此产品的文档集力求使用非歧视性语言。在本文档集中,非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言,文档中可能无法确保完全使用非歧视性语言。 深入了解思科如何使用包容性语言。
思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言,希望全球的用户都能通过各自的语言得到支持性的内容。 请注意:即使是最好的机器翻译,其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任,并建议您总是参考英文原始文档(已提供链接)。
本文档介绍如何在SD-WAN XE cEdge上安装和排除HSECK9许可证故障。
Cisco 建议您了解以下主题:
本文档基于以下软件和硬件版本:
本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始(默认)配置。如果您的网络处于活动状态,请确保您了解所有命令的潜在影响。
使用策略的智能许可使用各种新概念,例如:
有关详细信息,请导航至使用策略概念的智能许可。
步骤1.导航至 Cisco Software Central.
步骤2.单击Smart Software Manager.
步骤3.选择 Inventory
从顶部菜单中。
步骤4.选择适当的 Virtual Account.
步骤5.选择 Licenses
选项卡。
步骤6.检验许可证已添加且可用且余额为正。
如果没有可用的许可证或余额为负(红色),请向思科许可团队反映问题。
注意:本指南假设您已购买了HSECK9许可证或用于DNA的路由器美国出口许可证,该许可证会添加到智能帐户中的有效虚拟帐户。
使用其中一个命令检验路由器是否处于控制器管理模式。
show platform software device-mode
show version | include mode
示例:
Router# show platform software device-mode
Device Operating-mode: Controller-Managed
Device-mode bootup status:
8/03 00:44:16 System is green
Bootup Success
Router# show version | in mode
Router operating mode: Controller-Managed
注意:如果工作模式导致自治模式,请将路由器移至控制器管理模式 controller-mode enable
命令。
步骤1.配置正确的传输类型和URL。
cEdge#config-transaction
cEdge(config)# license smart transport smart
cEdge(config)# license smart url default
cEdge(config)# commit
Commit complete.
注意:如果路由器附加了模板。支持传输和URL的智能命令,可以使用CLI附加功能模板进行配置。有关详细信息,请导航到CLI附加功能模板。
步骤2.检验更改是否正确提交。
cEdge# show lic tech support | begin Smart Licensing Status
Smart Licensing Tech Support info
Smart Licensing Status
======================
Smart Licensing is ENABLED
License Conversion:
Automatic Conversion Enabled: True
Status: Not started
Export Authorization Key:
Features Authorized:
<none>
Utility:
Status: DISABLED
Smart Licensing Using Policy:
Status: ENABLED
Data Privacy:
Sending Hostname: yes
Callhome hostname privacy: DISABLED
Smart Licensing hostname privacy: DISABLED
Version privacy: DISABLED
Transport:
Type: Smart <<<<<<<<<<<<<<<<<<<<<<<<<<<< This must be Smart
URL: https://smartreceiver.cisco.com/licservice/license <<<<<<<<<<<<<<< URL must be pointed to smartreceiver.cisco.com
Proxy:
Address: <empty>
Port: <empty>
Username: <empty>
Password: <empty>
Server Identity Check: True
注意:默认URL会自动激活,无需修改。
步骤1.生成新令牌。
在许可证所在的同一虚拟帐户中,导航至 General
选项卡并单击 New Token.
步骤2.填写新的令牌信息。
描述:令牌用途简要说明。
到期时间:令牌对产品注册有效的天数。
最大值.使用次数:令牌最大使用次数。可选。
确保 Allow export-controlled
选中该选项,否则,许可证注册失败,然后单击 Create Token
.
注意:当达到到期时间或达到最大使用量时,令牌到期。
注意:有关详细信息,请导航至思科出口贸易。
步骤3.复制令牌。
将刚生成的令牌复制到剪贴板;导航至 Actions > Copy
或手动输入令牌字符串旁边的小蓝色图标。
为了提供使用出口管制许可证的授权,cEdge必须与CSSM建立信任。对于握手,cEdge使用上一步中在CSSM上生成的令牌。
license smart trust idtoken TOKEN local force
示例:
cEdge# license smart trust idtoken ZThjOTlmM2UtMjQ2ZC00YjI1LTgwNjctZGIxZjIzYjZiYmVmLTE2NjM0NjI1%0AMjgyNTh8YWNVeTFiZU03N0lCdTFadmJ4ejZBL0toR2Mva21odElrQmxDa1FN%0AcVI3cz0%3D%0A local force
建立信任后,日志会显示与CSSM的通信。
cEdge# show logging last 50
<snip>
*Aug 18 21:03:44.730: %CRYPTO_ENGINE-5-KEY_DELETED: A key named SLA-KeyPair2 has been removed from key storage
*Aug 18 21:03:46.146: %CRYPTO_ENGINE-5-KEY_ADDITION: A key named SLA-KeyPair2 has been generated or imported by crypto-engine
*Aug 18 21:03:53.221: %SYS-6-PRIVCFG_ENCRYPT_SUCCESS: Successfully encrypted private config file
*Aug 18 21:03:56.107: %SMART_LIC-5-COMM_RESTORED: Communications with Cisco Smart Software Manager (CSSM) restored
*Aug 18 21:03:56.347: %SMART_LIC-6-TRUST_INSTALL_SUCCESS: A new licensing trust code was successfully installed on P:C1111-8PWE,S:FGL2149XXXX.
验证信任建立成功计数器是否增加,这意味着许可代理可以到达CSSM。
cEdge# show lic tech support | begin Communication Statistics
Communication Statistics:
=======================
Communication Level Allowed: DIRECT
Overall State: <empty>
Trust Establishment:
Attempts: Total=1, Success=1, Fail=0 Ongoing Failure: Overall=0 Communication=0 <<<<<<<<<<
Last Response: OK on Aug 18 21:03:56 2022 UTC
Failure Reason: <none>
Last Success Time: Aug 18 21:03:56 2022 UTC
Last Failure Time: Aug 18 21:00:43 2022 UTC
<snip>
注意:如果故障计数器增加,请导航至本文档中的故障排除部分。
此时,信任已建立,但HSECK9许可证尚未使用。之所以发生这种情况,是因为需要路由器向CSSM请求许可证。要获取许可证,请运行授权请求。
cEdge# license smart authorization request add hseck9 local
日志:
cEdge# show logging | include SMART
*Aug 18 21:11:41.553: %SMART_LIC-6-AUTHORIZATION_INSTALL_SUCCESS: A new licensing authorization code was successfully installed on PID:C1111-8PWE,SN:FGL2149XXXX
*Aug 18 21:11:41.641: %SMART_LIC-6-EXPORT_CONTROLLED: Usage of export controlled features is allowed for feature hseck9
在智能许可事件日志中,保存许可证请求信息,以备需要时使用。
cEdge# show lic eventlog 0
**** Event Log ****
2022-08-18 21:11:41.538 UTC SAEVT_RESERVE_INSTALL_START udi="PID:C1111-8PWE,SN:FGL2149XXXX" authorizationCode="<smartLicenseAuthorization><udi>P:C1111-8PWE,S:FGL2149XXXX</udi><authorizationCode><customerInfo><smartAccount>Cisco Systems, TAC</smartAccount><virtualAccount>sdwan-lab</virtualAccount></customerInfo><flag>A</flag><version>C</version><piid>d216f143-7e2c-48df-aa71-652b15ea1c7e</piid><dateStamp>2022-08-18T21:17:45</dateStamp><entitlements><entitlement><tag>regid.2019-03.com.cisco.DNA_HSEC,1.0_509c41ab-05a8-431f-95fe-ec28086e8844</tag><count>1</count><startDate></startDate><endDate></endDate><licenseType>PERPETUAL</licenseType><displayName>Router US Export Lic. for DNA</displayName><tagDescription>U.S. Export Restriction Compliance license for DNA based Routers</tagDescription><tagType>PERPETUAL</tagType><status><success>true</success></status></entitlement></entitlements><status><success>true</success><correlationID>62feac79ca9112704623118db58bbc2c-09b6eebc91ae833f</correlationID></status></authorizationCode><signature>MEUCIBuNw8+ogfZmJAbsRa+8B+F0wnDZLrv5RXm822rN/he5AiEAtfzzFV9L3dqht4sUYDxRvnUHF2KYi+vFv2vivDF6rIs=</signature></smartLicenseAuthorization>"
2022-08-18 21:11:41.552 UTC SAEVT_TAG_EXPORT exportAllowed="False" count="0" entitlementTag="regid.2019-03.com.cisco.DNA_HSEC,1.0_509c41ab-05a8-431f-95fe-ec28086e8844"
2022-08-18 21:11:41.576 UTC SAEVT_TAG_EXPORT exportAllowed="True" count="0" entitlementTag="regid.2019-03.com.cisco.DNA_HSEC,1.0_509c41ab-05a8-431f-95fe-ec28086e8844"
2022-08-18 21:11:41.576 UTC SAEVT_STATE_RESERVE_AUTHORIZED
2022-08-18 21:11:41.641 UTC SAEVT_TAG_AUTHORIZED count="1" entitlementTag="regid.2019-03.com.cisco.DNA_HSEC,1.0_509c41ab-05a8-431f-95fe-ec28086e8844"
2022-08-18 21:11:41.641 UTC SAEVT_TAG_EXPORT exportAllowed="True" count="1" entitlementTag="regid.2019-03.com.cisco.DNA_HSEC,1.0_509c41ab-05a8-431f-95fe-ec28086e8844"
2022-08-18 21:12:06.119 UTC SAEVT_RESERVE_INSTALL_START udi="PID:C1111-8PWE,SN:FGL2149XXXX" authorizationCode="<smartLicenseAuthorization><udi>P:C1111-8PWE,S:FGL2149XXXX</udi><authorizationCode><customerInfo><smartAccount>Cisco Systems, TAC</smartAccount><virtualAccount>sdwan-lab</virtualAccount></customerInfo><piid>d216f143-7e2c-48df-aa71-652b15ea1c7e</piid><status><success>false</success><message>last update already confirmed</message><code>last update already confirmed</code><correlationID>62feac7c4be974f92eefc15a640f938b-f08787827763ca37</correlationID></status></authorizationCode><signature>MEUCIQDhI8x+Rzf7wyibdohvYY6q9/8puukf8SuJ4ok48d4y5QIgdl5/z/7rLu+LEd5gK9kgOxA2Vb+vnJUcTOVPo3/R0pc=</signature></smartLicenseAuthorization>"
有些命令用于验证许可证现在是否可用并正确激活。
show license tech support | begin License Usage
show license authorization
show license summary
show license usage
示例:
cEdge# show license tech support | begin License Usage
License Usage
=============
Handle: 1
License: hseck9
Entitlement Tag: regid.2019-03.com.cisco.DNA_HSEC,1.0_509c41ab-05a8-431f-95fe-ec28086e8844
Description: hseck9
Count: 1
Version: 1.0
Status: IN USE(15) <<<<<<<<<<<<<<<<<<<<<<
Status time: Aug 18 21:11:41 2022 UTC
Request Time: Aug 18 21:11:41 2022 UTC
Export status: RESTRICTED - ALLOWED
Feature Name: hseck9
Feature Description: hseck9
Enforcement type: EXPORT RESTRICTED
License type: Perpetual
Measurements:
ENTITLEMENT:
Interval: 00:15:00
Current Value: 1
cEdge# show license authorization
Overall status:
Active: PID:C1111-8PWE,SN:FGL2149XXXX
Status: SMART AUTHORIZATION INSTALLED on Aug 18 21:11:41 2022 UTC <<<<<<<<<<<<<<<
Last Confirmation code: 0cde51c5
Authorizations:
Router US Export Lic. for DNA (DNA_HSEC):
Description: U.S. Export Restriction Compliance license for DNA based Routers
Total available count: 1
Enforcement type: EXPORT RESTRICTED
Term information:
Active: PID:C1111-8PWE,SN:FGL2149XXXX
Authorization type: SMART AUTHORIZATION INSTALLED <<<<<<<<<<<<<
License type: PERPETUAL
Term Count: 1
Purchased Licenses:
No Purchase Information Available
Edge# show license summary
License Usage:
License Entitlement Tag Count Status
-----------------------------------------------------------------------------
hseck9 (DNA_HSEC) 1 IN USE <<<<<<<<<<
对于不允许访问Internet的气隙网络,可以通过在CSSM上本地预留SLAC来执行出口控制许可证安装。
注意:此方法不需要传输类型或有效的智能统一资源定位器(URL)。
在许可证所在的同一虚拟帐户中,导航至 Product Instances > Authorize License-Enforced Features.
本地许可证保留需要唯一设备标识符(UDI))中,运行 show license udi
命令获取产品ID(PID)和序列号(SN)。
cEdge# show license udi
UDI: PID:C1111-8PWE,SN:FGL2149XXXX
选择Single Device
并填写cEdge的SN和PID。点击 Next
.
由于它是单个设备,因此保留的许可证是1,请在框中键入数字。确保数字不超过可用数字。
设备类型可以是内部数字网络架构(DNA)或DNA云,这取决于所购买许可证的类型。
查看配置,然后单击Generate Authorization Code。
SLAC可下载为文件或复制到剪贴板。
有三个选项可以将SLAC文件复制到cEdge。
cEdge# show file systems | include usb|Size
Size(b) Free(b) Type Flags Prefixes
15598043136 15596658688 disk rw usb0:
cEdge# dir usb0:
Directory of usb0:/
5 -rwx 1557 Aug 19 2022 00:43:30 +00:00 AuthorizationCode_SN_FGL2149XXXX.txt
15598043136 bytes total (15596658688 bytes free)
cEdge# copy usb0:AuthorizationCode_SN_FGL2149XXXX.txt bootflash:
Destination filename [AuthorizationCode_SN_FGL2149XXXX.txt]?
Copy in progress...C
1557 bytes copied in 0.020 secs (77850 bytes/sec)
使用智能导入在bootflash中安装SLAC文件。
cEdge# license smart import bootflash:AuthorizationCode_SN_FGL2149XXXX.txt
Import Data Successful
Last Confirmation code UDI: PID:C1111-8PWE,SN:FGL2149XXXX
Confirmation code: aaa6b57e
日志。
cEdge# show logging | include SMART
*Aug 19 05:42:45.309: %SMART_LIC-6-AUTHORIZATION_INSTALL_SUCCESS: A new licensing authorization code was successfully installed on PID:C1111-8PWE,SN:FGL2149XXXX
*Aug 19 05:42:45.362: %SMART_LIC-6-EXPORT_CONTROLLED: Usage of export controlled features is allowed for feature hseck9
cEdge# show license eventlog 0
**** Event Log ****
2022-08-19 05:42:45.293 UTC SAEVT_RESERVE_INSTALL_START udi="PID:C1111-8PWE,SN:FGL2149XXXX" authorizationCode="<smartLicenseAuthorization><udi>P:C1111-8PWE,S:FGL2149XXXX</udi><authorizationCode><customerInfo><smartAccount>Cisco Systems, TAC</smartAccount><virtualAccount>sdwan-lab</virtualAccount></customerInfo><flag>A</flag><version>C</version><piid>0ceadf0a-3145-4779-8cbb-743c5a234a05</piid><dateStamp>2022-08-19T05:43:11</dateStamp><entitlements><entitlement><tag>regid.2019-03.com.cisco.DNA_HSEC,1.0_509c41ab-05a8-431f-95fe-ec28086e8844</tag><count>1</count><startDate></startDate><endDate></endDate><licenseType>PERPETUAL</licenseType><displayName>Router US Export Lic. for DNA</displayName><tagDescription>U.S. Export Restriction Compliance license for DNA based Routers</tagDescription><tagType>PERPETUAL</tagType><status><success>true</success></status></entitlement></entitlements><status><success>true</success><correlationID>62ff22ec38ab5858bde12581a2589b39-bde12581a2589b39</correlationID></status></authorizationCode><signature>MEUCIQDrUe11CPAsnjonKRmUe40arqPiY/q/UfTGSJ1IdmkkrAIgF8G2zoHIxz04IVO2J7ZHA1M51+QMvLzUGyZsfvwK5tk=</signature></smartLicenseAuthorization>"
2022-08-19 05:42:45.308 UTC SAEVT_TAG_EXPORT exportAllowed="False" count="0" entitlementTag="regid.2019-03.com.cisco.DNA_HSEC,1.0_509c41ab-05a8-431f-95fe-ec28086e8844"
2022-08-19 05:42:45.333 UTC SAEVT_TAG_EXPORT exportAllowed="True" count="0" entitlementTag="regid.2019-03.com.cisco.DNA_HSEC,1.0_509c41ab-05a8-431f-95fe-ec28086e8844"
2022-08-19 05:42:45.334 UTC SAEVT_STATE_RESERVE_AUTHORIZED
2022-08-19 05:42:45.362 UTC SAEVT_TAG_AUTHORIZED count="1" entitlementTag="regid.2019-03.com.cisco.DNA_HSEC,1.0_509c41ab-05a8-431f-95fe-ec28086e8844"
2022-08-19 05:42:45.362 UTC SAEVT_TAG_EXPORT exportAllowed="True" count="1" entitlementTag="regid.2019-03.com.cisco.DNA_HSEC,1.0_509c41ab-05a8-431f-95fe-ec28086e8844"
使用与在线方法中相同的命令以验证许可证是否正确安装。
show license authorization
show license summary
show license tech support | begin License Usage
如果安装正确,虚拟帐户中的许可证将自动递增 In Use
计数并递减 Available to Use
计数器。
也在 Product Instances
选项卡,显示cEdge的UDI信息,单击条目以获取有关许可证特征的更多信息。
目前,控制器管理模式中没有实现以在线或离线方式返回许可证。
cEdge# license smart authorization return local online
Operation cannot be completed because license is in use
cEdge# license smart authorization return local offline
Operation cannot be completed because license is in use
要删除许可证安装,需要将路由器更改为自主模式。
cEdge# controller-mode disable
Disabling controller mode erases the nvram filesystem, remove all configuration files, and reload the box!
Ensure the BOOT variable points to a valid image
Continue? [confirm]
注意:此模式更改会删除当前的SD-WAN配置,强烈建议在安全的位置备份配置。这有助于在cEdge移回控制器管理模式时重建控制连接。
一旦路由器处于自主模式,必须完成一些基本配置才能访问Internet和域名系统(DNS)解析:
注意:自治模式使用configure terminal命令进入配置模式,而不是configuration-transaction命令。
注意:自主模式不需要提交更改,而是将所有完成的配置保存在运行配置文件中。
使用来自HSECK9或DNA导出控制许可证所在虚拟帐户的令牌。如果没有活动令牌,请生成一个新令牌。
按照与cEdge中相同的步骤生成与CSSM建立的信任。
Router# configure terminal
Router(config)# license smart transport smart
Router(config)# license smart url default
Router(config)# end
Router# license smart trust idtoken TOKEN local force
Router# license smart authorization request add hseck9 local
注意:使用前面介绍的相同命令验证是否启用了正确的传输类型和智能接收器URL,并且信任建立已成功完成。
通信完成后,将许可证返回虚拟帐户中的存储站。
Router# license smart authorization return local online
Authorization already returned with this code:
UDI: PID:C1111-8PWE,SN:FGL2149XXXX
Return code: CmJHqn-5CFUkd-effkCh-4XqCpQ-SgK5Sz-fQFfM8-6qH7MA-33hDbX-sXT
日志。
Router# show logging | include SMART
*Aug 18 22:00:22.998: %SMART_LIC-6-AUTHORIZATION_REMOVED: A licensing authorization code has been removed from PID:C1111-8PWE,SN:FGL2149XXXX.
Router#show license eventlog 0
**** Event Log ****
2022-08-18 22:08:53.275 UTC SAEVT_RESERVE_RETURN_START udi="PID:C1111-8PWE,SN:FGL2149XXXX" authorizationCode="<smartLicenseAuthorization><udi>P:C1111-8PWE,S:FGL2149XXXX</udi><authorizationCode><customerInfo><smartAccount>Cisco Systems, TAC</smartAccount><virtualAccount>sdwan-lab</virtualAccount></customerInfo><flag>A</flag><version>C</version><piid>519e0f72-85d6-4a57-8805-5999e7b712be</piid><dateStamp>2022-08-18T22:08:17</dateStamp><entitlements><entitlement><tag>regid.2019-03.com.cisco.DNA_HSEC,1.0_509c41ab-05a8-431f-95fe-ec28086e8844</tag><count>1</count><startDate></startDate><endDate></endDate><licenseType>PERPETUAL</licenseType><displayName>Router US Export Lic. for DNA</displayName><tagDescription>U.S. Export Restriction Compliance license for DNA based Routers</tagDescription><tagType>PERPETUAL</tagType><status><success>true</success></status></entitlement></entitlements><status><success>true</success><correlationID>62feb851b0b3a2264144901cb3491c22-ff31e87ded74ffde</correlationID></status></authorizationCode><signature>MEUCIQCTL9Y/HrhJXgR3+oxCWH/mpLxezThnvoAMFRIO7BHzJgIgBNDnvAD4u1eiQZ3Qrg8uGc4I6rLkbR/pn3fDv67eG5c=</signature></smartLicenseAuthorization>"
注意:将路由器移回控制器管理模式,方法是 controller-mode enable
命令。
为了生成返回代码,路由器必须处于自主模式。按照在线方法更改模式。
使用路由器中的本地授权验证CSSM中保留的许可证需要返回代码。
Router# license smart authorization return local offline
Enter this return code in Cisco Smart Software Manager portal:
UDI: PID:C1111-8PWE,SN:FGL2149XXXX
Return code: CCKUTq-Qg2Ytw-ZhSLq5-bDFw7e-VvWgf2-QwwBed-3MaRcT-fFfGcn-X6e <<<< Copy the string
导航至 Product Instances > Actions > Remove.
粘贴刚从路由器复制的返回代码,然后单击 Remove Reservation
.
The License reservation removed successfully notification shown when after.(成功删除的许可证保留通知。)再次导航至 Actions > Remove > Remove Instance.
使用本部分可确认配置能否正常运行。
在线或离线方法的每个步骤中描述了验证过程。
show license tech support
show license status
show license authorization
show license summary
show license history message
show license eventlog
license smart clear event log
license smart sync local
license smart factory reset
本部分提供的信息可用于对配置进行故障排除。
使用策略的智能许可依赖于cEdge和CSSM之间通过Internet的安全双向通信,以便交换支持注册和许可证获取的确认和握手。
有些常见场景不允许在设备之间正确交换消息。
要访问smartreceiver.com,cEdge必须能够解析域名,否则,URL不会转换为可路由IP,通信失败。此错误通常在尝试建立信任后显示。
*Aug 18 20:45:10.345: %SMART_LIC-3-COMM_FAILED: Communications failure with the Cisco Smart License Utility (CSLU) : Unable to resolve server hostname/domain name
确保有IP连接到Internet。
ping 8.8.8.8
对URL执行ping操作以验证DNS是否有效,如果外部设备使用telnet访问URL阻止了Internet控制消息协议(ICMP)。
ping cisco.com
telnet cisco.com 80
如果测试失败,请配置DNS服务器并启用DNS解析。
ip domain lookup
ip name-server 8.8.8.8
如果无法配置外部DNS服务器,请在路由器中配置本地DNS解析。
cEdge# config-transaction
cEdge(config)# ip host smartreceiver.com A.B.C.D
cEdge(config)# commit
注意:如果您需要知道哪些IP响应smartreceiver.com,请运行 nslookup
命令。
注意:不建议使用本地DNS解析,因为响应方IP可以随时间变化,而思科不会通知此变化。
智能许可(SL)事件日志中出现常见错误消息。
cEdge# show license eventlog 0
**** Event Log ****
2022-08-18 20:45:10.345 UTC SAEVT_COMM_FAIL error="Unable to resolve server hostname/domain name"
2022-08-18 20:45:57.804 UTC SAEVT_COMM_FAIL error="Unable to resolve server hostname/domain name"
cEdge# show logging | include SMART
*Aug 18 20:59:44.914: %SMART_LIC-3-COMM_FAILED: Communications failure with the Cisco Smart Software Manager (CSSM) : No detailed information given
如果SD-WAN隧道中的隐式ACL阻止传入DNS响应,也会发生类似的问题。
cEdge# show license eventlog 0
**** Event Log ****
2022-08-18 20:45:10.345 UTC SAEVT_COMM_FAIL error="Unable to resolve server hostname/domain name"
2022-08-18 20:45:57.804 UTC SAEVT_COMM_FAIL error="Unable to resolve server hostname/domain name"
cEdge# show logging | include SMART
*Aug 18 20:59:44.914: %SMART_LIC-3-COMM_FAILED: Communications failure with the Cisco Smart Software Manager (CSSM) : No detailed information given
确保在注册时允许DNS服务。
cEdge# show sdwan running-config sdwan
sdwan
interface GigabitEthernet0/0/0
tunnel-interface
encapsulation gre
encapsulation ipsec weight 1
no border
color public-internet
no last-resort-circuit
no low-bandwidth-link
no vbond-as-stun-server
vmanage-connection-preference 5
port-hop
carrier default
nat-refresh-interval 5
hello-interval 1000
no allow-service all
no allow-service bgp
allow-service dhcp
allow-service dns <<<<<<<<<<<<<<<<<< MUST be allowed
allow-service icmp
allow-service sshd
allow-service netconf
no allow-service ntp
no allow-service ospf
no allow-service stun
no allow-service https
no allow-service snmp
no allow-service bfd
exit
对于全新安装(新安装),默认传输类型为思科智能许可实用程序(CSLU)。
cEdge# show license tech support | include Smart Licensing Status
Smart Licensing Tech Support info
Smart Licensing Status
======================
Smart Licensing is ENABLED
License Conversion:
Automatic Conversion Enabled: True
Status: Not started
Export Authorization Key:
Features Authorized:
<none>
Utility:
Status: DISABLED
Smart Licensing Using Policy:
Status: ENABLED
Data Privacy:
Sending Hostname: yes
Callhome hostname privacy: DISABLED
Smart Licensing hostname privacy: DISABLED
Version privacy: DISABLED
Transport:
Type: cslu <<<<<<<<<<<<<<<<<<
Cslu address: <empty>
Proxy:
Address: <empty>
Port: <empty>
Username: <empty>
Password: <empty>
Server Identity Check: False
日志中的常见错误。
cEdge# show license eventlog 0
**** Event Log ****
2022-08-18 20:45:10.345 UTC SAEVT_COMM_FAIL error="Unable to resolve server hostname/domain name"
2022-08-18 20:45:57.804 UTC SAEVT_COMM_FAIL error="Unable to resolve server hostname/domain name"
cEdge# show logging | include SMART
*Aug 18 20:59:44.914: %SMART_LIC-3-COMM_FAILED: Communications failure with the Cisco Smart Software Manager (CSSM) : No detailed info
注意:思科SD-WAN(Cisco vManage)不支持CSLU,CSLU不能用于报告由Cisco vManage管理的路由产品实例的许可证使用情况。有关详细信息,请导航至Cisco Smart License Utility(CSLU)。
手动配置智能代理的默认URL和传输类型,并再次尝试使用令牌建立的信任。
cEdge# configure terminal
cEdge(config)# license smart transport smart
cEdge(config)# license smart url default
cEdge(config)# commit
智能许可通信基于超文本传输协议安全(HTTPS)端口443,因此,如果SD-WAN隧道阻止传入HTTPS响应,注册、授权请求和RUM报告通知将失败。
日志和事件日志中的常见错误。
*Aug 18 20:59:44.914: %SMART_LIC-3-COMM_FAILED: Communications failure with the Cisco Smart Software Manager (CSSM) : No detailed information given
确保在注册时在SD-WAN隧道中允许HTTPS服务。否则,请允许该令牌并再次尝试使用令牌建立信任。
cEdge# show sdwan runnning-config sdwan
sdwan
interface GigabitEthernet0/0/0
tunnel-interface
encapsulation gre
encapsulation ipsec weight 1
no border
color public-internet
no last-resort-circuit
no low-bandwidth-link
no vbond-as-stun-server
vmanage-connection-preference 5
port-hop
carrier default
nat-refresh-interval 5
hello-interval 1000
no allow-service all
no allow-service bgp
allow-service dhcp
allow-service dns
allow-service icmp
allow-service sshd
allow-service netconf
no allow-service ntp
no allow-service ospf
no allow-service stun
allow-service https <<<<<<<<<<<<<<<<<< MUST be allowed
no allow-service snmp
no allow-service bfd
exit
如果站点架构使用防火墙控制流量,请确保端口443到smartreceiver.cisco.com未被阻止。请与您的防火墙团队或Internet服务提供商(ISP)联系以进一步验证。
从路由器。
cEdge# telnet smartreceiver.com 443
Trying smartreceiver.com (X.X.X.X, 443)...Open
从服务VRF主机。
ericgar@cisco$ telnet smartreceiver.cisco.com 443
Trying X.X.X.X...
Connected to smartreceiver.cisco.com.
Escape character is '^]'.
在某些接口不止一个的情况下,与CSSM的通信会失败;http源接口可以更改为路由器中的任何可用接口。
cEdge# config-transaction
cEdge(config)# ip http client source-interface INTERFACE
cEdge(config)# commit
版本 | 发布日期 | 备注 |
---|---|---|
1.0 |
06-Sep-2022 |
初始版本 |