Configure Licensing with HyperFlex Data Platform

Smart Licensing and HyperFlex

Overview

Cisco Smart Software Licensing (Smart Licensing) is an intelligent software license management system that automates time-consuming, manual licensing tasks, such as procuring, deploying, and managing licenses across your entire organization. It provides visibility into your license ownership and consumption so you know what you own and how you are using it.

Smart Licensing introduces company-wide license pooling. Server-based licenses, or smart licenses, are not node-locked to devices so they can be used on any compatible device owned by your company. Using virtual accounts to organize licenses and product instances for your company into logical entities, for example, by business unit, product type, or IT group, makes it easy to transfer devices and licenses across virtual accounts.

The Smart Licensing feature integrates with Cisco HyperFlex and is automatically enabled as soon as you create an HX storage cluster. For your HX storage cluster to start reporting license consumption, you must register it with Cisco Smart Software Manager (SSM) through your Cisco Smart Account. A Smart Account is a cloud-based repository that provides full visibility and access control to Cisco software licenses and product instances across your company. Registration is valid for one year.

Registration enables HyperFlex to be identified to a Smart Account and allows license usage to be reported to Cisco Smart Software Manager or Smart Software Manager satellite. After registration, HyperFlex reports license usage to Cisco Smart Software Manager or Smart Software Manager satellite with the current license status. See the following License Status section for details.


Note
You will need to open ports 80 and 443 to tools.cisco.com for all HyperFlex management IPs in order for this to work.

After you register your HX storage cluster, communication messages are signed by a certificate used to identify HyperFlex to Cisco Smart Software Manager or Smart Software Manager satellite. HyperFlex automatically sends the following requests:

  • A renew registration request every six months. In case the automatic registration renewal does not occur, use the stcli license renew id command to manually renew.

  • A renew authorization request every 30 days is required by Smart Licensing. In case the automatic authorization renewal does not occur, use the stcli license renew auth command to manually renew. You need to manually renew Smart Licensing authorization only if connectivity is not available when renewal is attempted or your renewal time is outside of your connectivity window.

  • A renew authorization request is also sent to Cisco Smart Software Manager or Smart Software Manager satellite whenever license consumption changes. This authorization is valid for 90 days. If HyperFlex doesn't contact Cisco Smart Software Manager or Smart Software Manager satellite for 90 days to renew its authorization, licenses consumed by HyperFlex are reclaimed and put back in the pool.

License Status

Registration Status

Description

Verify Status

System Functionality

Evaluation Mode

Smart Licensing is enabled but your HX storage cluster is not registered to Cisco Smart Software Manager or Smart Software Manager satellite and in a 90-day evaluation period.

To verify the status or check the remaining time left in the evaluation period, run

#stcli license show all
Result:
Mode = Eval & Remaining 
period(Number of 
Days:Hours:Minutes)

No impact on features or functionality.

Evaluation Expired

Smart Licensing is enabled but your HX storage cluster is not registered to Cisco Smart Software Manager or Smart Software Manager satellite. Your license is in the Initial Unidentified state and not considered out of compliance.

To verify the status, run #stcli license show all

Result:
Mode = Evaluation Expired

No impact on features or functionality.

  • Generates syslog message.

  • Generates an Evaluation Expired alarm in the HX Connect UI.

In Compliance

Smart Licensing is enabled and your HX storage cluster is registered to Cisco Smart Software Manager or Smart Software Manager satellite. You are consuming less licenses than you own.

—

—

HyperFlex Release 5.0(2a) and later Out of Compliance

-

-

See the License Compliance and Feature Functionality section for the impact to features and functionality.

HyperFlex Release 5.0(1b) and earlier Out of Compliance

You are consuming more licenses than you own.

Important

 
Cisco will never interfere with or shutdown a customer network when a device is out of compliance.

  • Out of Compliance at Initial Registration state—Smart Licensing is enabled and your HX storage cluster is registered to Cisco Smart Software Manager or Smart Software Manager Satellite but after initial registration you do not have enough licenses.

  • Out of Compliance after Initial state or after being in-compliance for some period— Smart Licensing is enabled and your HX storage cluster is registered to Cisco Smart Software Manager or Smart Software Manager Satellite but you no longer have enough licenses.

To verify the status, run #stcli license show all. 

Result:
Mode = Out of Compliance

No impact on features or functionality.

  • Generates syslog message.

  • Generates an Out of Compliance alarm in the HX Connect UI at cluster level.

Note

 
The Out of Compliance state breaches the intellectual property EULA and the license must be purchased/renewed in order to continue receiving support.

Authorization Expired

Smart Licensing is enabled and your HX storage cluster is registered to Cisco Smart Software Manager or Smart Software Manager satellite but has not communicated to Cisco Smart Software Manager or Smart Software Manager satellite for more than 90 days.

To verify the status, run #stcli license show status. 

Result:
Mode = Authorization Expired

No impact on features or functionality.

  • Generates syslog message.

  • No event or alarm on HX Connect.

  • Cisco Smart Software Manager portal displays flags and notifications.

Export Control Flag Set to "Not Allowed"

Smart Licensing is enabled and your HX storage cluster is registered to Cisco Smart Software Manager or Smart Software Manager satellite but cannot register to use Export Control.

—

Behavior is mostly controlled by the Cisco Smart Software Manager server.

Note

 
This status is applicable only if the HX storage cluster contains restricted functionality.

ID Certificate Expired

Smart Licensing is enabled and your HX storage cluster is registered to Cisco Smart Software Manager or Smart Software Manager satellite but your ID certificate has not renewed for more than six months. Your license is in the Subsequent Unidentified state and is considered out of compliance.

To verify the status, run

#stcli license show status
Result:
Mode: ID Certificate Expired

To clear all conditions and return to In Compliance status, run the following command: 

#stcli license renew
 <auth>/<id>

  • Generates syslog message.

  • No event or alarm on HX Connect.

  • Cisco Smart Software Manager portal displays flags and notifications.

License Compliance and Feature Functionality

Beginning with Cisco HXDP Release 5.0(2a), full feature functionality and configuration changes require a valid Cisco HyperFlex Software License. HX Connect users with expired or insufficient licenses at the end of the evaluation or the grace period after the license compliance date, view a prominent countdown banner that alerts the user to the license compliance need and provides a link to the license renewal page until the license expiration is remedied.

In the event a license passes both the license expiration date and the grace period countdown, the current configurations will operate as expected with limited information. Renewing the license allows a user to resume full feature functionality, and make configuration changes. For details and examples of the banners, see the License Compliance and Feature Functionality section of the Cisco HyperFlex Systems Ordering and Licensing Guide.

To review the Cisco End User Agreement (Cisco EULA), see https://www.cisco.com/c/en/us/about/legal/cloud-and-software/end_user_license_agreement.html

License Management for Connected Environments

To manage your licenses for connected environments, proceed as follows:

Registering a Cluster with Smart Licensing

Smart Licensing automatically integrates with your HX storage cluster and is enabled by default. You need not install Smart Licensing. Your HX storage cluster is unregistered with Smart Licensing and in a 90-day EVAL MODE. Within the 90 days, you need to register your HX storage cluster to use full functionality.


Attention

Before registering the HyperFlex cluster with Smart Software Manager satellite, ensure that proxy is not configured. If proxy is configured, remove proxy before registering the cluster with Smart Software Manager satellite.

Before you begin

  • Smart Licensing was introduced in Cisco HX Release 2.5. It is recommended that you confirm your cluster is running a HX 4.0 release and later.

  • Before you can begin using Smart Licensing, you need to have a Cisco Smart Account. You can create (or select) a Smart Account while placing an order, or create a Smart Account outside of placing an order and add new or existing licenses over time.

    To create a Smart Account, see Cisco Software Central > Request a Smart Account (https://webapps.cisco.com/software/company/smartaccounts/home?route=module/accountcreation).

You can register the HX storage cluster with Cisco Smart Software Manager (SSM) in one of the following ways:

Registering a Cluster with Smart Software Licensing through HX Connect

Cisco recommends registration of cluster with Smart Software Licensing through HX Connect.

Before you begin

  • You must have a product instance registration token. If you do not have a token, you can create a token in Cisco Smart Software manager. For more information on how to create a product instance registration token, see Creating a Registration Token.

Procedure

Step 1

Log into HX Connect.

Step 2

In the Dashboard page, click Cluster License not registered.

Alternatively, you can do the registration by clicking the Register Now link in the System Information page.

Step 3

In the Smart Software Licensing Product Registration dialog box, enter the registration token in the Product Instance Registration Token field.

For more information on how to create a product instance registration token, see Creating a Registration Token.

Step 4

Click Register.

On successful registration, the license type and license status appears in the System Information page.

  • License Type—Displays Evaluation, Edge, or Data Centre as the HX storage cluster license type.

  • License Status—Displays one of the following as the HX storage cluster license status:

    • In compliance

    • License expires in <n> days. Cluster not registered - Register Now. (This status appears only for Evaluation type license)

    • License expired. Cluster not registered - Register Now. (This status appears only for Evaluation type license)

    • Out of compliance - Insufficient license

    • Authentication expired—This status appears when HX is unable to communicate with Cisco Smart Software Manager or Smart Software Manager satellite for more than 90 days.

Creating a Registration Token

Registration Token is used to register and consume a product for smart licensing. You must create a token to register the product and add the product instance to a specified virtual account.

Procedure

Step 1

Log into the software manager depending on which release you are using.

Cisco Smart Software Manager

Navigate to Cisco Software Central (https://software.cisco.com/) and log in to your Smart Account. In the License pane, click Smart Software Licensing. Click Inventory.

Smart Software Manager satellite

Navigate to https://<IP address of the satellite>:8443, and log in to the satellite using admin credentials.

Step 2

From the virtual account where you want to register your HX storage cluster, click General, and then click New Token.

Step 3

In the Create Registration Token dialog box, do the following, and then click Create Token:

  • Add a short Description for the token.

  • Enter the number of days you want the token to be active and available to use on other products. Maximum = 365 days

  • Check Allow export-controlled functionality on the products registered with this token.

Step 4

From the New ID Token row, click the Actions drop-down list, and click Copy.

Registering a Cluster with Smart Software Licensing through a Controller VM

This section covers the alternate method for registering a cluster with Smart Software Licensing.

Procedure

Step 1

Log into a controller VM.

Step 2

Confirm that your HX storage cluster is in Smart Licensing mode.

# stcli license show status

Feedback should show Smart Licensing is ENABLED, Status: UNREGISTERED, and the amount of time left during the 90-day evaluation period (in days, hours, minutes, and seconds). The Smart Licensing evaluation period starts when the HX storage cluster begins using the licensing feature and is not renewable. When the evaluation period expires, the Smart Agent sends a notification.

Step 3

Register your HX storage cluster, where idtoken-string is the New ID Token from Cisco Smart Software Manager or Smart Software Manager satellite. 

# stcli license register --idtoken idtoken-string

Step 4

Confirm that your HX storage cluster is registered.

# stcli license show summary

Alternatively, you can confirm that your HX storage cluster is registered in Cisco Smart Software Manager > Inventory > Product Instances.

Example:
root@SpringpathController8OIW1HJOKW:~# stcli license show summary
 
Smart Licensing is ENABLED
 
Registration:
  Status: REGISTERED
  Smart Account: Corp X HyperFlex License 
  Virtual Account: west-region
  Last Renewal Attempt: None
  Next Renewal Attempt: Aug 1 17:47:06 2017 PDT
 
License Authorization:
  Status: AUTHORIZED
  Last Communication Attempt: SUCCEEDED
  Next Communication Attempt: Mar 4 16:47:11 2017 PST
 
License Usage:
  License                   Entitlement Tag                                                                Count  Status
  ------------------------------------------------------------------------------------------------------------------------------
  Cisco Vendor String XYZ   regid.2016-11.com.cisco.HX-SP-DP-S001,1.0_1c06ca12-18f2-47bd-bcea-518ab1fd4520 3      InCompliance

Deregistering a Cluster from Smart Licensing

You deregister an HX storage cluster when you want to release the licenses back into the pool to be used by another HX storage cluster or to remove Cisco Smart Software Manager registration; for example, if you want to decommission a cluster. After the HX storage cluster is deregistered, HyperFlex runs in evaluation mode, if any evaluation period remains. If not, HyperFlex is in evaluation expired status. Deregistering a cluster that is in an expired evaluation state, does not impact the cluster production data.

The Smart Agent contacts the licensing cloud and unregisters itself. All Smart Licensing entitlements and certificates on the platform are removed. All certificates and registration information on the trusted store are removed. The Smart Agent can unregister even if it is unable to communicate with Cisco to deregister. If you need to use Smart Licensing again, reregister your HX storage cluster. See Registering a Cluster with Smart Software Licensing through a Controller VM.

Before you begin

  • Verify that your HX storage cluster is registered with Smart Licensing using the following command:

    # stcli license show status

Procedure

Step 1

Log into a controller VM.

Step 2

Deregister your HX storage cluster from Smart Licensing.

# stcli license deregister

Step 3

Confirm that your HX storage cluster is deregistered.

# stcli license show summary

Renewing Smart Licensing Authorization

Before you begin

  • Verify that your HX storage cluster is registered with Smart Licensing using the following command:

    # stcli license show status

Procedure

Step 1

Log into a controller VM.

Step 2

Renew the Smart Licensing authorization using the following commands:

# stcli license renew id
# stcli license renew auth

Step 3

Confirm that the HX storage cluster is renewed and authorized.

# stcli license show summary

License Management for Disconnected Environments

To manage your license for disconnected environments, proceed as follows:

Smart Licensing and Smart Software Manager Satellite

If you would prefer not to, or are not permitted to manage your installed base using an Internet connection, you can install Smart Software Manager Satellite on-premises to manage your licenses locally using a subset of Cisco Smart Software Manager. Download Smart Software Manager satellite.

To configure Smart Software Manager satellite for HyperFlex, from the HX Data Platform CLI, run the following command:
stcli services sch set --portal-url http://<satellite-host>
/Transportgateway/services/DeviceRequestHandler --email 
<user-email-address>

After Smart Software Manager satellite registers with Cisco Smart Software Manager and is fully functional, it needs to synchronize with Cisco Smart Software Manager every 30 days. There are two options for syncing:

  • On-demand or scheduled synchronization when your network is connected.

  • Manual synchronization by downloading and then uploading the license file.


Note
Once the HX cluster is configured with a Smart Satellite server, the token can no longer be generated from the Smart Licensing registration from the Smart portal, as it needs to be generated from the Smart Satellite Server UI.

Note
Smart Software Manager Satellite on-premises is not supported with Hyper-V.

Specific License Reservation and HyperFlex

Cisco Specific License Reservation (SLR) is a new software license management system that allows customers to use their devices in a disconnected mode, specifically for environments without external network connectivity (air-gapped). SLR also provides the following additional benefits:

  • Automates time-consuming licensing tasks

  • Allows tracking of the status of license and software usage trends

  • Simplifies core purchasing, management, and reporting functions

SLR allows customers to reserve licenses from their virtual account, tie them to a devices UDI, and then use their device with these licenses in a disconnected mode. It also allows customers to operate normally without ongoing communication with either the Cisco Smart Software Manager (CSSM) or a Smart Software Satellite (on-site collector).

HyperFlex SLR enabled PIDs

Only the following HyperFlex PIDs are eligible for use under the SLR mode:

Table 1. Cisco HyperFlex Data Platform (HXDP) Software SKUs for Disconnected and Air-gapped Deployments

HXDP SKU

Description

Specific License Registration

HXDP-S-SLR

Cisco HyperFlex Data Platform Standard Edition Specific License Registration Subscription

HXDP-P-SLR

Cisco HyperFlex Data Platform Enterprise Edition Specific License Registration Subscription

HXDP-E-SLR

Cisco HyperFlex Data Platform Edge Edition Specific License Registration Subscription

Installing Specific License Reservation (SLR) Licenses

This procedure explains how to install an SLR license, return an SLR license (for re-use by CSSM), or cancel an SLR license request.

The SLR installation process is very similar to the regular Smart License installation process. Since there is no communication between the cluster and the Smart account, a manual process must be used to carry out the same conversation that previously existed with the HTTP connection.

These conversations start from the Cisco hardware cluster where request codes are generated. The request code includes some basic cluster identification information. The request then gets carried to the Smart account in the Cisco portal to request an authorization code based on the request code. Once Cisco gets the authorization code, which includes both license identification and entitlement information, the authorization code is carried back to the cluster and installation can begin. Once the installation is complete, the license is fully activated on the cluster.

The enable/disable command is for getting to reservation mode. This is the default mode in the current registration feature. You have to specifically enable reservation mode to configure all of the reservations inside of the command. If you already have a license registered with CSSM, you should unregister it so that it can be recycled. Once you get the authorization code back from CSSM, you can use the reservation install command to install the reservation code. At some point, if you want to destroy the cluster or just return the license back to CSSM so that it can be re-used, you can use the reservation return command to generate a return code that can be deposited back.

The following steps describe how to install, return and cancel your SLR license.

Procedure

Step 1

Enter the command stcli license reservation enable on the HX node to enable the reservation mode.

Entering this command switches the configuration mode into reservation mode. No license status is changed.

On the left side of the following screen, you can view the status for a typical cluster with a regular registration. In reservation mode, you can see the difference in that status. For a typical device, if you look at the reservation status, it shows as registered. The license authorization status will be authorized. If you have an individual license, it will tell you which license is in compliance.

On the right side, you can see the system is in the unregistered state and using the evaluation license.

Step 2

Enter the command stcli license reservation request to make a reservation request.

The license request code is shown in the blue box in the following screen.

Once you start a reservation request, you can see that the registration status is RESERVATION IN PROGRESS (as shown in the red box). Once you have the Request Code, you can go to CSSM to convert it into an authorization code.

Step 3

Log into CSSM (located at https;//software.cisco.com).

Step 4

In the License section, click on the Smart Software Licensing link.

This takes you to the Smart Software Licensing page.

Step 5

Under the Licenses tab, click License Reservation.

Step 6

Complete the four-step SLR process to Enter your Request Code, Select Licenses, Review and confirm the Authorization Code, then download the Authorization Code.

  1. Enter the Request Code – Enter the Reservation Request Code that was just generated on the cluster.

  2. Select Licenses – This screen tells you what the license is for and provides Product Instance Details such as the Product Type, UDI PID, UDI Serial Number and UDI VID. Verify the information provided, then select the checkbox to Reserve a specific license.

    For the Specific License Reservation you have selected, enter the Quantity to Reserve.

  3. Review and Confirm – Review and confirm the product instance details and license to reserve, then click the Generate Authorization Code button at the bottom of the screen.

  4. Authorization Code – View the authorization code, which you can use on the device side, then click the Download as File button at the bottom of the screen.

Step 7

Go to the Product Instances tab to view the license you just reserved, which is located in the row corresponding to the class and serial number of your reservation. Click the link in this row (shown in the red box).

A dialog box appears showing a description of the license:

From this page, you can view general details of the license. You can also download the reservation authorization code (highlighted in red above) in case you lose it in any given instance. You can always return to this page to retrieve it again.

You can then go back to the Licenses tab to view the current license consumption.

Step 8

Enter the command stcli license reservation install <enter authorization code> on the HX node followed by your authorization code.

Once the reservation is successful, you can view the status, which shows as REGISTERED – SPECIFIC LICENSE RESERVATION. The authorization also shows that it is AUTHORIZED – RESERVED.

You can also enter the command stcli license show reservation on the HX node to show the SLR reservation. The response shows that SLR has been installed.

Canceling Specific License Reservation (SLR) Licenses

This procedure explains how to cancel an SLR license request.

Procedure

Step 1

To cancel a reservation request that you started (before going to CSSM to get an authorization code), use the stcli license reservation cancel command.

Step 2

Verify that the reservation request was canceled by using the stcli license show reservation command.

After entering this command, you should see that the status has returned to unregistered.

Returning Specific License Reservation (SLR) Licenses

Now that the license on the cluster is fully active, at a later time, you can destroy the cluster and return the license to CSSM so it can be re-used for another cluster. The following steps describe how to return your SLR license.

Procedure

Step 1

Enter the command stcli license reservation return. A return code is then generated that you can use in CSSM. If you look at the status, the license reverts back to being an unregistered evaluation license just as it was before you registered it.

Step 2

Go back to CSSM to return the license back to the pool. Go back to the Product Instances tab, use the Actions menu, then click Remove.

The Remove Product Instance dialog box appears, which allows you to enter the return code. Enter the return code, then click Remove Product Instance.

In the Product Instances tab, you can see that the SLR license you previously registered is now gone. You can see that there are now only two in use, whereas there used to be three. At this point the license has been successfully returned.

Troubleshooting Specific License Reservation (SLR)

This section describes common error messages that may appear as you configure and use Specific License Reservation (SLR). It also provides recommendations on how to troubleshoot if applicable.

Two common error messages that may appear are as follows

  • During configuration, if you issue a reservation request command before you enable the reservation mode, an error message appears indicating that "License Reservation is not enabled". Or, if you request to cancel an operation that you did not request, a message appears indicating that "No reservation process is pending". The following image shows these errors:

  • During run-time when the license status changes, initial registration fails with a communication send error. This message typically appears when entering the show status command. The library does not propagate the error to the top but you can find the actual reason by using the logs.

Procedure

Step 1

Issue a grep command and view the SL column to identify errors and all other SL-related messages in the log. For example, the following image shows that a proxy is being used and that the proxy connection failed. This gives a good indication that the proxy configuration for your license server is not correct.

Step 2

To resolve this, use the stcli services sch show command to see the proxy set-up, correct any errors, then try again.

Step 3

You can also issue a grep command on "CISCO-SMART-LIC" to check the Smart License syslog messages which are generated during the transition.

Facilitating Controller VM Root Access for Air-Gapped Clusters

Starting with Cisco HX Release 5.0(2b), for HX nodes licensed with Subscription License Reservations or Permanent License Reservations, you now have the option to enable a persistent advance shell for troubleshooting, after a one-time Consent Token authentication with TAC. This enables access to root on-demand thereafter without needing to go through Consent Token (CT) challenge-response workflows with TAC repeatedly.


Note

To enable this feature, you must have a license reservation with either SLR or PLR.

Note

Once you enable this feature, you cannot invalidate the Consent Token.

Note

Once a cluster is enabled with persistent root shell, all expanded nodes are enabled with persistent root automatically.

To facilitate Controller VM Root Access for Air-Gapped Clusters, proceed as follows:

Procedure

Step 1

From hxshell, issue an su root command. A warning message appears indicating the following:

WARNING: By accepting this support session, you give your consent and hereby authorize Cisco to have privileged access to the supported Cisco device for the purpose of providing technical support. At the conclusion of this session you must exit root shell from all the open ssh sessions of all the controller vms of the cluster and invalidate the consent token in order to terminate Cisco’s access and close the privileged access portal. You are hereby advised that failure to do so may create a vulnerability in your product.

Step 2

Click Y to Accept. A message appears indicating that "Consent token is needed to access root shell !! with 4 options:"

1. Generate Challenge For root Shell Access

2. Accept Response

3. Exit

4. Generate Challenge for Persistent Root Shell Access

Step 3

Enter CLI Option 4. A Warning message appears indicating:

WARNING: Installation of this consent token will enable persistent root shell access on this device. You are hereby advised that this action may create a vulnerability in your product. Accept (N/y):

Step 4

Click y to Accept.

Step 5

Copy the Challenge String provided.

Step 6

Contact TAC and provide the Challenge String and obtain the Consent Token.

Step 7

If starting a new SSH session, re-enter su root. Enter CLI Option 2.

A message appears indicating a Starting background timer of 30 mins. Please input the response when you are ready ....

Step 8

Enter the Consent Token.

When done, a message appears indicating the status of the Response Signature and Response processed. Next, a message appears requesting "Do you want to sync the consent token to other controller VMs in the cluster (y/n)?

Step 9

Enter "y" to sync the consent token with all other nodes in the cluster.

Note

 

Sync the consent token with all other nodes in the cluster. You do not need to complete these procedures on multiple nodes.

EXAMPLE: