE    
hseck9                  (DNA_HSEC

)                        1 IN USE

Example of License Types

Show License Commands

show license summary
show license status
show license usage
show license authorization
show license all

You can used SYNC command to resync again if any issue occur

Device(config)#license smart sync all

Refrences

IOS-XE

• https://www.cisco.com/c/en/us/td/docs/routers/sl_using_policy/b-sl-using-policy.html

NXOS

• https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/nx-os/licensing/guide/cisco-nexus-nx-os-smart-licensing-using-policy-user-guide/m-smart-licensing-using-policy.html

That’s all from me. Happy Configuration ! :)

Thanks for reading my Cisco Smart License Configuration For IOS-XE And NXOS writeup! If you made it this far, congratulations — you now have 99 Device Configuration issues but a license ain’t one! I hope you found it helpful. Check out my GitHub for more writeups.

GitHub — rhanihasan/HexWriteUp: All of my writeups will be here. :)