Resolving "SIA Grace Period Expired" Alarm using Smart Licensing Configuration
Available Languages
Introduction
This document describes a common issue encountered with Cisco NCS1K devices where software upgrades are blocked due to a "SW Upgrade will be blocked as SIA Grace Period has expired" alarm.
Background Information
This document outlines the troubleshooting steps, resolution, and best practices to restore Software Innovation Access (SIA) compliance, enabling successful system upgrades.
Problem Description
Customers attempting to upgrade NCS1K devices can encounter an alarm indicating that the SIA Grace Period has expired. This alarm prevents the upgrade operations, effectively blocking any software upgrades. The system reports the device as SIA is "Out of Compliance" for an extended period of over 90 days.
SIA Out of compliance will only block Software Upgrades; this will not affect any functionality on the system.
Impact
The impact of this is the inability to perform software upgrades on the affected NCS1K device.
Troubleshooting Steps
Initial investigation and troubleshooting focused on validating the upgrade method and diagnosing the licensing compliance status.
- Confirm Upgrade Procedure: Provide and verify that the customer is using Cisco documented and supported procedure for software upgrades. For NCS1014 Software setup guide, refer to: Setup and Software Installation Guide.
- Verify Active Alarms: "SW Upgrade will be blocked as SIA Grace Period has expired" under active alarms. In order to view active alarms, you must connect to node via telnet/ssh and run command show alarms brief system active.
RP/0/RP0/CPU0:Node-A# show alarms b s a
Mon Aug 11 09:31:02.861 UTC
------------------------------------------------------------------------------------
Active Alarms
------------------------------------------------------------------------------------
Location Severity Group Set Time Description
------------------------------------------------------------------------------------
0/RP0/CPU0 Major Software 03/09/2025 01:55:55 UTC SW Upgrade will be blocked as SIA Grace Period has expired
- Check Licensing Status: The show license platform detail was reviewed in order to check the current compliance state and identify specific licensing issues.
RP/0/RP0/CPU0:Node-A# show license platform detail
Thu Aug 14 04:28:57.161 UTC
Collection: LAST: Thu Aug 14 2025 03:55:56 UTC
NEXT: Thu Aug 14 2025 04:55:56 UTC
Reporting: LAST: Thu Aug 14 2025 01:55:57 UTC
NEXT: Fri Aug 15 2025 01:55:57 UTC
IMPORTANT**
SIA Status: Out of Compliance(Grace Period Expired)
RUM ACK is not received for more than 90 days.
SW Upgrades are blocked as Grace Period is expired
- You must further verify the smart license configuration for the node in order to check why Sync is not happening. (If not configuring the license from scratch, proceed to Step 6.)
- For Configuring Smart Licensing:
Step A. Configure the domain name server for the smart license server.
Example:
RP/0/RP0/CPU0:ios#configure
Sat Dec 15 15:25:14.385 IST
RP/0/RP0/CPU0:ios(config)#domain name-server 192.0.2.247
Step B. Set up the CiscoTAC-1 profile and destination address for Smart Call Home, using these commands:
call-home
service active
contact smart-licensing
profile CiscoTAC-1
active
destination address http {http|https}://{FQDN}/its/service/oddce/services/DDCEService
destination transport-method http
Example:
RP/0/RP0/CPU0:ios#domain name-server 192.0.2.247
RP/0/RP0/CPU0:ios#call-home
RP/0/RP0/CPU0:ios#service active
RP/0/RP0/CPU0:ios#contact smart-licensing
RP/0/RP0/CPU0:ios#profile CiscoTAC-1
RP/0/RP0/CPU0:ios#active
RP/0/RP0/CPU0:ios#destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
RP/0/RP0/CPU0:ios#destination transport-method http
Step C. Configure the crypto ca Trust point profile, if Certificate Revocation List (CRL) distribution point is not defined in the Satellite server certificate or if the device is not able to reach the host mentioned in the CRL distribution point.
Example:
RP/0/RP0/CPU0:ios(config)#crypto ca trustpoint Trustpool CRL optional
Step D. Create and copy the registration token ID using Cisco Smart Software Manager.
Step E. In the privileged EXEC mode, register the token ID in Cisco Network Control System (NCS) 1014, using this command:
license smart register idtoken token-ID
Note: CiscoTAC-1 profile is the default profile for smart licensing and it must not be deleted.
Step F. Smart Licensing Transport Mode - The default transport mode for the 24.1.1 release is Cisco Smart License Utility (CSLU), but you can change the mode to Call-Home, Smart Transport or Offline mode. These transport modes are available for you to choose now:
-> CSLU
-> Call-Home
-> Smart
-> Offline
Step G. Configuring the Transport Mode.
CSLU: CSLU is the default license transport mode, use this configuration to set the communication transport mode to CSLU.
Example:
configure
license smart transport cslu
license smart url cslu http://cslu-local:8182/cslu/v1/pi
commit
Call-Home: In order to use the Call-Home transport mode, use this configuration:
Example:
configure
license smart transport callhome
callhome
service active
contact-email-addr username@example.com
profile CiscoTAC-1
destination transport-method http
Router(config-call-home-profile)# destination address http
https://tools.cisco.com/its/service/oddce/services/DDCEService
active
no destination transport-method email
commit
Smart Transport: In order to use the Smart Transport communication mode, use this configuration:
Example:
configure
license smart transport smart
license smart transport url https://smartreceiver.cisco.com/licservice/license
commit
Offline: In order to use the Offline communication mode you have to turn off the Smart Transport, use this configuration to turn off Smart Transport:
Example:
configure
license smart transport off
commit
- The running configuration was verified and it was identified that the node had call home configuration but Transport Mode was missing:
call-home
service active
http-proxy x.x.x.x port 3128
profile CiscoTAC-1
active
destination transport-method email disable
destination transport-method http
!
- Further check showed license status output and Transport showed as 'Off'.
RP/0/RP0/CPU0: Node-A#show license status
Thu Aug 14 04:27:52.330 UTC
Utility:
Status: DISABLED
Smart Licensing Using Policy:
Status: ENABLED
Account Information:
Smart Account: <none>
Virtual Account: <none>
Data Privacy:
Sending Hostname: yes
Callhome hostname privacy: DISABLED
Smart Licensing hostname privacy: DISABLED
Version privacy: DISABLED
Transport:
Type: Transport Off
- Since you already had the call home configuration, you will only need to change Transport mode to call home using these commands:
configure
license smart transport callhome
You can verify the configuration by executing show license status.
RP/0/RP0/CPU0:Node-A#show license status
Thu Aug 14 04:27:52.330 UTC
Utility:
Status: DISABLED
Smart Licensing Using Policy:
Status: ENABLED
Account Information:
Smart Account: <none>
Virtual Account: <none>
Data Privacy:
Sending Hostname: yes
Callhome hostname privacy: DISABLED
Smart Licensing hostname privacy: DISABLED
Version privacy: DISABLED
Transport:
Type: Callhome
- Step 5 D and 5 E were again executed in order to register the node and after its License was successfully synced.
Conclusion
Successfully resolving the "SIA Grace Period has expired" alarm and enabling software upgrades on Cisco NCS1014 devices requires a systematic approach to smart licensing configuration and verification. Ensuring correct license smart transport settings, proper node registration with CSSM using a valid token, and subsequent license synchronization are critical. In some cases, a force license registration or controller reload may be required to complete the system sync. Once SIA compliance is restored, the software upgrade process can proceed without further issues.
Related Information
Revision History
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
03-Sep-2025
|
Initial Release |
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)