Cisco IOS XE 17 - Managing Licenses for SD-Routing Devices

Scope of This Document

This document provides license management guidance for SD-Routing devices.

SD-Routing devices are routing devices that are managed or monitored by Cisco Catalyst SD-WAN Manager, but are not in SD-WAN controller mode.

License management for SD-Routing devices applies to single-tenant and multi-tenant scenarios and covers information about

the available licenses
how to assign and use licenses, and
how to report license usage information.

Topic	Reference Material
An overview of the features and benefits of SD-Routing.	Cisco SD-Routing Data Sheet
Onboarding existing and new autonomous routing devices to Cisco Catalyst SD-WAN Manager.	SD-Routing: Onboard Routing Devices to Cisco SD-WAN Manager
An understanding of the Smart Licensing Using Policy license management solution. Cisco Catalyst SD-WAN Manager manages licenses for SD-Routing devices within the framework of the Smart Licensing Using Policy infrastructure.	Smart Licensing Using Policy for Cisco Enterprise Routing Platforms
Ordering licenses.	Cisco Catalyst Software-Defined Routing (SD-Routing) Ordering Guide
For information about multitenancy in the context of license management refer to the SD-WAN documentation. When using Cisco Catalyst SD-WAN Manager with multitenancy, there are no additional considerations for SD-Routing devices.	Manage Licenses for Smart Licensing Using Policy and Cisco SD-WAN Multitenancy.

Config and Monitor Mode SD-Routing Devices

In the context of license management for SD-Routing devices, there are two kinds of devices.

Config mode SD-Routing devices: Cisco Catalyst SD-WAN Manager manages all licenses for these devices. The device does not consume or report any license.
Monitor mode SD-Routing devices: Cisco Catalyst SD-WAN Manager manages only certain licenses for these devices. The device consumes and reports other available licenses. Cisco Catalyst SD-WAN Manager cannot push any configuration to these devices.

This table clarifies the SD-Routing devices that are config mode devices and those that are monitor mode devices.


Config Mode SD-Routing Devices	Monitor Mode SD-Routing Devices
Cisco Catalyst 8200, 8200L, 8300, 8500, and 8500L Series Edge Platforms and 8000V Edge Software Cisco 1000 Series Integrated Services Routers	Cisco 4461 Integrated Services Router Cisco ASR 1000 Series Aggregation Services Routers

Available Licenses for SD-Routing Devices

This table clarifies the available licenses for SD-Routing devices. For information about ordering these licenses, see Cisco Catalyst Software-Defined Routing (SD-Routing) Ordering Guide.

Note how the license consumption location for all available licenses in case of config mode devices is Cisco Catalyst SD-WAN Manager. But for monitor mode devices, certain licenses are consumed on the device and only certain licenses are consumed in Cisco Catalyst SD-WAN Manager. The details are explained in subsequent sections.

Tip

If you intend to use licenses for which the consumption location is the "Device", we recommend configuring such licenses on the device, before onboarding the device to SD-Routing.


Product Family	License Consumption Location	Licenses Available in the Specified Consumption Location
Cisco Catalyst 8200, 8200L, 8300, 8500, and 8500L Series Edge Platforms and 8000V Edge Software	Device	None.
	Cisco Catalyst SD-WAN Manager	DNA Essentials, DNA Advantage, and High Security (HSECK9).
Cisco 1000 Series Integrated Services Routers	Device	None.
Cisco 1000 Series Integrated Services Routers	Cisco Catalyst SD-WAN Manager	DNA Essentials, DNA Advantage, HSECK9, and SDR-Monitoring.
Cisco 4461 Integrated Services Routers	Device	Advanced Unified Communication Suite (AdvUCSuiteK9), FoundationSuiteK9, appxk9, securityk9, uck9, HSECK9, Cisco UBE, Cisco Unified CME, Cisco Unified SRST, and so on. For information about all existing feature licenses that are consumed on the device, see Feature Licenses.
Cisco 4461 Integrated Services Routers	Cisco Catalyst SD-WAN Manager	DNA Essentials, DNA Advantage, and SDR-Monitoring.
Cisco ASR 1000 Series Aggregation Services Routers	Device	Advanced IP Services (AISK9), Advanced Enterprise Services (AESK9), and so on. For information about all existing feature licenses that are consumed on the device, see Cisco ASR 1000 Series Aggregation Services Routers Data Sheet.
Cisco ASR 1000 Series Aggregation Services Routers	Cisco Catalyst SD-WAN Manager	DNA Essentials, DNA Advantage, and SDR-Monitoring.

How License Management Works for SD-Routing Devices

These are the sequential stages of license management for SD-Routing devices:

Users set up a Smart Account and one or more Virtual accounts. Users display and manage the Smart Account and Virtual Accounts in the Cisco SSM portal.
Users purchase licenses for SD-Routing devices, through existing channels like Cisco Commerce Workspace.

Purchased licenses are available in the organization’s Smart Account and Virtual Accounts. Ensuring that the licenses are in the correct Smart Account and Virtual Account is essential to later stages where licenses are consumed.
Users complete the necessary workflows and configuration to consume any license except for the HSECK9 license.

Note

In case of HSECK9 licenses, the necessary workflows can be completed only after a method to communicate with Cisco SSM is setup.
Users setup a method or mode, to report license usage to Cisco SSM.

Multiple ways of interfacing with Cisco SSM are available. An organization’s network requirements and security policy are some of the factors that determine the choice of the reporting mode or topology.

For SD-Routing devices in the config mode, these options are available for interfacing with Cisco SSM: Cisco SSM Connection Options for All SD-Routing Devices.

For SD-Routing devices in the monitor mode, these options are available for interfacing with Cisco SSM: Cisco SSM Connection Options for Monitor Mode Devices
If applicable, users complete the necessary workflows for HSECK9 licenses: How HSECK9 License Management Works for SD-Routing Devices.
License usage reporting is triggered automatically, at a scheduled frequency, or completed manually by the user - depending on the chosen license reporting mode.
Users perform any general or recurring license management activities, such as monitoring license usage and keeping track of the remaining term for a license, assigning licenses to more devices, and so on.

Cisco SSM Connection Options for All SD-Routing Devices

For all SD-Routing devices, the online, offline, and on-prem license server options are available.

Online Modes (Recommended)

Three variations of the online mode are available.

The first one is where Cisco Catalyst SD-WAN Manager is directly connected to Cisco SSM, over the internet.

The second and third alternatives, provide the option of using an HTTP or HTTPS proxy server for internet access. Cisco Catalyst SD-WAN Manager is configured to use a proxy server to connect to Cisco SSM, or SSM On-Prem.

Offline Mode

This option involves manual management of licensing data in Cisco Catalyst SD-WAN Manager. All communication between Cisco Catalyst SD-WAN Manager and Cisco SSM is in the form of uploaded and downloaded files.

On-Prem Mode

This option provides Cisco Catalyst SD-WAN Manager with mediated access through a connected on-premises collector. SSM On-Prem is locally connected and acts as a local license authority. SSM on-prem synchronizes its license database with Cisco SSM periodically and functions similarly to Cisco SSM.

Cisco SSM Connection Options for Monitor Mode Devices

For an SD-Routing device in the monitor mode, the connection to Cisco SSM must be setup in two places.

The figure shows the two locations where users perform license management activities for SD-Routing devices in the monitor mode: Certain licenses, such as Cisco DNA licenses or monitoring licenses, can only be assigned in Cisco Catalyst SD-WAN Manager. Other available licenses, such as FoundationSuiteK9 on Cisco 4461 Integrated Services Routers, can only be configured on the device, using CLI.

The table here specifies where available licenses are consumed: Available Licenses for SD-Routing Devices. Depending on whether the consumption location reads "Cisco Catalyst SD-WAN Manager" or "Device", users assign or configure the licenses, in the respective location.

Since licenses can be consumed in two different locations, management of these licenses also occurs separately.

The left-hand side of the figure shows how Cisco Catalyst SD-WAN Manager records usage for and completes reporting only for the licenses assigned in Cisco Catalyst SD-WAN Manager.

Reporting is according to the license reporting mode implemented in Cisco Catalyst SD-WAN Manager, and can be any one of the options described here: Cisco SSM Connection Options for All SD-Routing Devices.
The right-hand side of the figure shows how the device records usage for and completes reporting only for the licenses configured on the device.

Reporting is according to the topology implemented on the device, and can be one of the following: Connected Directly to CSSM, Connected to CSSM Through CSLU, SSM On-Prem Deployment, or No Connectivity to CSSM and No CSLU.

Note

All licenses, regardless of where they are assigned or configured, are within the purview of the Smart Licensing Using Policy solution. So to ensure compliance, the necessary reporting workflows must be completed for all of them.

How HSECK9 License Management Works for SD-Routing Devices

The High Security license (HSECK9 license) is an export-controlled license and is required by U.S. export control laws. This license allows the use of throughput greater than 250 Mbps on HSECK9-Compatible SD-Routing Devices.

HSECK9 License Requirements

An HSECK9 license requires authorization before use. This authorisation is provided by a Smart Licensing Authorization Code (SLAC) which is obtained from Cisco SSM and installed on the device. Installing SLAC on the device enables the use of the HSECK9 license.

The HSECK9 license is tied to the Unique Device Identifier (UDI). One HSECK9 license, and therefore one SLAC, is required for each device UDI.

Requesting SLAC for HSECK9 Licenses

Cisco Catalyst SD-WAN Manager synchronizes with Cisco SSM to obtain a SLAC, and install it on the required SD-Routing device.

If an HSECK9 license is already in-use, that is, SLAC is already installed on the device, then you cannot synchronize or install SLAC again. This is regardless of whether SLAC was installed before or after onboarding a Cisco routing device to Cisco Catalyst SD-WAN Manager.

Returning SLAC for HSECK9 Licenses

Cisco Catalyst SD-WAN Manager does not support uninstalling an HSECK9 license from a device. If you need to release the HSECK9 license for use elsewhere, see Return SLAC for an HSECK9 License That Is In-Use.

Restrictions for HSECK9 Licenses

The use of HSECK9 licenses has these restrictions in Cisco Catalyst SD-WAN Manager.

Unused device-specific HSECK9 licenses

Device-specific HSECK9 licenses are HSECK9 licenses that have been tagged according to router model (for example, ISR_1100_2P_HSEC). They are being phased-out. Further, Cisco Catalyst SD-WAN Manager cannot install any device-specific HSECK9 licenses on the device. If you have an unused device-specific HSECK9 license, refer to Available Options for an HSECK9 License to know more.

HSECK9-Compatible SD-Routing Devices

This table clarifies SD-Routing devices that require an HSECK9 license and the ones that don't.


SD-Routing Devices	Is an HSEC License Required for Throughput Greater Than 250 Mbps?
Cisco Catalyst 8200, 8200L, 8300, 8500, and 8500L Series Edge Platforms and 8000V Edge Software	Yes Note On Catalyst 8500 and 8500L Series Edge Platforms, the HSECK9 license is required only for compliance purposes. Throughput is not impacted by the non-availability of the HSECK9 license.
Cisco 1000 Series Integrated Services Routers	Yes
Cisco 4461 Integrated Services Routers	Yes, but because this a monitor mode device, SLAC must be installed according to the topology implemented on the device and not in Cisco Catalyst SD-WAN Manager.
Cisco ASR 1000 Series Aggregation Services Routers	No

Return SLAC for an HSECK9 License That Is In-Use

To return an HSECK9 license that is being used (license status is IN-USE), you have to initiate a forced return of the Smart Licensing Authorization Code (SLAC).

Note

Returning an HSECK9 license, throttles throughput on the device to 250 Mbps.

Before you begin

The forced return option for SLAC is available only on these devices: Catalyst 8000V Edge Software, Catalyst 8200 Series Edge Platforms, Catalyst 8300 Series Edge Platforms, and Cisco 1000 Series Integrated Services Routers.

This option is not available on Catalyst 8500 Series Edge Platforms. This option is also not available on devices that do not support the HSECK9 license.

Follow these steps to initiate a forced return:

Step 1

license smart authorization return force-reload

Forces the the device to return the SLAC. A return code is displayed after you enter this command.

Note

On a Catalyst 8000V Edge device the keyword is force . This is because a reload is not required on virtual platforms.

Example:

Device# license smart authorization return force-reload

Attention!!! This command will forcibly remove HSECK9 authorization code. Device will reload automatically if you continue.
 
Do you want to continue? [yes/no]:yes

Step 2

Check that the return process is completed.

If the device has connectivity to the internet and Cisco SSM:

For virtual platforms, the return code is automatically updated in Cisco SSM, and the device does not reload.

For physical platforms, after reload is complete and connectivity is restored, the return code is automatically updated in Cisco SSM.

Verify the return by accessing the corresponding Smart Account and Virtual Account in Cisco SSM.
If the device is offline and has no connectivity to the internet, then you must manually copy and enter the return code in Cisco SSM, to complete the return process. You can find the code in the output of the show license authorization privileged EXEC command.
```
Device# show license authorization
Overall status:
  Active: PID:C8300-1N1S-4T2X,SN:FDO2349A00R
  Status: NOT INSTALLED
  Last return code: CrMfaJ-9odPW7-gr2DzP-t3srpf-ATqzGS-wGF3c6-U3Kg77-GdiABx-gud
<output truncated>
```

Once the SLAC return process is complete, the HSECK9 license is automatically returned to the license pool in Cisco SSM and throughput on the device is throttled to 250 Mbps.

Begin Implementation

Regardless of whether you implement the online, offline, or on-prem mode, complete these tasks in the given sequence:

Restrictions for SD-Routing License Management

Before you begin implementation, take note of these restrictions for license management

Multiple subscriptions for postpaid licenses

Do not assign multiple subscriptions for postpaid licenses within a single Cisco Catalyst SD-WAN Manager instance.

Mixing prepaid and postpaid

Do not assign both prepaid and postpaid licenses for the same DNA license, from the same Virtual Account. Set-up separate Virtual Accounts for prepaid and postpaid licenses.

Mixing Modes

In a multitenancy scenario, all tenants must operate in the online mode or all tenants must operate in offline mode. There cannot be a mix of modes.

When using SSM On-Prem in a multitenancy scenario note that only the service provider configures connectivity to an SSM On-Prem license server. Individual tenants cannot configure separate license servers.

Cisco Umbrella Secure Internet Gateway (SIG)

Assigning a DNA Premier entitlement to a device does not automatically enable Cisco Umbrella Secure Internet Gateway (SIG).

Set up Smart Account and Virtual Accounts

Set up a Smart Account and ensure that the licenses you are managing with Cisco Catalyst SD-WAN Manager are organized into one or more Virtual Accounts. This requires a user role with the required access rights to a Smart Account and the required Virtual Accounts. See Create a Smart Account.

For more guidance and information, see How to create a Smart Account and Cisco Software Licensing and Smart Accounts.

Purchase Licenses

Refer to the Cisco Catalyst Software-Defined Routing (SD-Routing) Ordering Guide to purchase the required licenses.

Once purchased, licenses are deposited in the Smart Account and Virtual Account you specify in your order, and you can view these by logging into the Cisco SSM portal.

Choose a License Reporting Mode

The reporting mode is the method Cisco Catalyst SD-WAN Manager uses, to report license usage to Cisco SSM. This must therefore be aligned with the topology you implement.

When using Cisco Catalyst SD-WAN multitenancy, the chosen mode applies to all the tenants in a multitenant scenario.

Caution

If you are using this procedure to change the mode, note that Cisco Catalyst SD-WAN Manager removes all currently stored license information.

Follow these steps to choose or change the license reporting mode:

Step 1	From the Cisco Catalyst SD-WAN Manager menu, choose Administration > Settings > License Reporting.
Step 2	Choose one of the three license server options: Online, Offline, or On-prem. For On-Prem, provide these details as well: SSM Server: Enter the IP address of the SSM On-Prem license server. SSM Credentials: Enter the client ID and client secret credentials for the Cisco SSM on-prem license server. If you don't have this information, check with the administrator who manages the license server in your organization.
Step 3	Click Save.

What's next

If you have chosen the Online Mode, complete the tasks outlined in Implement an Online License Reporting Mode.

If you have chosen the Offline Mode, complete the tasks outlined in Implement the Offline License Reporting Mode.

If you have chosen the On-Prem Mode, complete the tasks outlined in Implement the On-Prem License Reporting Mode.

Implement an Online License Reporting Mode

This table provides the sequence of tasks involved in implementing a topology where Cisco Catalyst SD-WAN Manager is connected to Cisco SSM, either directly, or through a proxy server, or through SSM On-Prem.


Task	Purpose
Verify Connectivity to the Cisco SSM Server	Required for all online modes, for connectivity to the internet.
Configure HTTP/HTTPS Proxy Server and Enable Global Proxy Server	Required only if you want to use a proxy server to access Cisco SSM. Cisco Catalyst SD-WAN Manager uses the proxy server for internet access and completes all licensing workflows.
Smart Software Manager On-Prem Installation Guide.	Required only if you want to use a proxy server to access SSM On-Prem.
Enter Smart Account Credentials in Cisco Catalyst SD-WAN Manager	Required for all online modes, for Cisco Catalyst SD-WAN Manager to perform licensing workflows such as reporting.
Check License Inventory in Cisco SSM	Recommended for all online modes, to ensures that you know the up-to-date tally of the available licenses, before you begin assigning.
Synchronize licenses	Recommended for all online modes, especially if you have recently added licenses to your Smart Account and Virtual Accounts, to ensure that you have the latest tally of the available licenses in Cisco Catalyst SD-WAN Manager, before you begin assigning licenses.
Assign Licenses to SD-Routing Devices	Required for all modes, to use the corresponding software features.
Install SLAC for an HSECK9 License	Required for all modes, if it is an HSECK9-compatible SD-Routing device and you require throughput greater than 250 Mbps.

Result of Implementing an Online Mode:

When you've completed the sequence of tasks for the online mode, Cisco Catalyst SD-WAN Manager starts recording license usage based on assigned licenses. Because it is connected to Cisco SSM, Cisco Catalyst SD-WAN Manager automatically sends license usage reports to Cisco SSM at a fixed, system-determined reporting interval of 24 hours.

If you have chosen the same Virtual Account to assign licenses to devices in multiple Cisco Catalyst SD-WAN Manager instances, each instance does its own reporting, and only for licenses consumed by devices in that instance.

These figures illustrate the licensing workflows that Cisco Catalyst SD-WAN Manager performs - depending on how it is setup to communicate with Cisco SSM.

Cisco Catalyst SD-WAN Manager is directly connected to Cisco SSM

Cisco Catalyst SD-WAN Manager is connected to Cisco SSM, through an HTTP or HTTPs proxy server

Cisco Catalyst SD-WAN Manager is connected to SSM On-Prem, through an HTTP or HTTPs proxy server.

Verify Connectivity to the Cisco SSM Server

When implementing the online mode Cisco Catalyst SD-WAN Manager must have connectivity to the apx.cisco.com and swapi.cisco.com domains.

In a multitenant scenario, only the provider has access to Cisco Catalyst SD-WAN Manager. In this scenario, the provider performs this procedure.

Before you begin

Ensure that Cisco Catalyst SD-WAN Manager has connectivity to the internet through VPN 0.

Step 1

From the Cisco Catalyst SD-WAN Manager menu, choose Monitor > Overview.

Step 2

Go to Control Components > Manager

All the Cisco Catalyst SD-WAN Manager instances are displayed.

Step 3

Verify connectivity for each Cisco Catalyst SD-WAN Manager instance.

Click … in the Action column, and choose SSH Terminal.
Log in using your Cisco Catalyst SD-WAN Manager credentials.

Use the nslookup command to verify connectivity to each of the following domains over VPN 0.

Cisco Catalyst SD-WAN Manager requires connectivity to: apx.cisco.com and swapi.cisco.com.

If the output shows external IP addresses, it means that Cisco Catalyst SD-WAN Manager is able to resolve the domain names and has connectivity.

Example:

This sample output shows connectivity to both domains.

Device# nslookup vpn 0 apx.cisco.com
nslookup in VPN 0:
Server:    10.1.0.1
Address 1: 10.1.0.1 dns.google

Name:      apx.cisco.com
Address 1: 10.1.0.2 apmx-prod1-vip.cisco.com

Device# nslookup vpn 0 swapi.cisco.com
nslookup in VPN 0:
Server:    10.1.0.1
Address 1: 10.1.0.1 dns.google

Name:      swapi.cisco.com
Address 1: 10.2.0.1 swapi.cisco.com
Address 2: 1234:5678:90ab::1 swapi.cisco.com

Enter Smart Account Credentials in Cisco Catalyst SD-WAN Manager

Specifying Smart Account and Virtual Account information, enables Cisco Catalyst SD-WAN Manager to access license information from the specified accounts.

To complete this task, you need the username and password of the Smart Account to which you have administrative privileges.

Follow these steps to enter Smart Account credentials in Cisco Catalyst SD-WAN Manager.

Step 1	From the Cisco Catalyst SD-WAN Manager menu, choose Administration > License Management > Sync Licenses .
Step 2	Click Smart Account Credentials , and enter the username and password.
Step 3	Click Save. If authentication is successful, the credentials are saved. You can now synchronize licenses as and when required. For instance, if you want to assign licenses to SD-Routing devices, and you have recently added licenses to your Virtual Account, start by synchronizing.

Configure HTTP/HTTPS Proxy Server and Enable Global Proxy Server

For scenarios in which Cisco Catalyst SD-WAN Manager is not connected directly to the internet, using a proxy server can provide access to Cisco SSM, or to SSM On-prem. For this, a global proxy server must be enabled and the proxy server must have access to Cisco SSM or SSM On-Prem.

Follow these steps to configure an HTTP or HTTPS proxy server.

Step 1	First complete this task to configure a proxy server: Configure HTTP/HTTPS Proxy Server.
Step 2	Go to Administration > Settings
Step 3	Click HTTP/HTTPS Proxy Server and enable the HTTP/HTTPS Proxy Server option.
Step 4	Click Save. This enables a global proxy server for Cisco Catalyst SD-WAN Manager.

Check License Inventory in Cisco SSM

Checking license inventory in Cisco SSM before assigning licenses in Cisco Catalyst SD-WAN Manager ensures that you see the most up-to-date tally of the available licenses.

The inventory in Cisco SSM does not account for licenses that have not been reported yet. The fixed, system-determined reporting interval in Cisco Catalyst SD-WAN Manager, is 24 hours. This means that if another Cisco Catalyst SD-WAN Manager instance used licenses from the same Virtual Account that you are going to use, and it has not been 24 hours since that instance assigned licenses, the inventory in Cisco SSM does not reflect it.

Step 1	Log in to Cisco SSM at https://software.cisco.com, and click Manage licenses. Log in using the username and password provided by Cisco. The Smart Software Licensing page is displayed.
Step 2	In the top right-hand corner, check that the correct Smart Account is selected.
Step 3	Go to Inventory.
Step 4	Choose the Virtual Account from which you want to assign licenses.
Step 5	Click Licenses, to check that there is an adequate balance of the required licenses.

Synchronize licenses

When Cisco Catalyst SD-WAN Manager is connected to Cisco SSM, or SSM On-Prem, directly, or through a proxy server, you can synchronize license information. This ensures that Cisco Catalyst SD-WAN Manager has an up-to-date tally of available licenses, before assignment.

Follow these steps to synchronize licenses.

Step 1	From the Cisco Catalyst SD-WAN Manager menu, choose Administration > License Management > Sync Licenses.
Step 2	Select the Smart Accounts and Virtual Accounts with which to synchronize.
Step 3	Click Sync. Synchronization may take a few minutes, depending on how many Smart Accounts and Virtual Accounts you have selected.

Assign Licenses to SD-Routing Devices

Assigning licenses, enables the use of a set of software features on the device.

Regardless of how you report license usage, whether in the online, offline, or on-prem mode, licenses are assigned the same way.

Follow these steps to assign licenses to SD-Routing devices.

Step 1	From the Cisco Catalyst SD-WAN Manager menu, choose Administration > License Management > Devices > Assign Licenses. This starts the License Assignment Workflow.
Step 2	By default only SD-WAN devices are listed. Change the option in the dropdown to SD-Routing, and choose one or more SD-Routing devices. Click Next.
Step 3	Choose the license you want to assign to each device. Because different licenses apply to the different SD-Routing devices, Cisco Catalyst SD-WAN Manager pre-filters the list of supported licenses for each. A preferred option is pre-selected; you can change this. The count of licenses in the Available and In Use columns are as of the last synchronization. What you assign, is reflected when you synchronize next. You can check and change the Smart Account and Virtual Account pair from which the license is assigned, click … in the Action column. In a multi-tenant scenario, when you have selected devices to assign licenses, you see a message about the total number of tenant licenses you are going to need. You can change which Virtual Account each license comes from as long as the total count matches up.
Step 4	Click Next to review the assignments, and again Next, to confirm. Cisco Catalyst SD-WAN Manager starts recording license usage.

Install SLAC for an HSECK9 License

Installation of a Smart Licensing Authorization Code (SLAC) on the device authorizes and enables the use of an HSECK9 license. Cisco Catalyst SD-WAN Manager synchronizes with Cisco SSM to retrieve the SLAC and install it on the required SD-Routing device.

Before you begin

If you are performing this task on a Catalyst 8000V Edge device, which was converted from the autonomous mode and not reloaded after conversion, reload the device before you start.

In the autonomous mode, a Catalyst 8000V Edge device uses the device unique device identifier (UDI) as a licensable UDI. The Sync and Install HSEC Licenses workflow in Cisco Catalyst SD-WAN Manager requires a UUID. After reload, SD-Routing devices use the UUID as licensable UDI.

Follow these steps to request and install SLAC for an HSECK9-compatible device.

Step 1	From the Cisco Catalyst SD-WAN Manager menu, choose Workflows > Workflow Library > Sync and Install HSEC Licenses .
Step 2	Complete the Sync Licenses sequence of steps.
Step 3	Verify synchronization. Navigate to Administration > License Management > Devices Check that the HSEC License Status column for the device is `fetched`.
Step 4	Complete the Install Licenses sequence of steps.

Implement the Offline License Reporting Mode

This table provides the sequence of tasks involved in implementing the offline mode, where Cisco Catalyst SD-WAN Manager is not connected to the internet, and where one has to manually synchronize with the Cisco SSM at regular intervals.


Task	Purpose
Download a License Summary File From Cisco SSM and Upload to Cisco Catalyst SD-WAN Manager	Required for the offline mode, but can be delayed. This task involves the entry of Smart Account details in Cisco Catalyst SD-WAN Manager, before starting the process of assigning licenses to devices. You can delay this activity, but if you do, Cisco SSM prompts you to select the relevant Virtual Account when you generate the usage report file for the first time and upload it to Cisco SSM.
Assign Licenses to SD-Routing Devices	Required for all modes, to use the corresponding software features.
Install SLAC for an HSECK9 License	Required for all modes, if it is an HSEC-compatible SD-Routing device and you require throughput greater than 250 Mbps.
Report Usage in the Offline Mode	Required for the offline mode, to ensure compliance.

Result of Implementing the Offline Mode:

When you've completed the sequence of tasks for the offline mode, license usage information as of the last uploaded report, is available in Cisco SSM.

Cisco Catalyst SD-WAN Manager is not connected to anything outside the organization’s network.

Cisco Catalyst SD-WAN Manager requires synchronization with Cisco SSM within an interval of 90 days. Alerts in the License Management dashboard, inform you when synchronization is overdue. Some licenses may require more frequent synchronization.

Prepaid licenses require a report every three months. Repeat task Report Usage in the Offline Mode as required.

Download a License Summary File From Cisco SSM and Upload to Cisco Catalyst SD-WAN Manager

In scenarios where the Cisco Catalyst SD-WAN Manager does not have internet access, all communication is in the form of uploaded and downloaded files.

Generating a license summary file in Cisco SSM and uploading the file to Cisco Catalyst SD-WAN Manager brings all of the license information from the corresponding Smart Account, into Cisco Catalyst SD-WAN Manager.

Step 1	Log in to Cisco SSM at https://software.cisco.com, and click Manage licenses Log in using the username and password provided by Cisco. The Smart Software Licensing page is displayed.
Step 2	In the top right-hand corner, check that the correct Smart Account is selected. You can download a license summary file for only one Smart Account at a time.
Step 3	Go to Reports > Synch File for Device Controllers.
Step 4	Choose vManage as the Controller Type, specify the Virtual Accounts you want to include, and click Download the Synch File. A file with extension `tar.gz` is downloaded.
Step 5	From the Cisco Catalyst SD-WAN Manager menu, choose Administration > License Management > Sync Licenses.
Step 6	Point to the file you downloaded from Cisco SSM and click Sync, to upload the file to Cisco Catalyst SD-WAN Manager. You can now proceed with assigning licenses provisioned with Smart Account and Virtual Account information, to SD-Routing devices. This makes the reporting part more straightforward, since account information is automatically included when you report license usage.

Report Usage in the Offline Mode

In scenarios where the Cisco Catalyst SD-WAN Manager does not have internet access, all communication is in the form of uploaded and downloaded files.

Manually generating a license usage report file and uploading it to Cisco SSM ensures the availability of up-to-date license usage information in Cisco SSM, and compliance.

Step 1	From the Cisco Catalyst SD-WAN Manager menu, choose Administration > License Management > Reporting.
Step 2	In the applicable Smart Account's row, click … and choose Generate Report to generate the usage report file. When you generate a report, the Cisco Catalyst SD-WAN Manager starts a 48-hour timer. If you do not upload an acknowledgement file from Cisco SSM within that time, an alert appears in the License Management Overview dashboard.
Step 3	Log in to Cisco SSM at https://software.cisco.com, and click Manage licenses.
Step 4	Navigate to Reports > Usage Data Files, and click Upload Usage Data , to select and upload the usage report to Cisco SSM. If you did not generate a license summary in Cisco SSM and upload it to Cisco Catalyst SD-WAN Manager before assigning licenses, Cisco SSM prompts you to select a virtual account. When you provide Cisco Catalyst SD-WAN Manager with a license summary file before assigning licenses, Cisco Catalyst SD-WAN Manager has the virtual account information that it needs, to associate licenses with the correct virtual account. The usage report you generated thereafter also, has the virtual account information.
Step 5	In the Acknowledgement column, click Download to save the ACK file. If there many usage reports to process, you may have to wait a while for the file to appear in the Acknowledgement column.
Step 6	Go back to the Cisco Catalyst SD-WAN Manager menu, choose Administration > License Management > Reporting.
Step 7	In the applicable Smart Account's row, click … and choose Upload Ack to upload the acknowledgement file from Cisco SSM.

Implement the On-Prem License Reporting Mode

Prerequisites When Using SSM On-Prem

Cisco Catalyst SD-WAN Manager must be hosted on-premises to enable local connectivity to the SSM On-Prem license server. Cisco Catalyst SD-WAN Manager cannot be hosted on a cloud server.
The SSM On-Prem version is 8-202206 or later. See Smart Software Manager On-Prem.
There is connectivity between the Cisco Catalyst SD-WAN Manager host and the SSM On-Prem license server.
The SSM On-Prem license server must be operational.

This table provides the sequence of tasks involved in implementing the on-prem mode, where Cisco Catalyst SD-WAN Manager has local connectivity to the SSM On-Prem license server.


Task	Purpose
Install SSM On-Prem. Go to Smart Software Manager On-Prem. Documentation is available along with the software download file.	Required for the On-Prem Mode. Installation is complete when you have deployed SSM On-Prem configured a common name synchronized the NTP server, and created, registered, and synchronized the SSM On-Prem local account with your Smart Account and Virtual Account in Cisco SSM. Note Licensing functions in the On-Prem Licensing Workspace are greyed-out until you complete the creation, registration, and synchronization of the local account with your Smart Account in Cisco SSM. Local account synchronization with Cisco SSM enables the SSM On-Prem instance to be known to Cisco SSM. This is different from license usage synchronization.
Assign Licenses to SD-Routing Devices	Required for all modes, to use the corresponding software features.
Install SLAC for an HSECK9 License	Required for all modes, if it is an HSEC-compatible SD-Routing device and you require throughput greater than 250 Mbps.

Result of Implementing the On-Prem Mode

After you have completed implementation, Cisco Catalyst SD-WAN Manager synchronizes license information with SSM On-Prem every 24 hours. During this synchronization, Cisco Catalyst SD-WAN Manager receives any updates to available licenses and it sends license usage reports to SSM On-Prem.

For information about configuring the frequency of synchronization between SSM On-Prem and Cisco SSM, refer to the Cisco Smart Software Manager On-Prem User Guide, which is also available along with the software download file.

Cisco Catalyst SD-WAN Manager is connected to Cisco SSM through SSM On-Prem

Recurring License Management Activities

After implementation of a supported topology, depending on the setup, the user or the system performs any routine or recurring license management activites, as applicable and as required.

The user performs licensing workflows such as assigning or monitoring licenses, finding the remaining term on a license, releasing a license, and so on.
License usage is recorded automatically.
License usage reporting may be triggered automatically, scheduled, or completed manually. This is topology-dependent.

This table provides a ready reference to general or recurring license management activities.


Activity or Task	Where the activity takes place for an SD-Routing device in config mode	Where the activity takes place for a SD-Routing device in monitor mode
Display and assign licenses See Assign Licenses to SD-Routing Devices	Only in Cisco Catalyst SD-WAN Manager	In Cisco Catalyst SD-WAN Manager, for monitoring and Cisco DNA licenses. On the device, for all other licenses.
License consumption and usage recording	Only in Cisco Catalyst SD-WAN Manager	In Cisco Catalyst SD-WAN Manager, for monitoring and Cisco DNA licenses. On the device, for all other licenses.
License usage reporting to Cisco SSM	Only in Cisco Catalyst SD-WAN Manager and according to license reporting mode.	From Cisco Catalyst SD-WAN Manager, for monitoring and Cisco DNA licenses. From the device and according to topology, for all other licenses.
Monitor license usage See Monitor License Usage for SD-Routing Devices	Only in Cisco Catalyst SD-WAN Manager	In Cisco Catalyst SD-WAN Manager, for monitoring and Cisco DNA licenses. From the device, for all other licenses.
Release a license See Release a License	Only in Cisco Catalyst SD-WAN Manager	From Cisco Catalyst SD-WAN Manager, for monitoring and Cisco DNA licenses. From the device, for all other licenses.
Decommission a device See Decommission an SD-Routing Device	Only in Cisco Catalyst SD-WAN Manager	From Cisco Catalyst SD-WAN Manager, for monitoring and Cisco DNA licenses. From the device, for all other licenses, by performing a factory reset.

Monitor License Usage for SD-Routing Devices

Monitor license usage to know

the number and percentage of licensed versus unlicensed devices
the most commonly used licenses
the remaining term on a license, to arrange for timely renewals
view license usage, license alarms, and so on.

From the Cisco Catalyst SD-WAN Manager menu, choose Administration > License Management.

The Overview tab provides a high-level overview of licensed and unlicensed devices.

The Devices tab provides more detailed information.

License Compliance Checks

Cisco Catalyst SD-WAN Manager actively monitors the compliance status of licenses. This helps identify issues with license synchronization, device assignments, or expired licenses. In case of an issue, it displays a compliance error message.

If the network is out of compliance due to a licensing issue, an Out of Compliance Due to Licensing message appears.

The possible causes for this message are:

Cisco Catalyst SD-WAN Manager has not been synchronized with Cisco SSM through one of the supported methods—online, offline, or SSM On-Prem.
There are devices that do not have licenses assigned.
One or more devices has an expired license for a postpaid subscription.

The message remains until all compliance issues are resolved.

You can also lookup license compliance status information. The License Management > Device page shows each device for which licensing is relevant and displays the license compliance status of each device.

Release a License

You can manually release a license in Cisco Catalyst SD-WAN Manager, without having to remove or decommission the device. This leaves the license available to use with other devices.

Follow these steps to release a license from a device.

Step 1	From the Cisco Catalyst SD-WAN Manager menu, choose Administration > License Management > Devices
Step 2	In the applicable device's row, click … and choose Release Licenses.
Step 3	Click Proceed, to confirm license release.

Decommission an SD-Routing Device

You may want to decommission a device

as part of issuing a Return Material Authorization (RMA) for the device, or
to permanently stop using it.

When you decommission a device, Cisco Catalyst SD-WAN Manager, removes the device from the network, and automatically releases any license assigned to the device - except for an HSECK9 license.

Step 1	From the Cisco Catalyst SD-WAN Manager menu, choose Configuration > WAN Edges.
Step 2	In the applicable device's row, click … and choose Decommission WAN Edge.
Step 3	Confirm decommissioning.

Switching Between the Different Router Operating Modes

These are the different router operating modes.

Autonomous Mode	SD-Routing Mode (Can be config or monitor mode)	SD-WAN controller mode
`Device# show version <output truncated> Router operating mode: Autonomous`	`Device# show version <output truncated> Router operating mode: Autonomous (SD-Routing)`	`Device# show version <output truncated> Router operating mode: Controller-Managed`

Autonomous Mode

SD-Routing Mode

(Can be config or monitor mode)

SD-WAN controller mode

Device# show version
<output truncated>
Router operating mode: Autonomous

Device# show version
<output truncated>
Router operating mode: Autonomous (SD-Routing)

Device# show version
<output truncated>
Router operating mode: Controller-Managed

When a router's operating mode changes, system processes ensure that any current license consumption is released to avoid double consumption. This section outlines the behavior and processes related to operating mode changes in routing devices.

From Autonomous Mode to SD-Routing Config or Monitor Mode


Mode Change Initiation:	Enter the sd-routing command in global configuration mode.
Reload Requirement:	No reload required.
Sequence of events:	For an SD-Routing device in config mode: The device initiates closure of all open license usage reports (RUM reports), except for HSECK9 licenses. After a final round of reporting, which reflects information about all released licenses, and receipt of the acknowledgement from Cisco SSM, ensures current license usage is correctly reflected in Cisco SSM. The device stops further license usage recording after control-plane connections in Cisco Catalyst SD-WAN Manager are up. Users follow a suitable method of onboarding the device and manage license assignments via Cisco Catalyst SD-WAN Manager, to ensure license reporting and compliance. For more information, see Onboard an Existing Hardware(Physical) Routing Device Manually.
Sequence of events:	For an SD-Routing device in monitor mode: The device continues to operate as it did in the autonomous mode. Users follow a suitable method of onboarding the device and manage license assignments via Cisco Catalyst SD-WAN Manager - as available to devices in the monitor mode.

From SD-Routing Config or Monitor Mode to Autonomous Mode


Mode Change Initiation:	Enter the no sd-routing command in global configuration mode
Reload Requirement:	No reload required.
Sequence of events:	For an SD-Routing device in config mode: The SD-Routing infrastructure notifies the device about the mode change, and the licenses that were in use before the switch to SD-Routing config mode. The device starts recording license usage and generates RUM reports after configuration change. Reporting to Cisco SSM is as per the topology that is implemented. Note If a device in autonomous mode with licenses configured is changed to SD-Routing, reloaded in SD-Routing config mode, the then switched back to the autonomous mode, then the system cannot restore the licenses of such a device. Users will have to configure the boot level licenses and and reload the device for the proper license level to be reflected in the configuration.
Sequence of events:	For an SD-Routing device in monitor mode: The device continues to operate as it did in the autonomous mode. Cisco Catalyst SD-WAN Manager stops reporting for licenses in monitor mode.

From SD-Routing Config or Monitor Mode to SD-WAN Controller Mode


Mode Change Initiation:	Decommission the SD-Routing device. See: Decommission an SD-Routing Device.
Reload Requirement:	Reload is required.
Sequence of events:	During reload, all the device configuration is erased. Onboard the device in SD-WAN controller mode. See Install and Upgrade Cisco IOS XE Catalyst SD-WAN Release 17.2.1r and Later.

From SD-WAN Controller Mode to SD-Routing Config or Monitor Mode


Mode Change Initiation:	Enter the controller-mode disable command in privileged EXEC mode, save configuration changes, and reload.
Reload Requirement:	Reload is required.
Sequence of events:	During reload, all the device configuration is erased. After reload, the device is in autonomous mode and must be onboarded as an SD-Routing device. Users follow a suitable method of onboarding the device and manage license assignments via Cisco Catalyst SD-WAN Manager, to ensure license reporting and compliance. For more information, see SD-Routing: Onboard Routing Devices to Cisco SD-WAN Manager.

Feature History for SD-Routing Licensing

This table provides a summary of licensing related changes for SD-Routing. These features are available in all the releases subsequent to the one they were introduced in, unless noted otherwise.


Feature Name	Release	Feature Information
SD-Routing License Management	Cisco IOS XE 17.15.1a Cisco IOS XE Catalyst SD-WAN Release 17.15.1a Cisco Catalyst SD-WAN Manager Release 20.14.1	Introduces license management support for SD-Routing devices. The supported licensing workflows include license assignment or configuration, license use, and license usage reporting.

Managing Licenses for SD-Routing Devices

Managing Licenses for SD-Routing Devices

Scope of This Document

Recommended Reading

Config and Monitor Mode SD-Routing Devices

Available Licenses for SD-Routing Devices

How License Management Works for SD-Routing Devices

Cisco SSM Connection Options for All SD-Routing Devices

Online Modes (Recommended)

Offline Mode

On-Prem Mode

Cisco SSM Connection Options for Monitor Mode Devices

How HSECK9 License Management Works for SD-Routing Devices

HSECK9 License Requirements

Requesting SLAC for HSECK9 Licenses

Returning SLAC for HSECK9 Licenses

Restrictions for HSECK9 Licenses

HSECK9-Compatible SD-Routing Devices

Return SLAC for an HSECK9 License That Is In-Use

Before you begin

Example:

Begin Implementation

Restrictions for SD-Routing License Management

Set up Smart Account and Virtual Accounts

Purchase Licenses

Choose a License Reporting Mode

What's next

Implement an Online License Reporting Mode

Verify Connectivity to the Cisco SSM Server

Before you begin

Example:

Enter Smart Account Credentials in Cisco Catalyst SD-WAN Manager

Configure HTTP/HTTPS Proxy Server and Enable Global Proxy Server

Check License Inventory in Cisco SSM

Synchronize licenses

Assign Licenses to SD-Routing Devices

Install SLAC for an HSECK9 License

Before you begin

Implement the Offline License Reporting Mode

Download a License Summary File From Cisco SSM and Upload to Cisco Catalyst SD-WAN Manager

Report Usage in the Offline Mode

Implement the On-Prem License Reporting Mode

Prerequisites When Using SSM On-Prem

Recurring License Management Activities

Monitor License Usage for SD-Routing Devices

License Compliance Checks

Release a License

Decommission an SD-Routing Device

Switching Between the Different Router Operating Modes

From Autonomous Mode to SD-Routing Config or Monitor Mode

From SD-Routing Config or Monitor Mode to Autonomous Mode

From SD-Routing Config or Monitor Mode to SD-WAN Controller Mode

From SD-WAN Controller Mode to SD-Routing Config or Monitor Mode

Feature History for SD-Routing Licensing

Bias-Free Language

Need help?