Contents

Introduction

Prerequisites

Requirements

Components Used

NSO Licenses

Smart Account and Virtual Account

Configure

Step 1. Generate a Token

Step 2. Token Registration Preparation

Option 1. Direct Cloud Access

Option 2. Direct Cloud Access through an HTTPS Proxy

NSO 4.5 or Later

NSO 4.4

Option 3. Mediated Access through an On-premises Collector-Connected

Option 4: Mediated Access through an On-premises Collector-Disconnected

Step 3. Token Registration

Verify

Before Registration

Usage (Authorized Status)

Troubleshoot

Renew CSSM On-Prem SSL Certificate

Introduction

This document describes the various Network Services Orchestrator (NSO) licenses and how they can be activated using the Cisco Smart License®.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

- How to use the NSO CLI

- Troubleshooting NSO

- Basic Linux knowledge

Components Used

The information in this document is based on these software and hardware versions:

- NSO 6.x

- NSO 5.x

- NSO 4.5 and later

- NSO 4.4

- NSO 4.1/4.2/4.3

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

NSO Licenses

Note: The user must possess a valid NSO license.

The licenses used by NSO are as follows:

PID

Display on SSM

type

Description

R-NSO-K 9

Top level

Required for each instance of NSO

NSO-P-PAK

NSO-platform-production

server

Required for Active node

NSO-HA-LIC-P

NSO-platform-production-standby

server

Required for Standby node

NSO-DEV-P-PAK

NSO-platform-development-test

server

Required for development environment

NSO-PNF-()

NSO-network-element

Network element

Southbound If the connected device is a physical device

NSO-VNF-()

NSO-network-element

Network element

Southbound The connected device is a virtual device

NED-()

Different for each NED

Example:

Cisco-ios-NED

Cisco-iosxr-NED

NED

For NED. It is necessary for each type of various devices.

Example:

NED-IOS-P: For IOS NED

NED-IOSX-P: For IOS-XR NED

Note: This could be included in a package Packet Identifier (PID) (bundle which includes ESC, and more), so it is possible that these PIDs do not appear in the order.

Smart Account and Virtual Account

Each product, including NSO, asks the Cisco server to acquire a license to activate itself. Essentially it checks if your have purchased the enough number of licenses for the product and they are available to use.

One smart account is assigned to an organization. Take company A, for example:

- Company A can have Department X, Y and Z, and they want to manage their licenses separately.

- A virtual account can be assigned to each department.

Tokens can be generated for each virtual account. We use the token to access to the virtual account from the product.

From the Smart Software Manager, license status in virtual accounts are seen like this:

Configure

There can be various methods of how the NSO connects to the Smart Licensing server and it depends upon the environment where the NSO is installed. This document also outlines the different integrations between the NSO and the Cisco Licensing servers.

Step 1. Generate a Token

1. To create a new token, log into Cisco Smart Software Manager (CSSM) with the user id/or the CCO ID and select the appropriate virtual account. Click on Manage licenses to proceed. Find the link in Cisco Software Central.

2. Click on the Inventory tab and select a virtual account you want to work with.

3. In CSSM, click New Token.

Fill out the required information. Please note that expiring date indicates how long the token is valid, so users need to use the created token within the days. Short and Long needs to be balanced between convenience and security risk. Also, it is NOT about how long the licenses are going to be valid.

5. The newly created token is in the table.

6. Click the token link to show a popup window. Copy the token from the dialogue window into your clipboard.

Step 2. Token Registration Preparation

Here are the Registration methods (direct/proxy/satellite).

If NSO or any Cisco products need smart licenses, talk to Cisco Smart Software Manager (or Cisco Cloud) to register themselves.

There are four main options to set-up Smart License Supported Environment:

Option 1. Direct Cloud Access

With this method, NSO server needs to be able to talk to Cisco Cloud directly with https. Using HTTP is supported, however, it is not recommended for security reason.

In this method, the registration process can be started without special configuration.

Option 2. Direct Cloud Access through an HTTPS Proxy

If you need to use the HTTP(S) proxy server to connect to the web on the Internet, the smart agent in NSO has to be configured with proxy server information.

When option 2 is used, the smart-agent needs to be instructed to send its registration request to the proxy server instead of directly sending to Cisco.

Configuration depends on the version.

NSO 4.5 or Later

From NSO 4.5, it is now possible to configure smart-license configuration through ncs.conf. If smart-license configuration exists in both ncs.conf and NSO CDB, the configuration in ncs.conf takes precedence.

This means that the commands such as smart-license smart-agent override-url url https://10.1.2.3/ do not take effect if a different configuration is present in ncs.conf. When doing an NSO system install, ncs.conf by default includes the following:

<smart-license>

<smart-agent>

<java-executable>DEFAULT</java-executable>

<java-options>DEFAULT</java-options>

<production-url>DEFAULT</production-url>

<alpha-url>DEFAULT</alpha-url>

<override-url>

<url>DEFAULT</url>

</override-url>

<proxy>

<url>DEFAULT</url>

</proxy>

</smart-agent>

</smart-license>

DEFAULT means it uses the default values as defined in $install_dir/src/ncs/yang/tailf-ncs-smart-license.yang.

To configure leafs listed in ncs.conf in NSO CDB instead, make sure to remove the respective entry from ncs.conf and perform /etc/init.d/ncs reload.

NSO 4.4

Configure proxy URL on this path.

smart-license smart-agent proxy url <proxy url>

admin@ncs(config)# smart-license smart-agent proxy url https://10.10.10.10:8080

admin@ncs(config)#

In the default configuration, NSO connects to https://tools.cisco.com/its/service/oddce/services/DDCEService, so the HTTPS proxy needs to be used.

This proxy configuration sets for both HTTPS and HTTP automatically, so if you change the target URL to HTTP for usage of Satellite that is explained at Option 3. or 4., one configuration is still able to handle both cases.

Option 3. Mediated Access through an On-premises Collector-Connected

In many cases, the NSO network is not connected to the Internet directly. Other than Option 2., the Smart Software Manager Satellite can be introduced; so that NSO does not need to exchange messages directly to the Cisco Cloud.

The product details of Smart Software Manager Satellite can be found here.

For how to install, find the installation guide in the link.

When you use this method, NSOl talks to the Satellite instead of the Cisco Cloud.

To change the target, you can modify override-url:

admin@ncs(config)# smart-license smart-agent override-url url https://10.1.2.3/

admin@ncs(config)#

This URL can be found in the administrative web of Smart Software Manager Satellite.

Option 4: Mediated Access through an On-premises Collector-Disconnected

This method is exactly the same with method (3) from NSO point of view. The difference is only how to sync with Cisco Cloud from Smart Software Manager Satellite.

Step 3. Token Registration

After you use the token, activate NSO with the generated token to the Cisco Server. The token is used on the NSO CLI to register to CSSM. When the command is entered, the registration process is initiated asynchronously.

admin@ncs# smart-license register idtoken YWVlMmQ3ZjEtYT....

result Registration process in progress. Use the 'show license status' command to check the progress and result.

admin@ncs#

Verify

Use this section in order to confirm that your configuration works properly.

Before Registration

Smart Licensing is always enabled. The output indicates that NSO is not registered, and in EVAL MODE which expires in 89 days 23 hours.

admin@ncs# show license status

Smart Licensing is ENABLED

Registration:

Status: UNREGISTERED

Export-Controlled Functionality: Allowed

License Authorization:

Status: EVAL MODE

Evaluation Period Remaining: 89 days, 23 hr, 17 min, 36 sec

Last Communication Attempt: NONE

Next Communication Attempt: NONE

Development mode: enabled

admin@ncs#

The registration status can be checked with show license status command. If the registration is still in process, the command shows this output and says; "REGISTRATION PENDING".

<Still registering...>

admin@ncs# show license status

Smart Licensing is ENABLED

Registration:

Status: UNREGISTERED - REGISTRATION PENDING

Initial Registration: First Attempt Pending

Export-Controlled Functionality: Allowed

License Authorization:

Status: EVAL MODE

Evaluation Period Remaining: 89 days, 23 hr, 16 min, 36 sec

Last Communication Attempt: SUCCEEDED on Aug 3 09:41:56 2016 UTC

Next Communication Attempt: NONE

Development mode: enabled

admin@ncs#

After a while, the registration gets completed. When you see the status REGISTERED, the system is registered to CSSM.

<Registered!!>

admin@ncs# show license status

Smart Licensing is ENABLED

Registration:

Status: REGISTERED

Smart Account: BU Production Test

Virtual Account: TAC-Japan-Cloudorch

Export-Controlled Functionality: Allowed

Initial Registration: SUCCEEDED on Aug 4 05:29:52 2016 UTC

Last Renewal Attempt: SUCCEEDED on Aug 4 05:30:03 2016 UTC

Next Renewal Attempt: Jan 31 05:30:03 2017 UTC

Registration Expires: Aug 4 05:24:56 2017 UTC

Export-Controlled Functionality: Allowed

License Authorization:

License Authorization:

Status: AUTHORIZED on Aug 4 05:30:05 2016 UTC

Last Communication Attempt: SUCCEEDED on Aug 4 05:25:02 2016 UTC

Next Communication Attempt: Sep 3 05:30:07 2016 UTC

Communication Deadline: Aug 4 05:24:56 2017 UTC

Development mode: enabled

admin@ncs#

Usage (Authorized Status)

What license is used can be seen with show license summary command. In the this example, NSO-platform-production, NSO-network-element and cisco-ios-NED are used in the system. Notice that License Authorization status is "AUTHORIZED". This means that the all components that require licenses are correctly working under a legal state.

admin@ncs# show license summary

Smart Licensing is ENABLED

Registration:

Status: REGISTERED

Smart Account: COMPANY A

Virtual Account: Network Department

Last Renewal Attempt: None

Next Renewal Attempt: Jan 31 05:33:02 2017 UTC

License Authorization:

Status: AUTHORIZED

Last Communication Attempt: SUCCEEDED

Next Communication Attempt: Sep 3 05:33:06 2016 UTC

License Usage:

License                     Entitlement Tag                                                                                Count        Status

----------------------------------------------------------------------------------------------------------------------------------------------

348fbb21-7edf-42bb-baa7-198903058a54regid.2016-04.com.cisco.NSO-platform-production,4.2_348fbb21-7edf-42bb-baa7-198903058a54       1            InCompliance

5d641fa0-757d-43b0-a926-166cb6e3cfddregid.2015-10.com.cisco.NSO-network-element,1.0_5d641fa0-757d-43b0-a926-166cb6e3cfdd           3            InCompliance

d9eca34d-1f6a-4595-ad74-9c0c57e03c27regid.2015-10.com.cisco.cisco-ios-NED,1.0_d9eca34d-1f6a-4595-ad74-9c0c57e03c27                 1            InCompliance

Development mode: disabled

admin@ncs#

This is an output of show license usage command in a different example. In this example, cisco-iosxr-NED is also added, and the status is OutOfCompliance. This indicates that to register to CSSM is fine, however, a license for cisco-iosxr-NED is insufficient in the virtual account. Because of out of compliance status of cisco-iosxr-NED, the overall status is OUT_OF_COMPLIANCE.

admin@ncs # show license usage

License Authorization Status : OUT_OF_COMPLIANCE  as of Oc  24 06:14:11 2016 UTC

NSO-platform-production (regid.2016-04.com.cisco.NSO-platform-production, 1.0_d1445dab-9d96-4593-99f2-6f633b8a759c)

Description : API unavailable

Count : 1

Version : 1.0

Status : InCompliance

NSO-network-element (regid.2015-10.com.cisco.NSO-network-element, 1.0_5d641fa0-757d-43b0-a926-166cb6e3cfdd)

Description : API unavailable

Count : 3

Version : 1.0

Status : InCompliance

cisco-ios-NED (regid.2015-10.com.cisco.cisco-ios-NED, 1.0_d9eca34d-1f6a-4595-ad74-9c0c57e03c27)

Description : API unavailable

Count : 1

Version : 1.0

Status : InCompliance

cisco-iosxr-NED (regid.2015-10.com.cisco.cisco.cisco-iosxr-NED, 1.0_9956fc34-cbed-4d13-a1ea-6a36f4e40a99)

Description : API unavailable

Count : 1

Version : 1.0

Status : OutOfCompliance

Troubleshoot

Try to enable debug on smart license feature. When debug is enabled, debug log is generated into the file specified in /smart-license/smart-agent/stdout-capture/file. smart license debug generates much logs, and it is recommended to disable the debug after collecting data.

Debug enable

admin@ncs# debug smart_lic all

ok

admin@ncs#

Debug disable

admin@ncs# no debug smart_lic all

ok

admin@ncs#

Smart license log config

admin@ncs# show running-config smart-license

smart-license smart-agent stdout-capture disabled

smart-license smart-agent stdout-capture file ./logs/ncs-smart-licensing.log

admin@ncs#

Enable smart license log

admin@ncs(config)# smart-license smart-agent stdout-capture enabled

admin@ncs(config)# commit

Commit complete.

admin@ncs(config)#

Renew CSSM On-Prem SSL Certificate

For customers that have on-prem CSSM, NSO can fail to connect to the server if the SSL certificate has expired.

Here are the steps in order to fix the problem by generating a onprem.crt file:

1. Collect the new certificate from the CSSM server using openssl (port normally used is 443):

openssl s_client -showcerts -connect <<ON_PREM_CSSM_IP_ADDRESS>>:443 | openssl x509 -out onprem.crt

2. Find the directory to import the certificate. The default directory is /etc/pki/ca-trust/extracted/java/cacerts. In order to find it, here is a command to search for the cacerts directories in the system, and an example of the output:

[root@localhost /]# find / -name cacerts 2>/dev/null | xargs -I {} ls -l {}

-r--r--r--. 1 root root 156478 Jun 26 08:02 /etc/pki/ca-trust/extracted/java/cacerts

lrwxrwxrwx. 1 root root 40 Aug 25  2022 /etc/pki/java/cacerts -> /etc/pki/ca-trust/extracted/java/cacerts

lrwxrwxrwx. 1 root root 21 Jun 15 04:52 /etc/java/java-17-openjdk/java-17-openjdk-17.0.15.0.6-3.el9.x86_64/lib/security/cacerts -> /etc/pki/java/cacerts

[root@localhost /]#

3. Load the certificate. The default password for the keystore is changeit:

sudo keytool -import -alias ssm_onprem -file onprem.crt -keystore /etc/pki/ca-trust/extracted/java/cacerts

3.1 (Optional) In order to confirm that the certificate was properly loaded, execute this command:

root@Ubuntu-24-9:/home/nso# keytool -list -keystore /etc/ssl/certs/java/cacerts -storepass changeit -alias ssm_onprem

Warning: use -cacerts option to access cacerts keystore

ssm_onprem, Aug 4, 2025, trustedCertEntry,

Certificate fingerprint (SHA-256): F7:00:C9:74:34:57:5E:BE:70:A7:0E:D2:9B:A8:2D:44:F1:CE:14:55:C3:D9:06:3F:83:68:95:A1:C6:B5:7F:26

root@Ubuntu-24-9:/home/nso#

4. Restart the smart agent (in config mode):

admin@ncs(config)# smart-license smart-agent restart

result Started

5. Re-register the certificate:

admin@ncs# license smart deregister

ok

admin@ncs# license smart register idtoken TOKEN

Registration process in progress. Use the 'show license status' command to check the progress and result.

admin@ncs#

6. In order to confirm that the registration was successful with the show license summary command whose output is shown in this article.