Here's a link regarding Cisco Device Led Conversion (DLC).
In a previous post, I've mentioned about the Cisco Smart License in a Cisco ISR 4K router. Below are the steps in preparing a Cisco ISR 4K router with no Smart License and convert its Traditional Product Activation Key (PAK) License to Smart License using DLC.
1. Perform the ROMMON firmware and IOS-XE Upgrade:
In this scenario, I got a Cisco ISR 4K router running IOS-XE 16.6 which is doesn't have the Smart License enabled yet and has a Unified Communication (UC) PAK license installed. The target code is IOS-XE 16.12 which requires a Smart License and I'll perform a DLC on the UC license.
Refer to this link for the ROMMON and IOS-XE software code compatibility matrix.
4K##show version
Cisco IOS XE Software, Version 16.06.05
Cisco IOS Software [Everest], ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 16.6.5, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2018 by Cisco Systems, Inc.
Compiled Mon 10-Dec-18 13:10 by mcpre
Cisco IOS-XE software, Copyright (c) 2005-2018 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.
ROM: IOS-XE ROMMON
4K uptime is 3 weeks, 6 days, 10 hours, 35 minutes
Uptime for this control processor is 3 weeks, 6 days, 10 hours, 36 minutes
System returned to ROM by Reload Command at 15:31:00 UTC Tue Jul 26 2022
System restarted at 15:34:06 UTC Tue Jul 26 2022
System image file is "bootflash:isr4400-universalk9.16.06.05.SPA.bin"
Last reload reason: Reload Command
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
export@cisco.com.
Suite License Information for Module:'esg'
--------------------------------------------------------------------------------
Suite Suite Current Type Suite Next reboot
--------------------------------------------------------------------------------
FoundationSuiteK9 None None None
securityk9
appxk9
AdvUCSuiteK9 None None None
uck9
cme-srst
cube
Technology Package License Information:
-----------------------------------------------------------------
Technology Technology-package Technology-package
Current Type Next reboot
------------------------------------------------------------------
appxk9 None None None
uck9 uck9 Permanent uck9
securityk9 None None None
ipbase ipbasek9 None ipbasek9
cisco ISR4431/K9 (1RU) processor with 1795979K/6147K bytes of memory.
Processor board ID FCZ26181234
4 Gigabit Ethernet interfaces
32768K bytes of non-volatile configuration memory.
4194304K bytes of physical memory.
7081983K bytes of flash memory at bootflash:.
0K bytes of WebUI ODM Files at webui:.
Configuration register is 0x2102
I skipped the ROMMON firmware upgrade since the 4K router is already on the latest 17.x firmware and it wouldn't allow you perform a ROMMON 17.x > 16.x code "downgrade."
For reference, the ROMMON upgrade command is issued in privileged EXEC mode.
4K#upgrade rom-monitor filename bootflash:isr4400_rommon_1612_2r_SPA.pkg all
4K#show platform
Chassis type: ISR4431/K9
Slot Type State Insert time (ago)
--------- ------------------- --------------------- -----------------
0 ISR4431/K9 ok 3w6d
0/0 ISR4431-X-4x1GE ok 3w6d
0/4 PVDM4-128 ok 3w6d
R0 ISR4431/K9 ok, active 3w6d
F0 ISR4431/K9 ok, active 3w6d
P0 PWR-4430-AC ok 3w6d
P1 PWR-4430-AC ok 3w6d
P2 ACS-4430-FANASSY ok 3w6d
Slot CPLD Version Firmware Version
--------- ------------------- ---------------------------------------
0 19042950 17.6.1
R0 19042950 17.6.1
F0 19042950 17.6.1
You change the boot variable with the boot system flash bootflash:<IOS-XE.bin> command and issue a reload afterwards.
4k#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
4K(config)#no boot system // A QUICK WAY TO REMOVE MUTIPLE BOOT VARIABLES
4K(config)#boot system flash bootflash:isr4400-universalk9.16.12.07.SPA.bin
4K(config)#boot system flash bootflash:isr4400-universalk9.16.06.05.SPA.bin
4K(config)#end
4K#write memory
Building configuration...
[OK]
4K#show run | include boot
boot-start-marker
boot system flash bootflash:isr4400-universalk9.16.12.07.SPA.bin
boot system flash bootflash:isr4400-universalk9.16.06.05.SPA.bin
boot-end-marker
no ip bootp server
license boot level uck9
diagnostic bootup level minimal
4K#reload
Proceed with reload? [confirm] <HIT ENTER>
<SNIP>
The Smart License status became Unregistered and UC license changed to an Eval mode which is valid for 90 days.
4K#show version
Cisco IOS XE Software, Version 16.12.07
Cisco IOS Software [Gibraltar], ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 16.12.7, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2022 by Cisco Systems, Inc.
Compiled Wed 02-Feb-22 11:11 by mcpre
Cisco IOS-XE software, Copyright (c) 2005-2022 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.
ROM: (c)
4K uptime is 3 minutes
Uptime for this control processor is 4 minutes
System returned to ROM by Reload Command at 02:16:02 UTC Tue Aug 23 2022
System image file is "bootflash:isr4400-universalk9.16.12.07.SPA.bin"
Last reload reason: Reload Command
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
export@cisco.com.
Suite License Information for Module:'esg'
--------------------------------------------------------------------------------
Suite Suite Current Type Suite Next reboot
--------------------------------------------------------------------------------
FoundationSuiteK9 None Smart License None
securityk9
appxk9
AdvUCSuiteK9 None Smart License None
uck9
cme-srst
cube
Technology Package License Information:
-----------------------------------------------------------------
Technology Technology-package Technology-package
Current Type Next reboot
------------------------------------------------------------------
appxk9 None Smart License None
uck9 uck9 Smart License uck9
securityk9 None Smart License None
ipbase ipbasek9 Smart License ipbasek9
The current throughput level is 500000 kbps
Smart Licensing Status: UNREGISTERED/EVAL MODE
cisco ISR4431/K9 (1RU) processor with 1694668K/6147K bytes of memory.
Processor board ID FCZ26181234
4 Gigabit Ethernet interfaces
32768K bytes of non-volatile configuration memory.
4194304K bytes of physical memory.
7081983K bytes of flash memory at bootflash:.
0K bytes of WebUI ODM Files at webui:.
Configuration register is 0x2102
4K#show license all
Smart Licensing Status
======================
Smart Licensing is ENABLED
Registration:
Status: UNREGISTERED
Export-Controlled Functionality: NOT ALLOWED
License Authorization:
Status: EVAL MODE
Evaluation Period Remaining: 89 days, 23 hours, 55 minutes, 45 seconds
License Conversion:
Automatic Conversion Enabled: False
Status: Not started
Export Authorization Key:
Features Authorized:
<none>
Utility:
Status: DISABLED
Data Privacy:
Sending Hostname: yes
Callhome hostname privacy: DISABLED
Smart Licensing hostname privacy: DISABLED
Version privacy: DISABLED
Transport:
Type: Callhome
License Usage
==============
(ISR_4400_UnifiedCommunication):
Description:
Count: 1
Version: 1.0
Status: EVAL MODE
Export status: NOT RESTRICTED
Product Information
===================
UDI: PID:ISR4431/K9,SN:FOC26161234
Agent Version
=============
Smart Agent for Licensing: 4.8.18_rel/86
Reservation Info
================
License reservation: DISABLED
2. Configure Call Home:
I'm using the 4K dedicated GigabitEthernet0 Out-of-Band (OOB) interface which has the default Mgmt-intf VRF. I'm also using an On-Prem Cisco Smart Software Manager (CSSM) Smart License server. The config also works with the Cisco Smart License public portal over the Internet. Below are some additional Call-Home config.
ip name-server vrf Mgmt-intf <PRIMARY DNS IP> <SECONDARY DNS IP>
ip domain lookup
ip domain lookup vrf Mgmt-intf source-interface GigabitEthernet0
ip http client source-interface GigabitEthernet0
license smart url https://<CSSM FQDN>/Transportgateway/services/DeviceRequestHandler
license smart transport smart
call-home
vrf Mgmt-intf
source-interface GigabitEthernet0
profile "CiscoTAC-1"
destination address http https://<CSSM FQDN>/Transportgateway/service/DeviceRequestHandler
3. Generate a Product Instance Registration token in CSSM and apply in ISR 4K
Generate a Product Instance Registration token in CSSM, go to Inventory > General > New Token.
Issue the license smart register idtoken <CSSM TOKEN> force command in privileged EXEC.
4K#license smart register idtoken <CSSM TOKEN> force
Registration process is in progress. Use the 'show license status' command to check the progress and result
Aug 23 03:40:17.560 UTC: %CRYPTO_ENGINE-5-KEY_DELETED: A key named SLA-KeyPair2 has been removed from key storage
Aug 23 03:40:18.476 UTC: %CRYPTO_ENGINE-5-KEY_ADDITION: A key named SLA-KeyPair2 has been generated or imported by crypto-engine
Aug 23 03:40:18.529 UTC: %PKI-6-CONFIGAUTOSAVE: Running configuration saved to NVRAM
Aug 23 03:40:23.960 UTC: %SYS-2-PRIVCFG_ENCRYPT: Successfully encrypted private config file
Aug 23 03:40:24.776 UTC: %PKI-3-CERTIFICATE_INVALID: Certificate chain validation has failed.
Aug 23 03:40:34.000 UTC: %PKI-3-CERTIFICATE_INVALID: Certificate chain validation has failed.
Aug 23 03:40:34.002 UTC: %SMART_LIC-3-AGENT_REG_FAILED: Smart Agent for Licensing Registration with the Cisco Smart Software Manager (CSSM) failed: No detailed information given
Aug 23 03:40:34.002 UTC: %SMART_LIC-3-COMM_FAILED: Communications failure with the Cisco Smart Software Manager (CSSM) : No detailed information given
Aug 23 03:40:40.003 UTC: %PKI-3-HOSTNAME_RESOLVE_ERR: Failed to resolve HOSTNAME/IPADDRESS : www.cisco.com
Aug 23 03:40:40.003 UTC: %PKI-3-CRL_FETCH_FAIL: CRL fetch for trustpoint SLA-TrustPoint failed
Reason : Failed to fetch IP address from :www.cisco.com
Aug 23 03:41:05.800 UTC: %PKI-3-CERTIFICATE_INVALID: Certificate chain validation has failed.
Aug 23 03:41:11.803 UTC: %PKI-3-HOSTNAME_RESOLVE_ERR: Failed to resolve HOSTNAME/IPADDRESS : www.cisco.com
Aug 23 03:41:11.803 UTC: %PKI-3-CRL_FETCH_FAIL: CRL fetch for trustpoint SLA-TrustPoint failed
Reason : Failed to fetch IP address from :www.cisco.com
If you get a CRL log error, apply this workaround command and apply the registration token again:
crypto pki trustpoint SLA-TrustPoint
revocation-check none
4K#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
4K(config)#crypto pki trustpoint SLA-TrustPoint
4K(ca-trustpoint)#revocation-check ?
crl Revocation check by CRL
none Ignore revocation check
ocsp Revocation check by OCSP
4K(ca-trustpoint)#revocation-check none
4K#license smart register idtoken <CSSM TOKEN> force
Registration process is in progress. Use the 'show license status' command to check the progress and result
Aug 23 03:43:11.806 UTC: %CRYPTO_ENGINE-5-KEY_DELETED: A key named SLA-KeyPair has been removed from key storage
Aug 23 03:43:12.103 UTC: %CRYPTO_ENGINE-5-KEY_ADDITION: A key named SLA-KeyPair has been generated or imported by crypto-engine
Aug 23 03:43:12.154 UTC: %PKI-4-NOCONFIGAUTOSAVE: Configuration was modified. Issue "write memory" to save new IOS PKI configuration
Aug 23 03:43:12.404 UTC: %SMART_LIC-5-COMM_RESTORED: Communications with the Cisco Smart Software Manager (CSSM) restored
Aug 23 03:43:12.517 UTC: %SMART_LIC-6-EXPORT_CONTROLLED: Usage of export controlled features is allowed
Aug 23 03:43:12.517 UTC: %SMART_LIC-6-AGENT_REG_SUCCESS: Smart Agent for Licensing Registration successful. udi PID:ISR4431/K9,SN:FOC26161234
Aug 23 03:43:14.932 UTC: %SMART_LIC-3-OUT_OF_COMPLIANCE: One or more entitlements are out of compliance
Aug 23 03:43:14.932 UTC: %SMART_LIC-5-END_POINT_RESET: End Point list reset
Aug 23 03:43:14.933 UTC: %SMART_LIC-6-AUTH_RENEW_SUCCESS: Authorization renewal successful. State=OOC for udi PID:ISR4431/K9,SN:FOC26161234
Aug 23 03:43:45.421 UTC: %SMART_LIC-6-AUTH_RENEW_SUCCESS: Authorization renewal successful. State=OOC for udi PID:ISR4431/K9,SN:FOC26161234
Aug 23 03:44:15.817 UTC: %SMART_LIC-6-AUTH_RENEW_SUCCESS: Authorization renewal successful. State=OOC for udi PID:ISR4431/K9,SN:FOC26161234
Issue a show license summary to check the Smart License status. Notice the UC Smart License status is Out of Compliance. This is because there's no UC Smart License balance available in the On-Prem CSSM.
4K#show license summary
Smart Licensing is ENABLED
Registration:
Status: REGISTERED
Smart Account: MY-ACCOUNT
Virtual Account: Default
Export-Controlled Functionality: ALLOWED
Last Renewal Attempt: None
Next Renewal Attempt: Feb 19 03:43:11 2023 UTC
License Authorization:
Status: OUT OF COMPLIANCE
Last Communication Attempt: SUCCEEDED
Next Communication Attempt: Aug 23 19:37:21 2022 UTC
License Usage:
License Entitlement tag Count Status
-----------------------------------------------------------------------------
ISR_4400_UnifiedComm... (ISR_4400_UnifiedCommun...) 1 OUT OF COMPLIANCE
3. Initiate Device Led Conversion (DLC)
The final step is to issue the license smart conversion start privileged EXEC command to start the DLC conversion process.
4K#license smart conversion start?
clear Clear
conversion Start or stop a license conversion
deregister deregister this device
export Get or return an export authorization key
factory Execute Smart Licensing Factory commands
register register token id
renew Smart License renew
send license smart send
4K#license smart conversion ?
start Start a manual license conversion
stop Stop a license conversion that pending retry because of a communications failure
4K#license smart conversion start
Aug 23 03:52:40.593 UTC: %SMART_LIC-6-CONVERT_START: Smart License Conversion has started
You can check the DLC status with the show platform software license dlc command. This would take around an hour to complete per the Cisco Smart License doc.
4K#show platform software license dlc
Index 1 Feature: uck9
Permanent License: 1
EVAL RTU License: 0
RTU License: 0
Paper License: 0
DLC Process Status: Not Complete
If you go to CSSM Inventory > Product Instances, you'll see an Alert that DLC has been requested and a Synchronization is required.
If the DLC status is still not yet completed after waiting for an hour, you can perform a "force update" in the On-Prem CSSM. Go to CSSM Admin Workspace > click Synchronization.
Select the Virtual Account > click Sync Selected.
Select again the Virtual Account > click Actions > Network Synchronization > Standard Synchronization Now.
Notice under Alerts status changed to Synchronization Successful.
You can verify if the DLC and License migration is complete in On-Prem CSSM > go to License Tab > check the Available to Use and In Use. Notice there's a ISR_4400_UnifiedCommunication Smart License that would appeared with a Available to Use and In Use balance count of 1.
4K#show platform software license dlc
Index 1 Feature: uck9
Permanent License: 1
EVAL RTU License: 0
RTU License: 0
Paper License: 0
DLC Process Status: Completed
DLC Conversion Status: SUCCESS
No comments:
Post a Comment