Troubleshoot ASA Smart Licensing Issues Due to Change in Default Transport Type

Introduction

This document describes the changes introduced in ASA Smart Licensing as the default transport method changed from Callhome to Smart Transport.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

• Adaptive Security Appliance CLI
• Cisco Smart Licensing

Component Used

The information in this document is based on: 

• Cisco Adaptive Security Appliance 9.20(4)10

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Feature Information

In the newest ASA releases, the default licensing transport method has been changed to Smart Transport. The primary difference is that the device now connects to https://smartreceiver.cisco.com to renew its licensing entitlement. In previous releases, which used the Callhome method, the device connected to https://tools.cisco.com instead.

This migration does not require any configuration changes; however, traffic to https://smartreceiver.cisco.com must be permitted on upstream devices.

The Transport Mode was introduced from mentioned ASA versions:

• 9.20.4
• 9.22.1
• 9.23.1
• 9.24.1

To verify if the device is using Call Home or Smart Transport, please use show license status command.

Verification

Smart Transport:

ASA# show license status
Smart Licensing is ENABLED
Utility:
  Status: DISABLED

Data Privacy:
  Sending Hostname: yes
    Callhome hostname privacy: DISABLED
    Smart Licensing hostname privacy: DISABLED
  Version privacy: DISABLED

Transport:
  Type: Smart <----
  URL: https://smartreceiver.cisco.com/licservice/license <----
  Proxy:
    Not Supported
  VRF:
    Not Supported

Callhome:

ASA# show license status 

Smart Licensing is ENABLED

Utility:
  Status: DISABLED

Data Privacy:
  Sending Hostname: yes
    Callhome hostname privacy: DISABLED
    Smart Licensing hostname privacy: DISABLED
  Version privacy: DISABLED

Transport:
  Type: Callhome <----

On ASA versions using Smart Transport by default, it can be reverted to Callhome if resolving reachability issue with smartreceiver.cisco.com is taking time and there is service outage. But please note that Callhome is going to be deprecated in the future so please make sure to revert the configuration to use Smart Transport again as soon as connectivity is restored.

Smart Transport to Callhome

Command Line:

ASA# configure terminal
ASA(config)#
ASA(config-smart-lic)# transport type ?

smart-lic-mode mode commands/options:
  callhome  Use Smart Call Home as license message transport
  smart     Use Smart Transport as license message transport
ASA(config-smart-lic)# transport type callhome

ASDM:

Configuration > Device Management > Licensing > Smart Licensing

Callhome to Smart Transport

Command Line:

ASA# configure terminal
ASA(config)#
ASA(config-smart-lic)# transport type ?

smart-lic-mode mode commands/options:
  callhome  Use Smart Call Home as license message transport
  smart     Use Smart Transport as license message transport
ASA(config-smart-lic)# transport type smart

ASDM:

Configuration > Device Management > Licensing > Smart Licensing

Proxy Support

If your environment requires a proxy to connect to https://smartreceiver.cisco.com, please configure the proxy under the smart licensing configuration by adding transport proxy [proxy] port [port].

Example:

ASA#configure terminal
ASA(config)#license smart
ASA(config-smart-lic)#transport proxy cisco-lab-proxy.cisco.com port 80 <----

From ASDM, Configuration > Device Management > Smart Licensing

Please be aware of 'Cisco bug ID CSCwr56980' while checking the proxy settings.

Compatibility 

Callhome remains available on versions where Smart Transport is configured as the default mode. To enable the Callhome option, the transport type must be set to Callhome within the licensing configuration:

ASA# show run license 
license smart
[..]
 transport type callhome <----

Common Issues

There are few common scenarios where different behaviours were observed where some ended up as production impacting post upgrade to a release where licensing model was also updated to Smart Transport.  

Scenario A

Condition: ASA is unable to reach Smart Authority.​

​

Status: ASA is authorized, no operational impact (less than 90 days).​

Registration:
  Status: REGISTERED
  Smart Account: Cisco Systems, TAC
  Virtual Account: EU TAC
  Export-Controlled Functionality: ALLOWED
  Initial Registration: SUCCEEDED on Jan 12 2026 13:09:43 UTC
  Last Renewal Attempt: None
  Next Renewal Attempt: Jul 11 2026 13:09:43 UTC
  Registration Expires: Jan 12 2027 13:04:42 UTC

License Authorization:
  Status: AUTHORIZED on Jan 12 2026 13:11:25 UTC
  Last Communication Attempt: FAILED on Jan 12 2026 13:11:25 UTC <----
  Failure reason: Communication message send error <----
  Next Communication Attempt: Jan 12 2026 13:11:55 UTC
  Communication Deadline: Apr 12 2026 13:04:55 UTC

Resoltuion Steps: 

1. Confirm that the Smart Licensing transport method configured on the device is either Smart or Callhome.
2. Ensure that DNS resolution is working correctly by verifying that the device can resolve and reach the appropriate server: smartreceiver.cisco.com for Smart transport or tools.cisco.com for Callhome transport.
3. After restoring connectivity, renew the license authorization by running the command: license smart renew auth.

Scenario B

Condition:ASA is unable to reach Smart Authority for more than 90 days.

​

Status: Upon license authorization expiration, features requiring special licenses are restricted. Most notably, ASAv AnyConnect sessions are limited to two, and throughput is throttled to 100 kbps.

Registration:
  Status: REGISTERED
  Smart Account: Cisco Systems, TAC
  Virtual Account: EU TAC
  Export-Controlled Functionality: ALLOWED
  Initial Registration: SUCCEEDED on Dec 15 2022 02:52:47 UTC
  Last Renewal Attempt: FAILED on Dec 29 2025 07:20:08 UTC
  Failure reason: Communication message send error
  Next Renewal Attempt: Dec 29 2025 07:20:38 UTC
  Registration Expires: Jun 02 2026 03:15:26 UTC

License Authorization:
  Status: AUTH EXPIRED on Dec 29 2025 06:37:55 UTC
  Last Communication Attempt: FAILED on Dec 29 2025 06:37:55 UTC <----
  Failure reason: Communication message send error <----
  Next Communication Attempt: Dec 29 2025 07:37:55 UTC
  Communication Deadline: DEADLINE EXCEEDED <----

Licensed features for this platform:
Maximum VLANs                     : 1024           
Inside Hosts                      : Unlimited      
Failover                          : Active/Active  
Encryption-DES                    : Enabled        
Encryption-3DES-AES               : Enabled        
Security Contexts                 : 2              
Carrier                           : Disabled       
AnyConnect Premium Peers          : 2 <<<<<<             
AnyConnect Essentials             : Disabled       
Other VPN Peers                   : 10000          
Total VPN Peers                   : 10000          
AnyConnect for Mobile             : Disabled       
AnyConnect for Cisco VPN Phone    : Disabled       
Advanced Endpoint Assessment      : Disabled       
Shared License                    : Disabled       
Total TLS Proxy Sessions          : 2              
Botnet Traffic Filter             : Enabled        
Cluster                           : Enabled 

Resoltuion Steps: 

1. Confirm that the Smart Licensing transport method configured on the device is either Smart Transport or Callhome.
2. Ensure that DNS resolution is working correctly by verifying that the device can resolve and reach the appropriate server: smartreceiver.cisco.com for Smart Transport or tools.cisco.com for Callhome Transport.
3. After restoring connectivity, renew the license authorization by running the command: license smart renew auth.

Scenario C

Condition: The ASA was rebooted afterfailing to reachthe Smart Licensing Authority for over one year.

Status: If a device is rebooted after one year of failed connectivity to the License Authority, it defaults to Evaluation mode, which disables export-controlled features (strong encryption). It can cause VPN outage, failover split-brain scenario or SSH outage. 

Status: REGISTERING - REGISTRATION IN PROGRESS​
Export-Controlled Functionality: NOT ALLOWED​
Initial Registration: FAILED on Dec 16 2025 12:59:29 UTC​
Failure reason: Communication message send error​
Next Registration Attempt: Dec 16 2025 14:00:10 UTC​

License Authorization: ​
Status: EVAL MODE

Resolution Steps:

1. Confirm that the Smart Licensing transport method configured on the device is either Smart Transport or Callhome Transport.
2. Ensure that DNS resolution is working correctly by verifying that the device can resolve and reach the appropriate server: smartreceiver.cisco.com for Smart transport or tools.cisco.com for Callhome Transport.
3. Upon restoration of connectivity, register the device by executing the command: license smart register idtoken [TOKEN].
4. "Do not save the configuration", as the device was booted without crypto related configurations. Even if 'transport type callhome' was configured under the 'license smart' submode to use call-home, the device can be reloaded without saving the configuration after a successful registration to ensure the original crypto configuration is restored.
5. Once the device has booted with the required crypto configuration, resolve the licensing issue by restoring connectivity to the license authority or by temporarily configuring 'transport type callhome' under the 'license smart' submode, until connectivity to smartreceiver.cisco.com is permitted.

​

Troubleshooting

• Please ensure that there is reachability to smartreceiver.cisco.com and DNS is correctly configured to resolve this FQDN.
• HTTP and licensing debugs can be leveraged, depending on the problem.
  • debug http 255
  • debug license agent all
  • debug license 255
• There are two known software bugs that can cause connectivity issues. Verification can be conducted based on:

'Cisco bug ID CSCwp10957': Susceptibility exists if the Cisco ASA software version is lower than 9.20(4)14, 9.22(2)14, or 9.23(1)22.
'Cisco bug ID CSCws62173': Susceptibility exists if the ASA is running on a Secure Firewall 2100 (FP2100) series platform with a software version lower than 9.20(4)22, 9.22.3, or 9.24(1)9.

Related Information

• Cisco Secure Firewall ASA General Operations CLI Configuration Guide, 9.20 

Revision History

Revision	Publish Date	Comments
1.0	21-May-2026	Initial Release