Guest

Evolution in Cisco PAK License Registration and Validation Process

Last Updated: July 09, 2018

In the new digital landscape, full of both opportunities and threats, customers and vendors alike are moving aggressively to ensure the integrity of their products and their business. To help lead this change, and to ensure we are ready for further adoption of digitization, Cisco is announcing new tools and processes that will deliver the quality, performance, and integrity that our customers rely on. In particular, we are excited to launch a new Cisco Product Activation Key (PAK) registration and validation processes. The updates to our systems will protect the integrity of our brand, product offerings, customers, and channel partners. These steps will enable us to further enhance the digital platforms needed for our customers’ future, as well as our own.

What’s Changing

Effective immediately, new PAK certificates will appear slightly different and additional information will be required at registration. Additionally, for select PAKs, owner validation steps will be required at the time of activation, and some PAKs may need to be replaced to comply with new system requirements. Customers whose PAKs require additional validation and/or replacement will be notified during their next attempt to activate the PAK in the Cisco License Registration Portal.

We anticipate a minimal amount of disruption associated with these changes for customers and partners, with potential for slight delays in activating PAKs that need to be replaced.

Beginning May 20, 2018, the activation of new PAKs that were generated after March 12, 2018 will require entry of a PIN as an added multi-factor authentication step. The associated PIN is included on the claim certificate and delivered to the PAK owner through the existing processes that authorized channel partners use to provide purchase documentation.

And on July 9, 2018, Cisco launched an enhanced authentication feature as part of the License Registration Portal to streamline the validation steps for those PAKs created prior to the availability of PAK PINs. The new feature will allow customers to validate ownership by providing necessary details and uploading supporting materials right through the portal, minimizing the potential for delays during the activation process.

Customers and partners with questions about PAK activation can contact the Cisco Global License Organization (GLO).

Why It’s Changing

Cisco actively monitors for unauthorized use or sale of our products to ensure that customers and partners receive the value they expect when buying Cisco technology. Cisco has found that improper use of customer and partner tools allowed some users – registered under false pretenses – to acquire details about select PAKs. The information was used to create fraudulent copies of select PAK claim certificates, and in some cases, those PAKs are being sold illegally through unauthorized channels.

No sensitive customer data was accessed as a result of the misuse of tools. And there is no impact to previously activated PAK licenses.

Easy access to the tools and involved PAK details are important for legitimate partners and customers to conduct business and effectively manage their networks. While our key stakeholders will continue to have streamlined access to necessary information and tools, Cisco has increased the resilience of those tools to protect against future improper use. And the increased validation steps for affected PAKs will ensure that activation is limited to the rightful owner.

As noted, some of the PAK licenses involved were found for sale outside of established sales channels. As a reminder, customers should always purchase Cisco technology and licenses from verified Cisco partners through established sales channels. Cisco and authorized Cisco resellers do not sell legitimate PAKs for Cisco products on any online marketplace or bidding site.

  • To learn more about this topic, please go to the FAQs tab.
  • If you need assistance with activating PAK licenses, please see the Contacts and Resources tab.

About the Changes to Cisco Tools and PAK Registration and Validation Processes

Q: What is changing for the Cisco PAK registration and activation processes?
New product activation key (PAK) licenses will appear slightly different. Additional information and owner validation steps will also be required at the time of activation.

PAKs generated after March 12, 2018 will include a PIN entry requirement during activation. For PAKs generated prior to the launch of the PIN feature, most customers will be able to validate ownership by providing necessary details and uploading support materials right through the License Registration Portal when prompted.

In rare cases, PAKs may need to be replaced in order to comply with new system requirements. Customers whose PAKs must be replaced will be notified in the License Registration Portal when they attempt to activate a new product using an affected PAK.

For a video overview of the PAK validation steps and how to complete them, see one of the links below:

Q: What has changed to the license portal / tools?
Cisco has addressed the potential for future misuse by enhancing the tools involved. These changes should not impact the overall usability or cause notable disruption for legitimate customers and partners.

Q: Which products are affected by changes in the PAK license generation and validation processes?
The changes Cisco is implementing will be applied to all new PAK licenses across Cisco’s portfolio, and the increased validation may be required for some previously generated PAKs across multiple products.

Q: Are there steps that customers can take to streamline the validation process?
For increased security and to streamline the validation process, we recommend customers specify or establish a Smart Account / Virtual Account in which PAKs can be deposited upon purchase. Once a PAK is secured in an owner's Smart Account, there should not be a need for PIN entry. Find out more about Smart Accounts, or Request a Smart Account today.

Also, if you have the eDelivery notification e-mail you can choose to click “Register Claim Certificate PAKs” link to fulfill the PAK.

Q: How will customers/partners know their PAK needs to be replaced?
If a PAK needs to be replaced to comply with new system requirements, the customer or partner will receive a notification upon attempted activation. When prompted, they should follow the simple instructions that appear in the pop-up window in License Registration Portal, and any subsequent instructions that will be provided by GLO.

Q: Can Cisco proactively issue new PAKs to replace those affected?
The verification approach – prompted by an activation request – allows Cisco to prioritize customers who require immediate activation of their PAKs. This approach also minimizes potential confusion for customers and partners who have purchased multiple PAKs, many of which are not affected, and makes the process as easy as possible for system administrators.

Q: Why is there now a PIN noted on my Claim Certificate?
Cisco has been making incremental updates to its PAK validation and registration process. The updates will protect the integrity of our brand, product offerings, customers, and channel partners. To help ensure use of a PAK is limited to the rightful owner, Cisco has incorporated a new multi-factor authentication step during PAK activation, which requires a PIN be entered.

Q: Do I need to get a PIN for the PAKs I already have (prior to March 12, 2018)?
No. PAKs received prior to this change will not require a PIN as part of activation. Some of these PAKs may still be subject to the additional verification steps that began in February 2018.

Q: How will I access the PIN that has been generated for my PAKs?
The PIN is included on the claim certificate that a customer receives when a new PAK is purchased. This document will continue to be delivered through the existing channels and processes that authorized channel partners use to deliver all purchase documentation.

Q: What do I do if I lost my claim certificate and PIN for new PAKs?
If your claim certificate was received through the eDelivery tool, you may log into that tool and follow steps for the certificate to be resent. If you received a physical copy of the claim certificate, and cannot locate it, please contact Cisco’s Global Licensing Organization (GLO) to complete the necessary ownership validation steps.

Q: What information or documents will be needed to complete the validation through the License Registration Portal?
Customers without a PIN may be asked for alternate security identifiers from an authentic claim certificate to validate ownership. Examples of information that may be requested include the Sales Order Number, Line Number, Ship Set, and/or Service Request number. Some customers may be also asked to upload the Claim Certificate in PDF format.

Q: Do these changes affect PAKs or licenses that have already been activated?
No. There is no impact to licenses that have already been activated and applied to a Cisco product in a customer network.

Q: What do customers / partners need to do?
If prompted following a PAK activation request, customers will need to follow the steps indicated in the License Registration Portal. Customers will be prompted to contact Cisco’s Global Licensing Organization (GLO) to complete the necessary validation steps.

Q: Will there be a delay when users attempt to activate PAKs?
For those select PAKs that require additional validation and/or replacement, customers will be prompted to contact Cisco’s Global Licensing Organization (GLO) to complete the necessary validation steps. Occasionally, there may be slight delays in activating PAKs that are being replaced. We are committed to completing these steps as quickly as possible to ensure minimal disruption for our customers and partners.

Q: Are there steps that customers can take to streamline the validation process?
For increased security and to streamline the validation process, we recommend customers specify or establish a Smart Account / Virtual Account in which PAKs can be deposited. Once a PAK is secured in an owner's Smart Account, there should not be a need for PIN entry.

Q: Why is Cisco making these changes now?
Cisco has increased the resilience of our tools to protect against improper use, and the increased validation steps for select PAKs will ensure that activation is limited to the rightful owner.

Q: Was there a breach or were PAK licenses stolen from a database?
No. Some users of customer and partner tools registered under false pretenses, and improperly used those tools to acquire details about select existing PAKs. The information was used to create fraudulent copies of select PAKs, and in some cases those PAKs are being sold illegally through unauthorized channels.

Q: What does it mean that “partner and customer tools were misused”?
Bad actors leveraged a series of Cisco partner and customer tools to query limited details in succession about PAKs, ultimately compiling enough data to create fraudulent copies of PAK claim certificates.

Q: Why was such information available in Cisco tools?
Easy access to the tools and PAK details are important for legitimate customers and partners to conduct business and effectively manage their networks. Cisco has increased the resilience of the involved tools to protect against improper use. The validation actions being taken are intended to limit PAK activation to the rightful owner, and help protect against involved PAKs subsequently being offered for unauthorized resale.

Q: Is sensitive customer information at risk as a result of misuse of the involved tools?
No, sensitive customer information is not involved in the misuse of tools. Such data is not stored in the data sets managed by these tools.

Q: How did Cisco identify which PAKs are affected?
Using system analytics, we are able to understand the improper use and can determine impacted PAKs upon attempted activation.