Configure Smart Licenses with NSO

Introduction

This document describes the various Network Services Orchestrator (NSO) licenses and how they can be activated using the Cisco Smart License®.

Prerequisites 

Requirements

Cisco recommends that you have knowledge of these topics:

• How to use the NSO CLI
• Troubleshooting NSO
• Basic Linux knowledge  

Components Used

The information in this document is based on these software and hardware versions:

• NSO 6.x
• NSO 5.x

• NSO 4.5 and later
• NSO 4.4
• NSO 4.1/4.2/4.3

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

NSO Licenses

Note: The user must possess a valid NSO license.

 The licenses used by NSO are as follows:

Note: This could be included in a package Packet Identifier (PID) (bundle which includes ESC, and more), so it is possible that these PIDs do not appear in the order.

Smart Account and Virtual Account

Each product, including NSO, asks the Cisco server to acquire a license to activate itself. Essentially it checks if your have purchased the enough number of licenses for the product and they are available to use.

One smart account is assigned to an organization. Take company A, for example:

• Company A can have Department X, Y and Z, and they want to manage their licenses separately.
• A virtual account can be assigned to each department.

Tokens can be generated for each virtual account. We use the token to access to the virtual account from the product.

From the Smart Software Manager, license status in virtual accounts are seen like this:

Configure

There can be various methods of how the NSO connects to the Smart Licensing server and it depends upon the environment where the NSO is installed. This document also outlines the different integrations between the NSO and the Cisco Licensing servers.

Step 1. Generate a Token

1. To create a new token, log into Cisco Smart Software Manager (CSSM) with the user id/or the CCO ID and select the appropriate virtual account. Click on Manage licenses to proceed. Find the link in Cisco Software Central.

2. Click on the Inventory tab and select a virtual account you want to work with.

 3. In CSSM, click New Token.

Fill out the required information. Please note that expiring date indicates how long the token is valid, so users need to use the created token within the days. Short and Long needs to be balanced between convenience and security risk. Also, it is NOT about how long the licenses are going to be valid.

5. The newly created token is in the table.

6. Click the token link to show a popup window. Copy the token from the dialogue window into your clipboard.

Step 2. Token Registration Preparation

Here are the Registration methods (direct/proxy/satellite).  

If NSO or any Cisco products need smart licenses, talk to Cisco Smart Software Manager (or Cisco Cloud) to register themselves.

There are four main options to set-up Smart License Supported Environment:

Option 1. Direct Cloud Access

With this method, NSO server needs to be able to talk to Cisco Cloud directly with https. Using HTTP is supported, however, it is not recommended for security reason.

In this method, the registration process can be started without special configuration.

Option 2. Direct Cloud Access through an HTTPS Proxy

If you need to use the HTTP(S) proxy server to connect to the web on the Internet, the smart agent in NSO has to be configured with proxy server information.

When option 2 is used, the smart-agent needs to be instructed to send its registration request to the proxy server instead of directly sending to Cisco.

Configuration depends on the version. 

NSO 4.5 or Later

From NSO 4.5, it is now possible to configure smart-license configuration through ncs.conf. If smart-license configuration exists in both ncs.conf and NSO CDB, the configuration in ncs.conf takes precedence.

This means that the commands such as smart-license smart-agent override-url url https://10.1.2.3/ do not take effect if a different configuration is present in ncs.conf. When doing an NSO system install, ncs.conf by default includes the following:

<smart-license>
  <smart-agent>
    <java-executable>DEFAULT</java-executable>
    <java-options>DEFAULT</java-options>
    <production-url>DEFAULT</production-url>
    <alpha-url>DEFAULT</alpha-url>
    <override-url>
      <url>DEFAULT</url>
    </override-url>
    <proxy>
      <url>DEFAULT</url>
    </proxy>
  </smart-agent>
</smart-license>

DEFAULT means it uses the default values as defined in $install_dir/src/ncs/yang/tailf-ncs-smart-license.yang.

To configure leafs listed in ncs.conf in NSO CDB instead, make sure to remove the respective entry from ncs.conf and perform /etc/init.d/ncs reload.

NSO 4.4

Configure proxy URL on this path.

smart-license smart-agent proxy url <proxy url>

admin@ncs(config)# smart-license smart-agent proxy url https://10.10.10.10:8080
admin@ncs(config)#

In the default configuration, NSO connects to https://tools.cisco.com/its/service/oddce/services/DDCEService, so the HTTPS proxy needs to be used.

This proxy configuration sets for both HTTPS and HTTP automatically, so if you change the target URL to HTTP for usage of Satellite that is explained at Option 3. or 4., one configuration is still able to handle both cases.

Option 3. Mediated Access through an On-premises Collector-Connected

In many cases, the NSO network is not connected to the Internet directly. Other than Option 2., the Smart Software Manager Satellite can be introduced; so that NSO does not need to exchange messages directly to the Cisco Cloud.

The product details of Smart Software Manager Satellite can be found here.

For how to install, find the installation guide in the link.

When you use this method, NSOl talks to the Satellite instead of the Cisco Cloud. 

To change the target, you can modify override-url:

admin@ncs(config)# smart-license smart-agent override-url url https://10.1.2.3/
admin@ncs(config)#

This URL can be found in the administrative web of Smart Software Manager Satellite.

Option 4: Mediated Access through an On-premises Collector-Disconnected

This method is exactly the same with method (3) from NSO point of view. The difference is only how to sync with Cisco Cloud from Smart Software Manager Satellite.

Step 3. Token Registration

After you use the token, activate NSO with the generated token to the Cisco Server. The token is used on the NSO CLI to register to CSSM. When the command is entered, the registration process is initiated asynchronously.

admin@ncs# smart-license register idtoken YWVlMmQ3ZjEtYT....
result Registration process in progress. Use the 'show license status' command to check the progress and result.
admin@ncs#

Verify

Use this section in order to confirm that your configuration works properly.

Before Registration

Smart Licensing is always enabled. The output indicates that NSO is not registered, and in EVAL MODE which expires in 89 days 23 hours.

admin@ncs# show license status

Smart Licensing is ENABLED

Registration:
  Status: UNREGISTERED
  Export-Controlled Functionality: Allowed

License Authorization:
  Status: EVAL MODE
  Evaluation Period Remaining: 89 days, 23 hr, 17 min, 36 sec
  Last Communication Attempt: NONE
  Next Communication Attempt: NONE
Development mode: enabled
admin@ncs#

The registration status can be checked with show license status command. If the registration is still in process, the command shows this output and says; "REGISTRATION PENDING".

<Still registering...>

admin@ncs# show license status

Smart Licensing is ENABLED

Registration:
  Status: UNREGISTERED - REGISTRATION PENDING
  Initial Registration: First Attempt Pending
  Export-Controlled Functionality: Allowed

License Authorization:
  Status: EVAL MODE
  Evaluation Period Remaining: 89 days, 23 hr, 16 min, 36 sec
  Last Communication Attempt: SUCCEEDED on Aug 3 09:41:56 2016 UTC
  Next Communication Attempt: NONE
Development mode: enabled
admin@ncs#

After a while, the registration gets completed. When you see the status REGISTERED, the system is registered to CSSM.

<Registered!!>

admin@ncs# show license status

Smart Licensing is ENABLED

Registration:
  Status: REGISTERED
  Smart Account: BU Production Test
  Virtual Account: TAC-Japan-Cloudorch
  Export-Controlled Functionality: Allowed
  Initial Registration: SUCCEEDED on Aug 4 05:29:52 2016 UTC
  Last Renewal Attempt: SUCCEEDED on Aug 4 05:30:03 2016 UTC
  Next Renewal Attempt: Jan 31 05:30:03 2017 UTC
  Registration Expires: Aug 4 05:24:56 2017 UTC
  Export-Controlled Functionality: Allowed

License Authorization:

License Authorization:
  Status: AUTHORIZED on Aug 4 05:30:05 2016 UTC
  Last Communication Attempt: SUCCEEDED on Aug 4 05:25:02 2016 UTC
  Next Communication Attempt: Sep 3 05:30:07 2016 UTC
  Communication Deadline: Aug 4 05:24:56 2017 UTC
Development mode: enabled
admin@ncs#

Usage (Authorized Status)

What license is used can be seen with show license summary command. In the this example, NSO-platform-production, NSO-network-element and cisco-ios-NED are used in the system. Notice that License Authorization status is "AUTHORIZED". This means that the all components that require licenses are correctly working under a legal state.

admin@ncs# show license summary
Smart Licensing is ENABLED

Registration:
  Status: REGISTERED
  Smart Account: COMPANY A
  Virtual Account: Network Department
  Last Renewal Attempt: None
  Next Renewal Attempt: Jan 31 05:33:02 2017 UTC

License Authorization:
  Status: AUTHORIZED
  Last Communication Attempt: SUCCEEDED
  Next Communication Attempt: Sep 3 05:33:06 2016 UTC

License Usage:
  License                     Entitlement Tag                                                                                Count        Status
  ----------------------------------------------------------------------------------------------------------------------------------------------
  348fbb21-7edf-42bb-baa7-198903058a54regid.2016-04.com.cisco.NSO-platform-production,4.2_348fbb21-7edf-42bb-baa7-198903058a54       1            InCompliance
  5d641fa0-757d-43b0-a926-166cb6e3cfddregid.2015-10.com.cisco.NSO-network-element,1.0_5d641fa0-757d-43b0-a926-166cb6e3cfdd           3            InCompliance
  d9eca34d-1f6a-4595-ad74-9c0c57e03c27regid.2015-10.com.cisco.cisco-ios-NED,1.0_d9eca34d-1f6a-4595-ad74-9c0c57e03c27                 1            InCompliance

Development mode: disabled
admin@ncs#

This is an output of show license usage command in a different example. In this example, cisco-iosxr-NED is also added, and the status is OutOfCompliance. This indicates that to register to CSSM is fine, however, a license for cisco-iosxr-NED is insufficient in the virtual account. Because of out of compliance status of cisco-iosxr-NED, the overall status is OUT_OF_COMPLIANCE.

admin@ncs # show license usage  

License Authorization Status : OUT_OF_COMPLIANCE  as of Oc  24 06:14:11 2016 UTC 

NSO-platform-production (regid.2016-04.com.cisco.NSO-platform-production, 1.0_d1445dab-9d96-4593-99f2-6f633b8a759c) 
 Description : API unavailable 
 Count : 1 
 Version : 1.0 
 Status : InCompliance 

NSO-network-element (regid.2015-10.com.cisco.NSO-network-element, 1.0_5d641fa0-757d-43b0-a926-166cb6e3cfdd) 
 Description : API unavailable 
 Count : 3 
 Version : 1.0 
 Status : InCompliance 

cisco-ios-NED (regid.2015-10.com.cisco.cisco-ios-NED, 1.0_d9eca34d-1f6a-4595-ad74-9c0c57e03c27) 
 Description : API unavailable 
 Count : 1 
 Version : 1.0 
 Status : InCompliance 

cisco-iosxr-NED (regid.2015-10.com.cisco.cisco.cisco-iosxr-NED, 1.0_9956fc34-cbed-4d13-a1ea-6a36f4e40a99) 
 Description : API unavailable 
 Count : 1 
 Version : 1.0 
 Status : OutOfCompliance 

Troubleshoot

Try to enable debug on smart license feature. When debug is enabled, debug log is generated into the file specified in /smart-license/smart-agent/stdout-capture/file. smart license debug generates much logs, and it is recommended to disable the debug after collecting data.

Debug enable

admin@ncs# debug smart_lic all
ok
admin@ncs#

Debug disable

admin@ncs# no debug smart_lic all
ok
admin@ncs#

Smart license log config

admin@ncs# show running-config smart-license
smart-license smart-agent stdout-capture disabled
smart-license smart-agent stdout-capture file ./logs/ncs-smart-licensing.log
admin@ncs#

Enable smart license log

admin@ncs(config)# smart-license smart-agent stdout-capture enabled
admin@ncs(config)# commit
Commit complete.
admin@ncs(config)#

Renew CSSM On-Prem SSL Certificate

For customers that have on-prem CSSM, NSO can fail to connect to the server if the SSL certificate has expired.

Here are the steps in order to fix the problem by generating a onprem.crt file:

1. Collect the new certificate from the CSSM server using openssl (port normally used is 443):

openssl s_client -showcerts -connect <<ON_PREM_CSSM_IP_ADDRESS>>:443 | openssl x509 -out onprem.crt

2. Find the directory to import the certificate. The default directory is /etc/pki/ca-trust/extracted/java/cacerts. In order to find it, here is a command to search for the cacerts directories in the system, and an example of the output:

[root@localhost /]# find / -name cacerts 2>/dev/null | xargs -I {} ls -l {}
-r--r--r--. 1 root root 156478 Jun 26 08:02 /etc/pki/ca-trust/extracted/java/cacerts
lrwxrwxrwx. 1 root root 40 Aug 25  2022 /etc/pki/java/cacerts -> /etc/pki/ca-trust/extracted/java/cacerts
lrwxrwxrwx. 1 root root 21 Jun 15 04:52 /etc/java/java-17-openjdk/java-17-openjdk-17.0.15.0.6-3.el9.x86_64/lib/security/cacerts -> /etc/pki/java/cacerts
[root@localhost /]# 

3. Load the certificate. The default password for the keystore is changeit:

sudo keytool -import -alias ssm_onprem -file onprem.crt -keystore /etc/pki/ca-trust/extracted/java/cacerts

3.1 (Optional) In order to confirm that the certificate was properly loaded, execute this command:

root@Ubuntu-24-9:/home/nso# keytool -list -keystore /etc/ssl/certs/java/cacerts -storepass changeit -alias ssm_onprem
Warning: use -cacerts option to access cacerts keystore
ssm_onprem, Aug 4, 2025, trustedCertEntry, 
Certificate fingerprint (SHA-256): F7:00:C9:74:34:57:5E:BE:70:A7:0E:D2:9B:A8:2D:44:F1:CE:14:55:C3:D9:06:3F:83:68:95:A1:C6:B5:7F:26
root@Ubuntu-24-9:/home/nso# 

4. Restart the smart agent (in config mode):

admin@ncs(config)# smart-license smart-agent restart 
result Started

5. Re-register the certificate:

admin@ncs# license smart deregister 
ok
admin@ncs# license smart register idtoken TOKEN
Registration process in progress. Use the 'show license status' command to check the progress and result.
admin@ncs# 

6. In order to confirm that the registration was successful with the show license summary command whose output is shown in this article.