After APIC is rebooted, Smart Licensing is automatically enabled, and the APIC is initialized. Before you register the APIC with CSSM (Cisco Smart Software Manager), Smart Licensing is automatically in the Evaluation Period. The Evaluation Period is global for all the license entitlements. The Evaluation Period lasts 90 days (usage days and not calendar days). The APIC starts to countdown the clock when it receives the report of the first license consumption. After the APIC is registered with CSSM, the Evaluation Period countdown clock stops and Smart Licensing is in the Registered state. If the APIC is unregistered, the countdown clock starts again, and Smart Licensing returns to the Evaluation Period. After 90 days, the Evaluation Period expires and cannot be reset. When Smart Licensing is in the Evaluation Period, an info fault notifies you that the APIC is not registered. When the Evaluation Period expires, a major fault is raised to warn you that you must register the APIC.

 Note

If the APIC is unregistered, the APIC functionality is not affected.

Follow these Smart Licensing guidelines and limitations:

• The Evaluation Period countdown time is stored in the Cisco Application Policy Infrastructure Controller (APIC). The countdown time remains intact during a software downgrade. Therefore, if you upgrade your Cisco APIC software to version 3.2 or later once again after a downgrade, the countdown time will continue from the previous value before the downgrade. The countdown time cannot be reset. After 90 days, if no action is taken to register, the license status will display Evaluation Expired.

• Upgrading Cisco APIC from a 3.x release to a 4.x release causes Smart Licensing to lose its registration. Registering Smart Licensing again will clear the fault. In order for Smart Licensing to be secure, the registration token is not stored in the database. Therefore, you must generate a new token from CSSM and re-register.

• If there is a license violation for a feature that is enabled on Cisco APIC, the feature functionality will not be disabled, and there will be no impact on system functionality. The system will continue to operate, but relevant faults will be raised to warn the user. The most severe fault that will be raised is major.

• If the registration fails, click the Faults tab in the Cisco APIC GUI System > Smart Licensing area. To see details about a specific failure, double click the listed fault.

• The DLC tool is not supported when you use the Smart Software Manager Satellite transport setting.

• Upgrading Cisco APIC from a 3.x release to a 4.x release causes Smart Licensing to lose its registration. Registering Smart Licensing again will clear the fault.

• Cisco Application Centric Infrastructure (ACI) license SKUs are in Hybrid mode because the same SKU is shared between Cisco ACI and Cisco Nexus 9000 series ACI-mode switch licenses. If customers use a Cisco ACI software image, they must convert the SKU from a Product Activation Key (PAK) to Smart License and consume it from the product in the Smart License mode.

• Cisco APIC Smart Licensing registration to the Satellite Server may not work if the Satellite Server language setting is not set to English. When using this method to register, verify that the language setting is set to English.

• Smart Licensing does not support IPv6.

The following is a user checklist for readiness and configurations required with CSSM.

1. Verify that you have the appropriate Smart Account and Virtual Accounts created.

2. If you have purchased smart-enabled licenses from Cisco Commerce, then verify that your user-purchased licenses are populated.

3. As you begin the APIC Smart Licensing registration, work with your Cisco TAC engineer to ensure that you are ready with the appropriate CSSM items.

The following is a user checklist for readiness and configurations required with the APIC.

- Your DNS settings must be configured in APIC to resolve to https://software.cisco.com/.

With APIC release 3.2(1), when you first log in to the GUI, the display shows a blinking alert that indicates that Smart Licensing is not configured with CSSM. There is a hyperlink to the Smart Licensing location in the GUI that takes you directly to the Smart Licensing GUI location. You can also manually navigate to the Smart Licensing GUI area as follows: System > Smart Licensing.

In the Smart Licensing GUI screen, click the Register button to start the process of registering the APIC controller. The Register Smart License dialog box is displayed where you can choose the appropriate method to register that suits your environment.

There are different methods to register depending upon your environment. The methods are described in the following sections.

The Renew Authorization menu item is displayed when you click System > Smart Licensing > Renew Authorization.

Every time a license usage is changed (consumed or released), APIC immediately reports all the licenses consumed to CSSM and gets the license authorization status from CSSM. If there is no license usage change, APIC will synchronize the license authorization status from CSSM once every day. However, you can click Renew Authorization to manually synchronize the license authorization status from CSSM on-demand.

The Renew Registration menu item is displayed when you click System > Smart Licensing > Renew Registration.

After the APIC is registered with CSSM, an ID certificate is returned by CSSM and stored in the APIC filesystem. Unlike the certificate used in HTTPS protocol, this ID certificate is used by CSSM to uniquely identify the registered APIC for subsequent communications. The ID certificate is valid for one year and can be automatically renewed. However, during the time when the APIC automatically renews the ID certificate, if network connectivity with CSSM has an issue, the ID certificate renewal can fail. If the ID certificate has expired, you must generate a registration token from CSSM and register the APIC again. To prevent such a situation from occurring, you can click Renew Registration, and the ID certificate will get renewed for one year immediately

It is recommended that you renew registration of your Smart License every six months. This will prevent your ID certificate from expiring.

If you encounter an instance when the APIC has not deregistered successfully and it fails, the backend will still be associated with the instance ID. In such cases, to register the device again you must use a force option which is to reregister.

If you have already registered Smart Licensing with your APIC earlier, you can reregister the Smart License during the subsequent times you use the APIC. This prevents your registration from failing.

To reregister APIC, check the check box for the Reregister product if already registered dialog box in the APIC GUI by navigating to the System > Smart Licensing area. Click Register.

Regardless of which transport setting (direct connect to CSSM, CSSM Satellite, or proxy server) you use, APIC has a built-in certificate signed by Cisco root CA and can communicate with CSSM (or CSSM Satellite) using a secured HTTPS protocol. In addition, when the certificate is close to expiry, APIC will automatically renew the certificate. Therefore, normally you are not required to manually download and import the certificate into APIC. However, if during the time when the certificate is being automatically renewed, APIC cannot reach the Cisco certificate website due to a network connectivity issue, the certificate auto renewal could fail. If as a result of such a rare incident, the certificate has expired and APIC cannot communicate with CSSM or CSSM Satellite, you must manually download a certificate from the following Cisco URL and import it into APIC: http://www.cisco.com/security/pki/certs/clrca.cer.

The Import/Remove Private Certificate menu item is displayed when you choose System > Smart Licensing > Import/Remove Private Certificate.

 Note

This certification is for network communication and is different from the token ID that is used during the Smart Licensing registration.

 Note

• The DLC tool is not supported when you use the Smart Software Manager Satellite transport setting. If you are using the Satellite Manager Mode, a workaround task is available for your use in the following section: Workaround for Using DLC in the Smart Software Manager Satellite Mode

• The DLC may also be referred as Claim Device License in the APIC GUI.

With the Device Led Conversion (DLC) tool, existing ACI customers can get their licenses under compliance.

Smart Licensing has a license catalog that specifies each license entitlement for the Cisco ACI fabric. Each license entitlement is considered as a type of license. The Product and Entitlement definition is available as an MO (Managed Object) in XML format. The CLI show license catalog displays the license catalog in a format similar to the MO XML format.

Standard CLI configurations and show commands for Cisco Smart Licensing are supported in the ACI fabric with the following exceptions:

• In the CLI, there is no difference between the config and the exec command. Therefore, both config and the exec commands are implemented as a config command.

• By default, Smart Licensing is enabled and cannot be disabled by the user. Therefore, the [no] license smart enable CLI configuration command is not supported in APIC controller.

• The operational test CLI commands are not supported.

• A few CLI commands specific to the ACI fabric product line are implemented.

Within a Cisco Application Centric Infrastructure (ACI) fabric, there are two methods used to report license consumption:

• Hardware License Reporting is used for count: An inventoried device (leaf and spine switch) results in one instance of a license consumed. When that device is decommissioned, it results in one less license consumed.

• Software License Reporting is tiered: Feature usage based on policy configuration and deployment is constantly assessed to dynamically determine which tier of license must be consumed. When a higher tier feature is enabled in policy and applied to a switch, that switch reports that it is consuming a tier of license that matches that feature set. When all policies of a higher tier are removed, the switch will report requiring the next lowest tier of license that matches its currently enabled feature set.

The following diagram displays an example of how available Cisco ACI licenses match the available feature sets. In your Cisco Application Policy Infrastructure Controller (APIC) GUI, navigate to System > Smart Licensing. In the Smart License Usage area, click View the Smart Licensing Overview.

Your registration fails upon registering APIC with the following error displayed under Faults in the Smart Licensing area of the APIC GUI.

Failed to register APIC Controller product with CSSM: Fail to send out Call Home HTTP message.

To troubleshoot such a registration failure, verify the following items:

• Verify that your DNS server is configured to resolve to www.software.cisco.com. Perform a DNS lookup from APIC to verify this configuration.

• Verify that you used the correct port numbers when you configured the Transport Gateway, the Smart Software Manager Satellite, or the HTTP/HTTPS proxy mode

• It you are using HTTPS Proxy mode, the issue could be due to a certificate mismatch. Verify that your certificate is the correct one.

• If you are using the Smart Software Manager Satellite mode, and you have generated an SSL certificate by providing a hostname, you must use the same hostname instead of the IP address while configuring the Smart Software Satellite mode in APIC. Similarly, if you have generated an SSL certificate by providing an IP address, you must use the same IP address instead of the hostname while configuring the Smart Software Satellite mode in APIC.

You must use a private certificate when you use Smart Software Manager Satellite as your Transport Setting. If you choose Cisco Smart Software Manager Satellite as your Transport Setting and use the HTTPS protocol, you must first download a certificate from the following Cisco web site: http://www.cisco.com/security/pki/certs/clrca.cer. Then, you must import the certificate into the APIC before registering the APIC. Otherwise, the registration will fail. Only Cisco Smart Software Manager Satellite (using HTTPS protocol) requires an import certificate. Other Transport Settings, such as Cisco Transport Gateway (HTTPS) and third-party Apache proxy server (HTTPS) do not require you to have an import certificate.

During registration, if you see a Registering status that lasts for a couple of minutes, verify the following items:

• The network latency between the APIC instance you are trying to register and the Cisco cloud is high and some transactions are being rerun.

• In proxy mode , if you have registered using an incorrect IP address or port then the registration could take a few minutes to exhaust the retry. Please correct the IP address or port number after a couple of minutes to restart the registration process with the correct input.

If the failure continues to persist after you have tried to troubleshoot using the above verification suggestions, collect the relevant tech-support data and contact Cisco TAC.

Your registration failed due to an expired token.

To troubleshoot such a registration failure issue, verify the following items:

The error message is self-explanatory and can be viewed under Smart Licensing > Faults. If registering with the Smart Software Manager Satellite server, use the token from the satellite manager to register. Do not use the token from CSSM.

If you see an Out of Compliance message upon registering, check the following items:

• In the APIC GUI, navigate to System > Smart Licensing > Smart License Usage, and double-click the item that is displayed as Out of Compliance. The dialog box that opens will provide details about the features consumed by the specific APIC. Verify whether you have adequate licenses of the required type in your smart account.

• When using the Smart Software Manager Satellite server, verify that the licenses in your smart account and in the Satellite server account are synchronized. If they are not synchronized, perform a manual or a network synchronization between the smart account and Smart Software Manager Satellite server.

When a Cisco Application Centric Infrastructure (ACI) fabric is deployed with Smart Licensing enabled and CSSM connectivity in place, there are two noteworthy states.

• Authorized: In this state, the number of purchased licenses in the Smart Account are equal to or greater than the number of consumed licenses.

  • This includes the count as well as the tier of a license.

  • If the tier of a license within the Smart Account is greater than the tier of license being requested by the devices in a Cisco ACI fabric, CSSM is expected to return an Authorized status back to Cisco Application Policy Infrastructure Controller (APIC) to be reported for its license usage. In this scenario, CSSM must have an indicator showing that the higher tier license is being temporarily subtracted, and the lower tier license is being temporarily added.

    Example: A Cisco ACI fabric is using features that require 10 Essentials licenses; however, the Smart Account contains 12 Advantage licenses and 0 Essentials licenses. CSSM should display that it now has 12(-10) Advantage licenses and 0(+10) Essentials licenses. CSSM is expected to return an Authorized status to Cisco ACI.

• Out-Of-Compliance: The number of purchased licenses in the Smart Account are less than the number of consumed licenses.

  • If your Smart Account is missing licenses, contact your account team to gather all appropriate Sales Orders/Purchase Orders. Then contact the Cisco Licensing team to deposit those licenses into your Smart Account.

  • If your Smart Account has more licenses than devices, and you are not consuming features greater than your available tier of license, invoke Renew Authorization to re-trigger the CSSM validation. If forcing a Renew Authorization does not correct the Authorization status to the expected state, collect an On-demand Techsupport policy for the Cisco ACI fabric and contact Cisco TAC.

     Note

    Without a manual re-triggering of Renew Authorization, Cisco APIC will trigger one automatically every 30 days.

To troubleshoot authorization issues with Smart Licensing, see the following information: