Managing CPS Licenses

Smart Software Licensing

CPS 10.0.0 and its later releases support Smart Licensing. It is a cloud-based approach to licensing that simplifies the purchase, deployment, and management of Cisco software assets. Entitlements are purchased through your Cisco account via Cisco Commerce Workspace (CCW) and immediately deposited into your Virtual Account for usage. This eliminates the need to install license files on every device. Products that are smart enabled communicate directly to Cisco to report consumption. A single location is available to customers to manage Cisco software licenses—the Cisco Smart Software Manager (CSSM). License ownership and consumption are readily available to help make better purchase decision based on consumption or business need.

Classic Licensing

Classic Licensing is Cisco’s legacy licensing model based on Product Activation Keys (PAK) and Unique Device Identifiers (UDI). On most IOS devices, a determination of bandwidth needs is assessed prior to obtaining and installing a tar file on the platform to retrieve the UDI. A PAK is ordered and typically emailed to the customer. The combination of a UDI and PAK are used to receive a license file, which is installed in the boot directory to complete the installation of IOS on the platform. The License Registration Portal (LRP) is available to help migrate Classic Licenses to Smart Licenses. To access the LRP, and to obtain training and manage licenses, visit http://tools.cisco.com/SWIFT/LicensingUI/Home.

Comparison between Licensing Models

The following sections provide a comparison of the existing CPS SWIFT-based licensing model, the Cisco Smart Software Licensing model, and Cisco Smart Software Licensing as it is implemented in CPS 10.0.0 and later releases.

CPS SWIFT-Based Licensing

For CPS versions prior to 10.0.0, CPS licensing is SWIFT "lmgrd" based, and the license is tied to the MAC address of the device on which CPS is installed. The following list summarizes the CPS SWIFT-based licensing model:

  • The License count that is purchased by the customer is defined in the license.lic file and is read into the CPS application using the lmgrd/cisco processes.

  • License compliance is determined and tracked by CPS. CPS periodically compares the current session count with the licensed count at a predefined interval.

  • CPS creates and logs license statuses: adhere, "RATE_LIMITED" and "VALID" statuses are logged with proper messages, and traps are generated accordingly.

Cisco Smart Software Licensing

The following list summarizes the Cisco Smart Software License model:

  • Smart Licensing maintains and tracks license information including license quantity, license surplus, and shortage usages.

  • There is no API for returning the number of licenses (entitlements) purchased by the customer.

  • License compliance is determined and tracked by Cisco Smart Software License. Entitlement enforcement mode notifications will send out when it is changed upon the request.

  • License (entitlement) expiration is tracked by Cisco Smart Software License. There is no API for returning the license expiration date.

  • Smart Licensing does not support license version.

  • Utility/Metering is not supported.

  • An entitlement consumption request is allowed once every 24 hours maximum.

  • Smart Licensing supports high availability. For Smart Agent clusters, one Smart Agent is active and the rest are standbys. This means that for a given cluster, only one Smart Agent is active, and it will register to the Smart Licensing portal at any time. (Smart License is a combination of Smart Agent and Smart Call Home, which is responsible for communicating to Cisco Smart Software Licensing.)

CPS Cisco Smart Software License Based Model

The following list summarizes the Cisco Smart Software License model for CPS 10.0.0 and greater:

  • For a CPS high availability installation, only the active client (either pcrfclient01 or pcrfclient02) is registered to the Smart Licensing Portal at any given time, and it uses the same identify for the registration.

  • CPS uses the Smart Licensing API to request the entitlement (license) consumption amount based on the pre-defined maximum licensed concurrent session amount.

  • The predefined maximum licensed concurrent session amount is defined in the features.properties file for each CPS feature.

  • One licensed entitlement count is equivalent to one CPS Policy concurrent session count.

  • Smart Licensing Entitlement notifies CPS about the requested entitlement conformance (enforce mode) if the requested entitlement consumption is InCompliance or OutCompliance or Eval, meaning that the product instance is not registered to the Smart Licensing Portal and is running in evaluation mode. CPS populates license data into mongoDB: shardding/licensedfeats <SITEID> collection based on the received entitlement compliance status.

  • The Smart Agent (SA) is embedded in CPS+SL (SA+SCH) integration. A CLI is supported.

  • CPS Orchestration API-based installation is not supported.

  • Dynamically switching the license manager from lmgrd to Smart Licensing or vise versa is supported. Switching the licensing manager requires a restart of CPS OAM (pcrfclient).

  • CPS Smart Licensing integration follows the CPS In-Service Software Upgrade process.

In summary, CPS 10.0.0 and later releases support the same functionality as CPS SWIFT imgrd-based licensing with the following exceptions:

  • There is no API to return the license amount available for the virtual account. A new “complianceMode” attribute has been added to indicate the requested feature entitlement compliance status with the following value options:

    • InCompliance – The requested feature entitlement maximum licensed amount is in surplus status.

    • OutOfCompliance – The requested feature entitlement maximum licensed amount is in shortage status.

    • Eval – The product is not yet registered to Cisco Smart License Cloud.

  • There is no API to return the license expiration date. The license expiration date value will set to “current date + 10 years future date” in CPS 10.0.0 and later releases.

  • Smart Licensing does not support license version. Currently, the license version is set to “V1.0” in CPS.

Smart Accounts/Virtual Accounts

A Smart Account provides a single location for all Smart-enabled products and entitlements. It helps speed procurement, deployment, and maintenance of Cisco Software. When creating a Smart Account, you must have the authority to represent the requesting organization. After submitting, the request goes through a brief approval process.

A Virtual Account exists as a sub-account within the Smart Account. Virtual Accounts are a customer-defined structure based on organizational layout, business function, geography or any defined hierarchy. They are created and maintained by the Smart Account administrator.

See http://software.cisco.com to learn about, set up, or manage Smart Accounts.

Request a Cisco Smart Account

A Cisco Smart Account is an account where all products enabled for Smart Licensing are deposited. A Cisco Smart Account allows you to manage and activate your licenses to devices, monitor license use, and track Cisco license purchases. Through transparent access, you have a real-time view into your Smart Licensing products. IT administrators can manage licenses and account users within your organization's Smart Account through the Smart Software Manager.

Procedure

Step 1

In a browser window, enter the following URL:

http://software.cisco.com

Step 2

Log in using your credentials, and then click Request Smart Account in the Administration area under Smart Account Management.

The Smart Account Request window is displayed.

Step 3

Under Create Account, select one of the following options:

  • Yes, I have authority to represent my company and want to create the Smart Account – If you select this option, you agree to authorization to create and manage product and service entitlements, users, and roles on behalf of your organization.

  • No, the person specified below will create the account – If you select this option, you must enter the email address of the person who will create the Smart Account.

Step 4

Under Account Information:

  1. Click Edit beside Account Domain Identifier.

  2. In the Edit Account Identifier dialog box, enter the domain, and click OK. By default, the domain is based on the email address of the person creating the account and must belong to the company that will own this account.

  3. Enter the Account Name (typically, the company name).

Step 5

Click Continue.

The Smart Account request will be in pending status until it has been approved by the Account Domain Identifier. After approval, you will receive an email confirmation with instructions for completing the setup process.

Cisco Smart Software Manager

Cisco Smart Software Manager (CSSM) enables the management of software licenses and Smart Account from a single portal. The interface allows you to activate your product, manage entitlements, and renew and upgrade software. A functioning Smart Account is required to complete the registration process. To access the Cisco Smart Software Manager, see https://software.cisco.com/.

License Conversion

Using the License Registration Portal, you can convert classic licenses that are associated with Product Activation Keys (PAKs) to smart entitlements.

Procedure

Step 1

To access the License Registration Portal:

  1. Login to the Cisco Software Central page at software.cisco.com.

  2. Under License, click Traditional Licensing.

    On the Welcome to the Product License Registration Portal window, you can choose to watch training videos, or you can go directly to the Product License Registration Portal.

  3. Select the Product License Registration Portal option.

    The Product License Registration page opens.

Step 2

Select the PAKs/Tokens tab to access your classic licenses.

Step 3

On the PAKs/Tokens tab, check the box next to the PAK/Token ID for which you want to convert licenses.

Step 4

From the Actions drop-down list, select Convert to Smart Entitlements.

In the Convert to Smart Entitlements dialog box, you can change to a different Virtual Account if needed.

Step 5

Check the box next to the PAK.

Step 6

Enter the Quantity to Convert, and click Submit.

You will receive a message when the conversion has completed successfully.
Step 7

Login to the Cisco Smart Software Manager (CCSM), and view the converted Smart Entitlements as follows:

  1. Select the Virtual Account, and click the License Conversion tab.

  2. Click the Event Log tab to see the confirmation message that the licenses were converted.

Enable Smart Licensing for CPS

You can enable smart licensing after upgrading CPS, or after a new CPS deployment.


Note

These steps must be performed on the Cluster Manager VM.

Procedure

Step 1

Log in to the Cluster Manager VM.

Step 2

Enter the following commands to create license_sl_data and license_sl_conf directories: 

mkdir -p /etc/broadhop/license_sl_data
mkdir -p /etc/broadhop/license_sl_conf
Step 3

Create the following license configuration files in the /etc/broadhop/license_sl_conf directory on the Cluster Manager:

  1. Create a file named features.properties, and add the required PID and count. For example:

    LicenseFeature=<PID>:<COUNT>

  2. Create a file named sl.properties with the following content from the CSSM account:

    TRANSPORT_URL=https://tools.cisco.com/its/service/oddce/services/DDCEService

  3. Create a file named conf.properties with the following content from the CSSM account. For example: 

    PRODUCT_SN=10999
PRODUCT_ID_TAG=CPS
SOFTWARE_ID_TAG=regid.2016-06.com.cisco.CPS10,1.0_e454cefa-5e10-4af4-81d8-3f76260485fb
USE_PROD_ROOT_CERT=true
RENEW_AUTH=false
TAC_PROFILE_NAME=CiscoTAC-1
HTTP_TRANSPORT_FLAG=true
HTTP_URL=https://tools.cisco.com/its/service/oddce/services/DDCEService
PRODUCT_NAME=Cisco Policy Suite
SOFTWARE_VERSION=10.0
SYSTEM_DESCRIPTION=Cisco Policy Suite for Mobile is a carrier-grade policy, charging, and subscriber data management solution.
PRODUCT_SERIES=Cisco Policy Suite Series
Step 4

Enter the following command to rebuild the /etc/broadhop/license_sl_data and license_sl_conf directory in the Cluster Manager VM: 

/var/qps/install/current/scripts/build/build_etc.sh
Step 5

Enter the following commands to push the license to pcrfclient01 and pcrfclient02: 

ssh pcrfclient01 
   /etc/init.d/vm-init 
                
ssh pcrfclient02
   /etc/init.d/vm-init
Step 6

Enter the following commands to map the Smart License server hostname to the IP address and to synchronize the /etc/hosts files across the VMs: 

echo "173.37.145.8 tools.cisco.com" >> /etc/hosts
/var/qps/bin/update/synchosts.sh
Step 7

Configure CPS to use Smart Licensing as follows:

  1. Open the qns.conf file by entering the following command: 

    vi /etc/broadhop/qns.conf

  2. Edit the qns.conf file, and add the following argument:

    -Dcom.broadhop.license.approach=sl

  3. Save and close the qns.conf file.

  4. Enter the following commands to copy the modified qns.conf file from Cluster Manager to all of the VMs: 

    copytoall.sh /etc/broadhop/qns.conf /etc/broadhop/qns.conf
restartall.sh
Step 8

To view license related logs, see the following log file:

/var/log/broadhop/license.log

Step 9

Access the Cisco Smart Software Manager (CSSM) at the following location:

https://software.cisco.com/

Step 10

Select the appropriate virtual account, and then click New Token in the General tab.

Step 11

In the Create Token dialog box, enter the required information, accept the terms and responsibilities, and then click Create Token.

Step 12

Select the token text, and copy it to your clipboard.

Step 13

Enter the following command, pasting the token that you copied in place of <token>:

license smart register idtoken <token> [force]

Product ID Tags

Tags for the following PIDs have been created to enable the proper product IDs to be identified, reported, and enforced.

Table 1. PID Tags

PID

Entitlement Tag

Entitlement name in CSSM

POLICY-VALUE

regid.2016-06.com.cisco.POLICY-VALUE, 1.0_7f667e53-11e1-40e2-9480-ff7eb064561c

CPS Value Plus Feature Pack

POLICY-ALL

regid.2016-06.com.cisco.POLICY-ALL, 1.0_65566461-0788-4c92-8ffa-f9a02e9843e8

CPS All Inclusive Feature Pack

POLICY-UPGRADE

regid.2016-06.com.cisco.POLICY-UPGRADE, 1.0_8fa236bc-e481-4673-aa4d-7da8f707647c

CPS Upgrade from Value Plus to All Inclusive Feature Pack

POLICY-ADD

regid.2016-06.com.cisco.PCRF-ADD, 1.0_676d51ca-4e14-40b3-81e7-1a600d726ce7

CPS PCRF Application License - Additional Applications

Smart Licensing CLI Commands

The following sections describe the commands that you can use to register, view information for, and manage Smart Licenses on your CPS systems.


Note

These commands must be run on the active pcrfclient.

Register your Smart License

You must issue the following command to register your Smart License:

license smart register idtoken <token> [force]

This command registers the device with Cisco using an ID token that you obtain from the CSSM. The agent will register this product with Cisco and receive back an identity certificate. This certificate is saved and automatically used for all future communications with Cisco. After registration it will send the current license usage information to Cisco. Every 180 days the agent will automatically renew the registration information with Cisco. The ID token is not saved on the device.

This only needs to be done once per device.

The force option will cause the device to attempt registration even if it thinks it is already registered.

Show Smart License Information

You can use the following commands to view information related to your Smart License:

  • show license status

  • show license summary

  • show license UDI

  • show license usage

  • show license all

  • show license tech support

Manage your Smart License

You can use the following commands to manage your Smart License:

  • license smart renew ID

    Dependency – Before using this command, Smart Licensing must be registered using the license smart register idtoken command.

    This command initiates a manual update of the license registration information with Cisco. Since the registration renewal is automatically done by the agent every 6 months, the customer will probably never need to use this command. It is available if for some reason the user needs to renew the registration information manually.

  • license smart renew auth

    Dependency – Before using this command, Smart Licensing must have been registered using the license smart register idtoken command.

    This command manually refreshes license authorization information with Cisco. Since the license authorization is renewed automatically by the agent every 30 days, the customer will probably never need to use this command. It is available if for some reason the user needs to renew the license authorization information manually.

  • license smart deregister

    Dependency – Before using this command, Smart Licensing must have been registered using the license smart register idtoken command.

    This command unregisters the device. The agent will try to contact the Cisco licensing cloud and unregister itself. All Smart Licensing entitlements and certificates on the platform will be removed. All certificates and registration information will be removed from the trusted store. This is true even if the agent is unable to communicate with Cisco to unregister. If the customer wants to use Smart Licensing again, they must run the license smart register idtoken command again.

License Usage Threshold

The Fault list configuration in Policy Builder allows configuring the thresholds at which License Usage Threshold Exceeded traps are sent out. The default recommended values are: Critical 95, Major 90, Minor 85 and Warning 80 which would result in traps being sent at 80, 85, 90 and 95 percent for License Usage Threshold Limits.

For example, if the license limit is 10000 sessions and there are 9600 active sessions, configuring the threshold at 95 and type as Critical would generate a Critical trap whose message is Session Count License Usage at 96%, exceeding threshold: 95%.

Configuration

Procedure

Step 1

Open the Policy Builder GUI.

Step 2

Go to Reference Data tab and select Fault List from the left pane.

Step 3

Under Create Child, click Fault List to create a License Usage Threshold Fault as below.

Figure 1. License Usage Threshold Fault
Step 4

Choose a Name for the Fault List. Currently, only License Usage Threshold Percentage fault type is supported. The Alarm Severity can be configured to be one of Critical, Major, Minor or Warning.

The recommended values for License Usage Threshold Percentage are:

  • Critical 95

  • Major 90

  • Minor 85

  • Warning 80

The above PB configuration when saved and published would trigger an application trap of type MAJOR when the 90% threshold configuration is crossed. One example of a trap sent would be number of licenses exceeded.

Validation Steps

Procedure
Step 1

Configure a Threshold Limit as explained above in PB.

Step 2

Generate active sessions exceeding the configured threshold limit.

Step 3

Validate the Traps are received on the configured trap receiver for the defined limit and Severity.