Configure Cisco Smart Licenses with NSO

Introduction

This document is intended to describe the various Network Services Orchestrator (NSO) licenses and how they can be activated with the use of the Cisco Smart License. There can be various methods of how the NSO connects to the Smart Licensing server and it depends upon the environment where the NSO is installed. This document also talks about the different integrations between the NSO and the Cisco Licensing servers.

Prerequisites 

Requirements

Cisco recommends that you have knowledge of these topics:

• How to use the NSO CLI
• Troubleshooting NSO
• Basic Linux knowledge  

Components Used

The information in this document is based on these software and hardware versions:

• NSO 4.5 and later
• NSO 4.4
• NSO 4.1/4.2/4.3

NSO Licenses

Note: The user must possess a valid NSO license.

 The licenses used by NSO are as follows:

Note: This might be included in a package Packet Identifier (PID) (bundle etc. with ESC etc.), so it is possible that these PIDs don't appear in the order.

From the Smart Software Manager, license status is seen here:

Configure

Step 1. Generate a Token

1. To create a new token, log into Cisco Smart Software Manager (CSSM) with the user id/or the CCO ID and select the appropriate virtual account.

2. Click on the Smart Licenses link to enter CSSM.

 3. In CSSM click on New Token.

4. Follow the dialog to provide a description, expiration, and export compliance applicability before you accept the terms and responsibilities. Click on Create Token to continue.

5. Click on the New Token.

6. Copy the token from the dialogue window into your clipboard.

Step 2. Token Registration Preparation

Here are the Registration methods (direct/proxy/satellite).  

If NSO or any Cisco products need smart licenses talk to Cisco Smart Software Manager (or Cisco cloud) to register themselves.

There are four main options to set-up Smart License Supported Environment:

Option 1. Direct Cloud Access

With this method, NSO server needs to be able to talk to cisco cloud directly with https. Using HTTP is supported, however, it is not recommended for security reason.

In this method, the registration process can be started without special configuration.

Option 2. Direct Cloud Access through an HTTP's Proxy

If you need to use HTTP(S) proxy server to connect to the web on the Internet, the smart agent in NSO has to be configured with proxy server information.

When option 2 is used, smart-agent needs to be instructed to send its registration request to the proxy server instead of directly sending to Cisco.

It depends on versions, the way to configure is different.

NSO 4.5 or later

From NSO 4.5, it is now possible to configure smart-license configuration through ncs.conf. If smart-license configuration exists in both ncs.conf and NSO CDB, the configuration in ncs.conf will take presedent.
This means that the commands such as "smart-license smart-agent override-url url https://10.1.2.3/"; don't take effect if a different configuration is present in ncs.conf. When doing an NSO system install, ncs.conf by default includes the following:

<smart-license>
  <smart-agent>
    <java-executable>DEFAULT</java-executable>
    <java-options>DEFAULT</java-options>
    <production-url>DEFAULT</production-url>
    <alpha-url>DEFAULT</alpha-url>
    <override-url>
      <url>DEFAULT</url>
    </override-url>
    <proxy>
      <url>DEFAULT</url>
    </proxy>
  </smart-agent>
</smart-license>

'DEFAULT' means it will use the default values as defined in $install_dir/src/ncs/yang/tailf-ncs-smart-license.yang.

To configure leafs listed in ncs.conf in NSO CDB instead, make sure to remove the respective entry from ncs.conf and perform "/etc/init.d/ncs reload"

NSO 4.4

Configure proxy URL on this path.

smart-license smart-agent proxy url <proxy url>

admin@ncs(config)# smart-license smart-agent proxy url https://10.10.10.10:8080
admin@ncs(config)#

In the default configuration, NSO connects to https://tools.cisco.com/its/service/oddce/services/DDCEService, so HTTPS proxy needs to be used.

This proxy configuration will set for both HTTPS and HTTP automatically, so if you change the target URL to HTTP for usage of Satellite that is explained at Option 3. or 4., one configuration will still be able to handle both cases.

Option 3. Mediated Access through an On-premises Collector-Connected

In many cases, the NSO network is not connected to the Internet directly. Other than Option 2., the Smart Software Manager Satellite can be introduced; so that NSO doesn't need to exchange messages directly to the cisco cloud.

The product details of Smart Software Manager Satellite can be found here.

For how to install, find installation guide in the link.

When you use this method, NSO will talk to the Satellite instead of the cisco cloud. 

To change the target, you can modify override-url:

admin@ncs(config)# smart-license smart-agent override-url url https://10.1.2.3/
admin@ncs(config)#

This URL can be found in the administrative web of Smart Software Manager Satellite.

Option 4: Mediated Access through an On-premises Collector-Disconnected

This method is exactly the same with method (3) above from NSO point of view. The difference is only how to sync with cisco cloud from Smart Software Manager Satellite.

Step 3. Token Registration

After you use the token, activate NSO with the generated token to the Cisco Server.

The token is used on the NSO CLI to register to CSSM. When the command is entered, the registration process is initiated asynchronously.

admin@ncs# smart-license register idtoken YWVlMmQ3ZjEtYT....
result Registration process in progress. Use the 'show license status' command to check the progress and result.
admin@ncs#

Verify

Use this section in order to confirm that your configuration works properly.

Before Registration: Smart Licensing is always enabled. The output indicates that NSO is not registered, and in EVAL MODE which will expire in 89 days 23 hours.

admin@ncs# show license status

Smart Licensing is ENABLED

Registration:
  Status: UNREGISTERED
  Export-Controlled Functionality: Allowed

License Authorization:
  Status: EVAL MODE
  Evaluation Period Remaining: 89 days, 23 hr, 17 min, 36 sec
  Last Communication Attempt: NONE
  Next Communication Attempt: NONE
Development mode: enabled
admin@ncs#

The registration status can be checked with show license status command. If the registration is still in process, the command shows this output and says; "REGISTRATION PENDING".

<Still registering...>

admin@ncs# show license status

Smart Licensing is ENABLED

Registration:
  Status: UNREGISTERED - REGISTRATION PENDING
  Initial Registration: First Attempt Pending
  Export-Controlled Functionality: Allowed

License Authorization:
  Status: EVAL MODE
  Evaluation Period Remaining: 89 days, 23 hr, 16 min, 36 sec
  Last Communication Attempt: SUCCEEDED on Aug 3 09:41:56 2016 UTC
  Next Communication Attempt: NONE
Development mode: enabled
admin@ncs#

After a while, the registration gets completed. When you see the status "REGISTERED", the system is registered to CSSM.

<Registered!!>

admin@ncs# show license status

Smart Licensing is ENABLED

Registration:
  Status: REGISTERED
  Smart Account: BU Production Test
  Virtual Account: TAC-Japan-Cloudorch
  Export-Controlled Functionality: Allowed
  Initial Registration: SUCCEEDED on Aug 4 05:29:52 2016 UTC
  Last Renewal Attempt: SUCCEEDED on Aug 4 05:30:03 2016 UTC
  Next Renewal Attempt: Jan 31 05:30:03 2017 UTC
  Registration Expires: Aug 4 05:24:56 2017 UTC
  Export-Controlled Functionality: Allowed

License Authorization:

License Authorization:
  Status: AUTHORIZED on Aug 4 05:30:05 2016 UTC
  Last Communication Attempt: SUCCEEDED on Aug 4 05:25:02 2016 UTC
  Next Communication Attempt: Sep 3 05:30:07 2016 UTC
  Communication Deadline: Aug 4 05:24:56 2017 UTC
Development mode: enabled
admin@ncs#

Usage (Authorized Status)

What license is used can be seen with show license summary command. In the this example, NSO-platform-production, NSO-network-element and cisco-ios-NED are used in the system. Notice that License Authorization status is "AUTHORIZED". This means that the all components that require licenses are correctly working under a legal state.

admin@ncs# show license summary
Smart Licensing is ENABLED

Registration:
  Status: REGISTERED
  Smart Account: COMPANY A
  Virtual Account: Network Department
  Last Renewal Attempt: None
  Next Renewal Attempt: Jan 31 05:33:02 2017 UTC

License Authorization:
  Status: AUTHORIZED
  Last Communication Attempt: SUCCEEDED
  Next Communication Attempt: Sep 3 05:33:06 2016 UTC

License Usage:
  License                     Entitlement Tag                                                                                Count        Status
  ----------------------------------------------------------------------------------------------------------------------------------------------
  348fbb21-7edf-42bb-baa7-198903058a54regid.2016-04.com.cisco.NSO-platform-production,4.2_348fbb21-7edf-42bb-baa7-198903058a54       1            InCompliance
  5d641fa0-757d-43b0-a926-166cb6e3cfddregid.2015-10.com.cisco.NSO-network-element,1.0_5d641fa0-757d-43b0-a926-166cb6e3cfdd           3            InCompliance
  d9eca34d-1f6a-4595-ad74-9c0c57e03c27regid.2015-10.com.cisco.cisco-ios-NED,1.0_d9eca34d-1f6a-4595-ad74-9c0c57e03c27                 1            InCompliance

Development mode: disabled
admin@ncs#

This is an output of show license usage command in a different example. In this example, cisco-iosxr-NED is also added, and the status is OutOfCompliance. This indicates that to register to CSSM is fine, however, a license for cisco-iosxr-NED is insufficient in the virtual account. Because of out of compliance status of cisco-iosxr-NED, the overall status is OUT_OF_COMPLIANCE.

admin@ncs #   show license usage  

License  Authorization  Status :  OUT_OF_COMPLIANCE  as  of  Oct  24  06 : 14 : 11  2016  UTC 

NSO - platform - production  ( regid . 2015 - 10.com . cisco . NSO - platform - production , 1.0 _d1445dab - 9d96 - 4593 - 99f2 - 6f633b8a759c ) 
 Description :  API unavailable 
 Count :  1 
 Version :  1.0 
 Status :  InCompliance 

NSO - network - element  ( regid . 2015 - 10.com . cisco . NSO - network - element , 1.0 _5d641fa0 - 757d - 43b0 - a926 - 166cb6e3cfdd ) 
 Description :  API unavailable 
 Count :  3 
 Version :  1.0 
 Status :  InCompliance 

cisco - ios - NED  ( regid . 2015 - 10.com . cisco . cisco - ios - NED , 1.0 _d9eca34d - 1f6a - 4595 - ad74 - 9c0c57e03c27 ) 
 Description :  API unavailable 
 Count :  1 
 Version :  1.0 
 Status :  InCompliance 

cisco - iosxr - NED  ( regid . 2015 - 10.com . cisco . cisco - iosxr - NED , 1.0 _9956fc34 - cbed - 4d13 - a1ea - 6a36f4e40a99 ) 
 Description :  API unavailable 
 Count :  1 
 Version :  1.0 
 Status :  OutOfCompliance 

Troubleshoot

Try to enable debug on smart license feature as the below.

When debug is enabled, debug log is generated into the file specified in /smart-license/smart-agent/stdout-capture/file.

smart license debug generates much logs, and it is recommended to disable the debug after collecting data.

Debug enable

admin@ncs# debug smart_lic all
ok
admin@ncs#

Debug disable

admin@ncs# no debug smart_lic all
ok
admin@ncs#

Smart license log config

admin@ncs# show running-config smart-license
smart-license smart-agent stdout-capture disabled
smart-license smart-agent stdout-capture file ./logs/ncs-smart-licensing.log
admin@ncs#

Enable smart license log

admin@ncs(config)# smart-license smart-agent stdout-capture enabled
admin@ncs(config)# commit
Commit complete.
admin@ncs(config)#