Implement Permanent Licenses in Air-Gapped Networks on FDM

Available Languages

Download Options

  • PDF     (2.0 MB)
    View with Adobe Reader on a variety of devices
  • ePub     (2.2 MB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (2.3 MB)
    View on Kindle device or Kindle app on multiple devices
Updated:July 23, 2026
Document ID:221713

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

This document describes how to implement Permanent Licenses in Air-Gapped Networks on Firepower Device Manager (FDM).

Prerequisites

Requirements

It is recommended to have knowledge of this topic:

  • Cisco Secure Firewall Threat Defense Initial Configuration

Components Used

The information in this document is based on the software version:

  • Firepower Threat Defense Version 7.4.1.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Configure

Enable PLR Mode

1. Enable PLR Mode on your device.

2. Click Device and navigate to Smart License.

Enable PLR Mode

3. Click the gear and select Switch to Universal PLR.

note-icon

Note: If your device is using smart licensing, you must unregister the device.

caution-icon

Caution: Once you switch to PLR mode, you cannot switch back to evaluation mode.

Click the Gear and Select Switch to Universal PLR

4. In the preview window, select the Performance Tier and click Yes.

In Preview Pane, Select the Performance Tier and Click Yes

5. Save the Request Code.

Save the Request Code

6. Log in to your CSSM account and navigate to Smart Software Licensing > Inventory > Licenses and click License Reservation.

Log in to your CSSM Account and Navigate to Smart Software Licensing, Inventory, Licenses and Click License Reservation

7. Click Proceed.

Click Proceed

8. Paste your Request Code and click Next.

Paste your Request Code and Click Next

9. Select your license and click Next.

Select your License and Click Next

10. Click Generate Authorization Code.

Click Generate Authorization Code

11. To save the Authorization Code, click Download as File or Copy to Clipboard.

Save Authorization Code

12. Click Close to finish the process.

13. Go back to FDM and paste the Authorization Code and click Register.

note-icon

Note: Refresh the page to view the current status of the license.

Paste the Authorization Code

Cancel PLR Registration

I have a License in CSSM

Use this option, when you complete the License Registration wizard in CSSM and you have an authorization code. For example, you started the process in the wrong FDM, so you must release your license in your CSSM account.

1. Click Device and navigate to Smart License.

Enable PLR Mode

2. Click the gear and select Cancel PLR.

Cancel PLR

3. Select I have a license in CSSM.

Select I have a License in CSSM

4. Paste your Authorization Code and click Generate Release Code.

Paste Your Authorization Code and Click Generate Release Code

5. Save your Release License Code.

Save your Release License Code

6. Log in to your CSSM account and navigate to Smart Software Licensing > Inventory > Product Instances.

Navigate to Smart Software Licensing, Inventory and Product Instances

7. Search your device by name.

note-icon

Note: The Name is the device serial number.

Search for your Device by Name

8. Click Actions and select Remove in the drop-down list.

Click Actions and Select Remove in Drop-Down List

9. Paste your Release License Code and click Remove Reservation.

Paste Release License Code and Click Remove Reservation

10. Go back to your device and click Ok.

note-icon

Note: Refresh the page to view the current status of the license.

Go Back to your Device and Click Ok

I do not have a License in CSSM

Use this option when you do not complete the License Registration wizard in CSSM. For example, you started the PLR process in your FDM, but you do not have the correct licenses in your CSSM.

1. Click Device and navigate to Smart License.

Enable PLR Mode

2.Click the gear and select Cancel PLR.

Cancel PLR

3. Select I do not have a license in CSSM.

I do not have a License in CSSM

4. Click Ok to complete.

Unregister the Device in PLR Mode

1. Click Device and navigate to Smart License.

Unregister the Device in PLR Mode

2. Click the gear and select Unregister Universal PLR.

Click the Gear and Select Unregister Universal PLR

3. Click Yes to continue the process.

Click Yes to Continue the Process

4. Save the Release License Code.

Save the Release License Code

5. Log in to your CSSM account and navigate to Smart Software Licensing > Inventory > Product Instances.

Navigate to Smart Software Licensing, Inventory and Product Instances

6. Search for your device by name.

note-icon

Note: The name of your device is serial number.

Search for your Device by Name

7. Click Actions and select Remove in the drop-down list.

Click Actions and Select Remove in Drop-Down List

8. Paste your Release License Code and click Remove Reservation.

Paste your Release License Code and Click Remove Reservations

9. Go back to your device and click Unregister.

Go Back to your Device and Click Unregister

Verify

1. Navigate to Device > Smart License and the license displays as Universal PLR.

Verify

Troubleshoot

1. Look for errors in /ngfw/var/log/cisco/smart_agent.log.

For example, in these logs, you can see the registration process was successful.

> expert
admin@firepower:~$ sudo su
Password: 
root@firepower:/home/admin# cd /ngfw/var/log/cisco/ 
root@firepower:/ngfw/var/log/cisco# tail smart_agent.log 
2024-02-09 03:21:21 ajp-nio-8009-exec-8: INFO LicenseSoftwareIds:82 - Selected software ID: regid.2019-11.com.cisco.VIRTSEC,1.0_9aa10401-8a9a-4bfb-8e41-bea8ea257aad
2024-02-09 03:21:21 ajp-nio-8009-exec-8: INFO DefaultSmartAgentFactoryProvider:398 - New platform tag is regid.2019-11.com.cisco.VIRTSEC,1.0_9aa10401-8a9a-4bfb-8e41-bea8ea257aad
2024-02-09 03:21:21 ajp-nio-8009-exec-8: INFO PLRUnhandledNotificationHandler:31 - Handling listener class com.cisco.ngfw.onbox.backend.services.SmartAgentStatusServiceDelegate for Notification: NotifyReservationInstalled
2024-02-09 03:21:21 ajp-nio-8009-exec-8: INFO PLRUnhandledNotificationHandler:31 - Handling listener class com.cisco.ngfw.onbox.backend.platform.SmartAgentConfFileSync for Notification: NotifyReservationInstalled
2024-02-09 03:21:21 ajp-nio-8009-exec-8: INFO SmartAgentConfFileSync:178 - RegistrationStatus : REGISTERED AuthorizationStatus : AUTHORIZED
2024-02-09 03:21:21 ajp-nio-8009-exec-8: INFO SmartAgentConfFileSync:192 - updated the smart Agent File with the status
2024-02-09 03:21:21 ajp-nio-8009-exec-8: INFO PLRUnhandledNotificationHandler:31 - Handling listener class com.cisco.ngfw.onbox.backend.services.LicenseServiceDelegate for Notification: NotifyReservationInstalled
2024-02-09 03:21:21 ajp-nio-8009-exec-8: INFO DefaultSmartAgentManager:159 - Received notification from Nesla: 'NotifyExportControlled'.

2. Take a pigtail to request TAC assistance and attach it to the case notes. You can request support assistance in Cisco Technical Support & Downloads.

> expert
admin@firepower:~$ sudo su
root@firepower:/home/admin# pigtail all -outfile LogsRegistration.txt

3. The license status is also reported in the /etc/sf/smart_agent.conf file. If the device is in Universal Permanent Licensing Reservation mode, the smart_agent.conf shows as REGISTERED and AUTHORIZED.

> expert
admin@firepower:~$ sudo su
root@firepower:/home/admin# tail /etc/sf/smart_agent.conf 
#Fri Feb 09 03:21:21 UTC 2024
virtual_acct=
registration=REGISTERED,null
authorization=AUTHORIZED,1707448881842

Common Issues

Not enough licenses. In the License Reservation process, you receive this error:

Not Enough Licenses

Recommended Action:

1. Verify you have enough licenses in your CSSM account. If you have enough licenses, request TAC assistance.

2. You cannot see the License Reservation button.

You Cannot See the License Reservation Button

Recommended Action:

3. You must contact your Cisco representative to enable PLR mode in your account.

Related Information

Revision History

Revision Publish Date Comments
2.0
23-Jul-2026
Updated Introduction, Title, spelling, grammar, inserted horizontal lines to separate sections/readability, fixed CCW alerts.
1.0
20-Feb-2024
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • Alexis Armando Rivera Garcia
    Cisco Security Technical Consulting Engineer

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products