Configure and Troubleshoot Expressway Smart Licensing

Introduction

This document describes how to configure Expressway with Cisco Software Smart Licensing (CSSM).

Prerequisites

Requirements

Cisco recommends you have knowledge of these topics:

• Expressway and CSSM.

Components Used

The information in this document is based on these software and hardware versions:

• Cisco Expressway x14.0.11
• Cisco Expressway x14.3.1
• Cloud CSSM

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background

Cisco Smart Licensing makes managing licensing more flexible and simplifies management across the enterprise.  Devices that utilize Smart Licensing report license consumption, which removes the need to use option keys (Product Activation Keys). License entitlements are pooled in a single account that can be used across Expressways or across different clusters of Expressways. Expressway started to utilize Cisco Smart Licensing in version x12.6.  At that time, deployments could use either traditional licenses or Smart Licensing. With version x14.1 and later the Expressway only supports Smart licensing.  Upgrades from deployments using traditional licenses to any version x14.1 or newer automatically enables Smart licensing and starts a 90 day grace period.  Expressway version x14.2 introduced Specific License Reservations (SLR).

Here are some benefits of Smart Licensing:

• Adds flexibility to licensing and simplifies it across the enterprise.
• Easier to procure, deploy, and manage licenses easily where devices self-register and report license consumption, removing the need for product activation keys (PAK).
• utilize on premise satellite Cisco Smart Software Manager or Cloud Smart Software Manager to easily allocate licenses where needed (CSSM).

Note: Due to a Root Certificate change on software.cisco.com in January 2023, Expressway does NOT work with neither a direct or proxy connection to Smart Licensing unless running X14.0.11 or X14.2.5 (or newer). Only Satellite CSSM works before these versions.

Types of Smart Licenses

There are 4 types of license reservation types available for Smart Licensing on Expressways.  These are used to create a pool of licenses that each Expressway in the deployment can utilize.   

• Cisco Expressway Rich Media Session License (Rich Media Session)
• UC Manager Enhanced License (Desktop/User Device)
• UC Manager Telepresence Room License (Telepresence Room)
• Permanent License Reservation (PLR) (For Defense / Military customers and internal Cisco Technical support only)

These licenses are not available on Smart Licensing, so if using these, deployments cannot be upgraded past 14.0.x

• Advanced Account Security - 116341J00
• Hardware Security Module (HSM) - 116341H00
• Microsoft Interoperability - 116341 COO

Note: No licenses are required for Mobile Remote Access (MRA) unless placing video calls from MRA clients to addresses outside your domain.  If the latter, Expressway E requires RMS licenses.

Converting Traditional Licenses to Smart Software Licenses

If you do not yet have smart licenses in your Virtual Account, you can convert your existing licenses to Smart Licenses in the Smart Software Licensing Portal (https://software.cisco.com). If you do not already have eligible SKUs (only RMS and Device Licenses are eligible for Smart Licensing), you need to have your PAK number for the licenses you want to convert and associate those with your Smart Account before converting them.  You would perform that association in the Product License Registration Portal. If you do not have your PAK numbers, contact Cisco Licensing and provide them your sales order number so they can help complete the conversion for you.

1. Navigate to Cisco Software Central > Smart Software Licensing > Convert to Smart Licensing and select either Convert PAKs or Convert Licenses, depending on what you need.

License Conversion

2. Select the licenses you want to convert (A-FLEX-EXP-RMS, A-FLEX-EXP-DESK, A-FLEX-EXP-ROOM), then click Convert Licenses.

3. On the pop up menu Convert to Smart Software Licenses:

a: select the licenses you want to convert, click next

b: review your selection and click Convert Licenses

Transport settings

When configuring Smart Licensing on Expressway, Transport settings must be configured in the Maintenance > Smart Licensing page. This section tell Expressway how to reach Smart Licensing.

Expressway Transport Settings

Direct: Expressway reaches out to the Internet directly to the Smart Receiver.  The Expressway requires HTTPS access to the Internet for this method.

Cisco Smart Software Manager On-Prem: Expressway talks to a satellite server that is running locally on your network. (Configure the satellite server URL with /SmartTransport at end of the satellite URL).

Proxy Server: Expressway has to connect via a proxy server to reach the Internet.  Deployments that do not allow devices direct access to the Internet over HTTPS require a proxy server for that traffic to flow through.

Do Not share my Hostname or IP address with Cisco: When left unchecked, the host name is visible in the Smart licensing > Product instance page.  This only occurs when using Tokens.  If using License Reservation, the product instance page shows Expressway and the device serial number.  In this example, e1 and e2 are shown as the name because the deployment is using tokens and the box is not checked.

Product Instance Page - CSSM

Smart Licensing Using Tokens

Smart Licensing using Tokens was the only method to connect to Smart Licensing between versions x12.6 and x14.0.11 and required the Expressway to be able to reach the CSSM (cloud or on-prem) in order to access available licenses, or to update license usage. The inclusion of Smart licensing makes managing Expressway licenses easier, removing the need for PAK licensing. Prior to x14.1, Smart Licensing must be enabled in Maintenance > Smart Licensing, but from x14.1 onward, Smart Licensing is enabled by default.

Tokens give the Expressway(s) access to all available licenses in the Virtual Account (VA) on CSSM.

Note: Each node in an Expressway cluster must have tokens assigned. Applying a token to the primary expressway node does not license the peer nodes.

Configure 

1. Log into software.cisco.com and go to the General tab in the Virtual Account and select New Token.
2. Fill in the token registration with a Description, Expires After (number of days the token is valid for before applying to the servers, in days), and Max. Number of Uses, and click Create Token.

CSSM Token Creation

Caution: Smart Licensing changed their Certificate Authority (CA) on Jan, 2023. Since that time, tokens do not work if using Direct or Proxy connection to CSSM prior to x14.0.11. Refer to Cisco bug ID CSCwe09378.

Note: Only registered Cisco users can access internal Cisco bug information.

3. Copy the token and on each Expressway in the deployment, open Maintenance > Smart Licensing.  If on an Expressway version x12.6 - x14.0.x, you must manually enable Smart Licensing.  A prompt is displayed saying that enabling Smart Licensing is irreversible and a factory reset is required if you want to go back to using traditional licenses.  
4. Paste token in the Registration field at the bottom of the page and click Register.

Expressway Token Field

The deployment license usage is automatically updated every 6 hours from Expressway to CSSM, but if you wanted to update the usage at any given time, this can be done in Expressway Maintenance > Smart Licensing, and selecting Update Usage Details.

Caution: This is resource intensive, and must be used with caution.

Note: This assumes you have already set up the Transport settings in Expressway Maintenance > Smart Licensing.

Smart Licensing Using Specific License Reservation (SLR)

Introduced in Expressway x14.2, SLR licensing method is needed for air-gapped deployments, where Expressway cannot reach the Internet, but is suitable for any deployment that is using cloud CSSM.  Only cloud CSSM can have License Reservation, so if you have on-prem CSSM, you need to use Smart Licensing Tokens or engage the Cisco Licensing team to assist in creating a new Virtual Account in your cloud CSSM that can have License Reservation.  Each node in a cluster must have Smart License Reservation enabled and configured.

Before beginning, deployments that are clustered already must have no alarms. Refer to the Cisco Expressway Cluster creation documentation for further details regarding clustering.

Note: Specific License Reservation (SLR) must be performed on each node in the Expressway cluster.

Tip: SLR cannot be used with Satellite CSSM and cannot be used in cloud CSSM using the same Virtual Account (VA) used for connecting with the satellite CSSM. If wanting to use SLR, Expressway Smart Licenses need to be transferred to a different or new VA in cloud CSSM.  Engage Cisco Licensing team for assistance, if needed.

Configure

Steps to enable SLR:

1. In CLI, run command xconfiguration license Smart reservationEnable: on.
2. In CLI, run command xcommand license Smart reservation request.
3. Copy the Reservation Request Code, and log into the Smart Account at Cisco Software Smart Licensing.
4. In the Virtual Account, click License Reservation and paste the Reservation Request Code.

CSSM License Reservation

Note: If License Reservation is not the Virtual Account, engage Cisco Licensing team.

5. Select how many licenses to reserve for this request. 

Caution: All nodes in the cluster must be registered to Smart Licensing which means there has to be some licenses available for all nodes. Do not assign all licenses to one node.

CSSM License Reservation

6. After reviewing, click Generate Authorization Code.

CSSM Review and Confirm

7. Copy the authorization code, or download as a file, and close this window.

CSSM SLR Auth Code

8. In Expressway CLI, enter command xcommand License Smart Reservation Install <copied auth token> (the SLR Auth token MUST have quotations trailing and leading). There is no need to enter the confirmation code to CSSM.

Expressway SLR Install

Expressway Registered with SLR

Smart Licensing Using Permanent License Reservation (PLR)

Introduced in Expressway x14.2, PLR licensing method is needed for air-gapped defence or military deployments, where Expressway cannot reach the Internet, but is suitable for any deployment that is using cloud CSSM.  Only cloud CSSM can have License Reservation, so if you have on-prem CSSM, you need to use Smart Licensing Tokens or engage the Cisco Licensing team to assist in creating a new Virtual Account in your cloud CSSM that can have License Reservation.  Each node in a cluster must have Smart License Reservation enabled and configured.

Before beginning, deployments that are clustered already must have no alarms. Refer to the Cisco Expressway Cluster creation documentation for further details regarding clustering.

Note: Permanent License Reservation (PLR) must be performed on each node in the Expressway cluster.

Tip: PLR cannot be used with Satellite CSSM and cannot be used in cloud CSSM using the same Virtual Account (VA) used for connecting with the satellite CSSM. If wanting to use PLR, Expressway Smart Licenses need to be transferred to a different or new VA in cloud CSSM.  Engage Cisco Licensing team for assistance, if needed.

Steps to enable PLR:

1. In CLI, run command xconfiguration license Smart reservationEnable: on.
2. In CLI, run command xcommand license Smart reservation request.
3. Copy the Reservation Request Code, and log into the Smart Account at Cisco Software Smart Licensing.
4. In the Virtual Account, click License Reservation and paste the Reservation Request Code.

CSSM License Reservation

Note: If License Reservation is not the Virtual Account, engage Cisco Licensing team.

5. On CSSM in the Smart License Reservation window, enter the Reservation request Code that was generated by the Expressway.

6. Select Expressway PLR.  If you do not see Expressway PLR here, you do not have PLR license.

7. Click generate authorization code.

8. Copy the authorization code.  

9. In Expressway CLI, run 'xcommand license smart reservation install <auth code>  (the PLR authorization code, unlike the SLR authorication code, does not need to be encompassed in quotations.

10. This is how the Smart Licensing page in Expressway looks once PRL is installed.

Returning Reserved Licenses

At some point, if you want or need to return your reserved licenses due to decommissioning one Expressway and spinning up another or some other reason, start by getting a return code from Expressway.

If needing to update reservation to add more licenses, see the Updating License section. There is no need to return the license and start over for updating.

1. In Expressway command line interface, run the command xcommand license Smart reservation return.

2. Copy the code (if you lose this code, engage Cisco Licensing to have the product instance removed).

Expressway CLI - License Return code

3. In the virtual account on Smart licensing, go to Product Instances > Actions menu for the Expressway in question, click Remove, and enter the Reservation Return Code copied from CLI.

CSSM - License Return

Updating Reserved Licenses

In the event that you need to add additional licenses to their SLR reservation, this can be done by first making the change in the cloud CSSM, then updating the Expressways themselves, and then finishing by entering the confirmation code from Expressway back into the cloud CSSM.

1. In CSSM, find Expressway reservation in Virtual Account > Product Instances.

2. Select Actions > Update Reservation Licenses.

CSSM Product Instance Update

3. Select Reserve a Specific License and enter new amounts.

4. Click Next > Generate Authorization Code.

CSSM Generate Auth code

5. Copy the new Authorization code.
6. Leave this window open to enter the Confirmation code that Expressway generates, but if it is closed, the confirmation code can be entered later.
7. In command line interface of Expressway, run the command xcommand license Smart reservation install <auth code> and copy the confirmation code.
8. Return to CSSM to Enter the confirmation code.  License reservation is not completed until this is done.

Expressway CLI - update

Tip: Do not forget to use the quotations around the Authorization code when entering it into Expressway command line interface.

9. If the reservation window in CSSM was closed, go to Product Instances and find the Expressway. 
10. Select Actions > Enter Confirmation Code and paste the code to complete the process.

CSSM Product Instance Update

Migrating from PAK Licenses (Option Keys) to Smart Licensing

If the deployment currently uses option keys but you want to upgrade to x14.1 or newer where only Smart is available, or you want to simply enable Smart now, unless the you are using a Satellite CSSM, the only option is to upgrade to x14.2.5 or newer (x14.0.11 and newer also has the fix).  This is due to Smart Licensing changing their root certificates in January, 2023. Refer to Cisco bug ID CSCwe09378

Note: Only registered Cisco users can access internal Cisco bug information.

If you try to register an Expressway running software before the fixed version, the registration fails, stating this error message:

"SSL Certificate Problem: Self Signed Certificate in Certificate chain"

If using a Satellite CSSM server, it is okay to enable Smart Licensing at any time, but make sure there are enough licenses on their Virtual Account to cover the number of registrations and RMS Licenses needed.

Once Expressways are upgraded to X14.1 or newer, the server operates with a 90-day grace period for licensing, unless previously set up to use Smart Licensing.

Troubleshooting

Registration issues

1. If endpoint registration is failing, check the event log to see if it is reporting any licensing issues.

Expressway Event Log - Registration Rejected

2. Unknown CA

Known issue before x14.2.5, refer to Cisco bug ID CSCwe09378.   If expressway is running x14.2.5 or newer but still failing to connect to Smart Licensing in the cloud due to Unknown CA, as seen in the packet capture below.  There is no way to add a different CA to the Expressway trust for Smart Licensing, so the only fix is to by pass the proxy server, or add https://smartreceiver.cisco.com  to the white list on the internet proxy.

Expressway Packet Capture

Certificate Packet details

Evaluation Mode

If Expressway fails to reach CSSM when using tokens, or if the deployment has Smart Licensing enabled, but not configured (common issue when upgrading from x14.0.x to x14.1 or newer), the expressway starts a 90 day count down. The deployment can function for 90 days in the evaluation mode. If the deployment is clustered, do not attempt to make any changes to the cluster after the 90 day period. This can cause irreversible problems with the database, resulting in needing to factory reset the node.

• Evaluation is only 90 days.  It counts down when server is not registered to Smart Licensing. Once registered, the clock stops, but does not reset. 
• Do not make any cluster configuration changes when evaluation mode has expired. This could break the cluster and could result in needing to rebuild the cluster (factory reset, rebuild).
• When Evaluation mode is expired, Cluster menu is greyed out.
• Xstatus shows how many days of evaluation mode are left.

xstatus evaluation mode

Diagnostic Logging

For additional troubleshooting, debugging can be enabled in the Expressway. Standard logging captures some issues. Diagnostic log bundle > loggingsnapshot the pertinent lines contain the phrase Smartlicenseagent.

Debugs can be enabled in Maintenance > Diagnostics > Advanced > Support Log Configuration

Expressway Support Log Configuration Debugs

Known Issues

Defects

1. "Unexpected software error was detected in smartlicenseget" and  "signal SIGABRT, Aborted". Refer to Cisco bug ID CSCwh22349

2. "Detail="Smart license communication error: The system failed to communicate with cloud-based Cisco Smart Software Manager or Cisco Smart Software Manager On-Prem".  Refer to Cisco bug ID CSCwe09378

Related Information

• Cisco Technical Support & Downloads