Cisco Smart Licensing for Secure Workload

Cisco Smart Licensing is a unified license management system that manages software licenses across Cisco products. If you have a Cisco Smart Licensing account, you can associate the Cisco Smart Licensing token with a Secure Workload license.

Secure Workload Licenses

  • Tetration workload protection—For workload protection. License information is available in the Total workload license usage table on the License Usage Information page.

  • Tetration endpoint visibility—For workload visibility in Secure Workload. The number of workloads and licenses that are consumed is available in the Total endpoint license usage table on the License Usage Information page.

  • Secure Workload PLR—Purchase the PLR license to use the license reservation PLR mode in Secure Workload.

Prerequisites for Secure Workload Smart Licensing

Table 1. Prerequisites for Secure Workload Smart Licensing

New Users

Existing Users

  1. Create a Smart Account on Cisco Software Central and purchase the Secure Workload entitlements. For more information, see Cisco Licensing.

  2. Go to Smart Software Manager and create a token to register the Secure Workload cluster.

  3. From Secure Workload, connect to the Cisco Smart Software Manager (CSSM) portal to register the cluster and sync all the licenses and compliance information. You can also reserve specific licenses.

  1. The purchased Secure Workload entitlements are saved in the Cisco Smart Software Manager under your Smart Account. To manage, go to Smart Software Manager.

  2. Upgrade to Secure Workload release 3.8.

  3. Go to Smart Software Manager and create a token to register the Secure Workload cluster.

  4. From your latest Secure Workload version, connect to the Cisco Smart Software Manager (CSSM) portal to register the cluster and sync all the licenses and compliance information. You can also reserve specific licenses.

For more information about creating a smart account, see:

Licensing options available in Secure Workload:

  • Connected mode—The entitlement and compliance information is communicated by Secure Workload with the Smart Software Manager on a periodic basis. If you make changes in the Smart Software Manager, you can refresh the authorization on Secure Workload so the changes immediately take effect. You can also wait for Secure Workload to communicate as scheduled. See Secure Workload Smart License Registration—CSSM Portal.

  • Air-gapped mode

    • Specific license reservation—Use the license reservation method to reserve licenses from your virtual smart account without accessing the Smart Software Manager or using Smart Software Manager On-Prem. You need to reserve the license first and then verify if Tetration Licenses are reflecting in your account. For more information, see License Reservation.

    • Smart Software Manager On-Prem—The Smart Software Manager On-Prem allows you to schedule synchronization or manually synchronize Smart License authorization with the Smart Software Manager. To register a Secure Workload cluster using Smart Software Manager On-Prem, see Secure Workload Smart License Registration—CSSM On-Premises.


Note

  • Smart licensing is applicable to the Secure Workload on-premises version and is not applicable to the SaaS version.

  • Smart licensing feature requires a Secure Workload cluster running on version 3.8 and later.

  • After the failover, you must register the latest primary cluster with Smart Software Manager or using Smart Software Manager On-Prem to synchronize the licenses.

  • For Federation clusters, individually register leaders and followers using smart licenses. However, the leader will not consume any endpoint or workload licenses.

  • The Secure Workload cluster enters a noncompliant state when the licenses are being overutilized or the licenses have expired. We recommended that you take action immediately to restore the cluster in a compliant state. In release 3.8, no features are affected due to the noncompliant state.

Secure Workload Smart License Registration—CSSM Portal

Before you begin

Ensure that:

  • Internet connectivity is available to register the Secure Workload cluster with the CSSM portal.

  • Smart Licensing account contains the required licenses you need.

  • The Outbound HTTP connection is configured. Verify that you are able to connect to internet using outbound HTTP.

Procedure

Step 1

Go to the Cisco Smart Software Manager (CSSM) portal and perform the following actions to generate a token for the virtual account to which you want to register the Secure Workload cluster.

  1. Login to the CSSM portal.

  2. Choose the correct virtual account and navigate to Smart Software Licensing > General and click New Token. Follow the onscreen instructions to create a token.

    Figure 1. Create a New Token on CSSM Portal
    Creating a New Token On CSSM Portal

  3. Copy the generated token.

Step 2

In Secure Workload, navigate to Manage > Service Settings > Licenses, and then click Register.

Step 3

Under the Smart Licenses tab, enter the generated token from the CSSM portal.

Figure 2. Secure Workload Smart License Registration Page
Secure Workload Smart License Registration Page

Step 4

(Optional) Enable Force Register to continue with the registration even if the cluster UUID is already registered with CSSM.

Step 5

Click Register.

The registration of Secure Workload with the CSSM portal is initiated. To view the updated status of the registration, refresh the License Usage Information page.

Secure Workload Smart License De-Registration

Procedure

Step 1

On the License Usage Information page, click Deregister.

Step 2

To confirm, click Yes.

After you refresh the License Usage Information page, the Licensing Status field displays the licensing status as Not Registered and the cluster enters the evaluation period.

License Reservation

The License reservation feature is used to deploy Smart Licensing in an air-gapped network. Before you begin, ensure that the required licenses for Secure Workload are available in your smart account.

  1. Generate reservation code from Secure Workload UI.

  2. Reserve Licenses in Cisco Smart Software Manager (CSSM). For detailed instructions, see How to Reserve Licenses.

  3. Verify that the reserved licenses are appearing in your smart account. To know the count of available licenses in your account, go to CSSM Smart software licensing portal and click Inventory > Licenses

The steps are explained in detail.

Generate Reservation Code

Procedure

Step 1

On the Secure Workload UI, navigate to Manage > Service Settings > Licenses.

The License Usage Information page is displayed.

Step 2

Click Register.

Step 3

Select the License Reservation tab, and click Yes to confirm.

A request code is generated by Secure Workload.

Step 4

Copy the generated request code.

Reserve Licenses in the CSSM licensing portal

Procedure

Step 1

Log into Cisco Smart Software Manager (CSSM) with your cisco.com account.

Step 2

In the Smart Software Manager section, click Manage licenses.

Step 3

Navigate to Inventory > Licenses.

Step 4

Click License Reservation, and then click Proceed to continue.

Figure 3. Licenses Page-CSSM Portal
Licenses Page-CSSM Portal

Step 5

Enter the request code generated by Secure Workload, and then click Next.

Figure 4. License Reservation-CSSM Portal
License Reservation-CSSM Portal

Step 6

Under Licenses to Reserve, choose either of the following and click Next.

  • Secure Workload PLR: No limitations on the number of workloads and endpoints that can be configured on the cluster.

  • Reserve a specific license: Based on the purchased workload and endpoint licenses, update the reserve count for Tetration Workload Protection and Tetration Endpoint Visibility license types.

On the CSSM portal, the reserved licenses can be viewed under the Licenses tab

Step 7

Review the license type selected and the quantity of licenses to reserve, and then click Generate Authorization Code.

Step 8

Click Copy to Clipboard.

Step 9

Click Close to exit the wizard. Go back to the Secure Workload UI Licensing page to enter the Authorization code.

.

Note

  • During the license reservation process, you can also select Continue Later. To resume the reservation process, on the License Usage Information page, click Continue Reservation.

  • If you decide to cancel the license reservation, click Cancel Reservation on the License Usage Information page and perform either of the following actions:

    • When you generate an authorization code, a license is typically reserved for use on CSSM. To return the license, enter the authorization code that is generated from CSSM. A return code is then generated by Secure Workload which needs to be entered in CSSM.

    • If you do not have a license in CSSM, choose the I do not have a license in CSSM tab.

Verify License Reservation

Verify if licenses are appearing in your smart account.

Procedure

Step 1

In Secure Workload, navigate to Manage > Service Settings > Licenses

Step 2

Enter the authorization code and click Install.

Figure 5. Secure Workload License Reservation Page
Secure Workload License Reservation Page

Update Specific License Reservation

Procedure

Step 1

On the CSSM portal, perform these steps:

  1. For the reserved specific license, from the Actions drop-down menu, choose Update Reserved Licenses.

  2. Choose Reserve a specific license and update the reserve count for the required Tetration Workload Protection and Tetration Endpoint Visibility license types.

  3. Click Next.

  4. Review the selected reservations and click Generate Authorization Code.

  5. Click Copy to Clipboard.

Step 2

In Secure Workload, perform these steps to update the reservation of specific licenses:

  1. On the License Usage Information page, click Update Reservation.

  2. Enter the authorization code from CSSM.

  3. Click Generate Confirmation Code.

  4. Copy the generated confirmation code and click Next.

  5. The generated confirmation code cannot be recovered later in Secure Workload, ensure that you copy the return code. Click the Copy icon.

Step 3

On the CSSM portal, perform these steps to complete the reservation process:

  1. Under Product Instances, choose the license to be reserved and click Actions.

  2. Choose Enter Confirmation Code.

  3. Enter the confirmation code and click OK.

Step 4

In Secure Workload, click Finish to exit the wizard.

Refresh the License Usage Information page to view the updated license reservation details.

Return Specific Licenses Reservation

Procedure

Step 1

In Secure Workload, on the License Usage Information page, click Deregister.

Step 2

To generate a return code, click Generate return code.

Step 3

Click the Copy icon to copy the return code and click Next. Ensure to copy the generated return code as you cannot recover the code later.

Step 4

To complete the de-registration process, navigate to the CSSM portal and perform these steps:

  1. Under Product Instances, choose the license to deregister and click Actions.

  2. Choose Remove.

  3. Enter the return code and click Remove Reservation.

Step 5

In Secure Workload, click Finish to exit the wizard.

The reserved licenses are returned to the smart account. Secure Workload enters the evaluation period and the reserved licenses are classified to non-registered compliance state.

Secure Workload Smart License Registration—CSSM On-Premises

The Smart Software Manager On-Premises allow you to schedule synchronization of licenses or provides an option to manually synchronize Smart License authorizations with the Smart Software Manager portal. You can use CSSM on-premises to register Secure Workload in air-gapped networks or if you prefer to manage smart licenses through a single connection from your network.

Procedure

Step 1

Setup Smart Software Manager on-premises. For more information, see Cisco Software Central.

Step 2

Log in to the Smart Software Manager On-prem and select the virtual account. Under the General tab, click New Token. Follow the onscreen instructions to create a token.

Figure 6. On-Premises License Workspace
Smart Licensing On-Prem License Workspace

Step 3

In Secure Workload, navigate to Manage > Service Settings > Licenses, and then click Register.

Step 4

Under the Smart Licenses tab, enter the generated token from the Smart Software Manager On-prem.

Step 5

Under the Smart Licenses tab, in the Smart Transport Registration URL field, enter the Smart Transport Registration URL of your Smart Software Manager On-Prem.

Step 6

(Optional) Enable Force Register to continue with the registration even if the cluster UUID is already registered with CSSM.

Step 7

Click Register.

The registration of Secure Workload with the CSSM on-premises is initiated. To view the updated status of the registration, refresh the License Usage Information page. Synchronize Smart Software Manager On-Prem to the Smart Software Manager portal after assigning the licenses.

Synchronize Smart Licenses

The license and compliance information is synchronized with the Smart Software Manager portal every 24 hours. However, if the cluster is out of compliance and licenses are renewed on CSSM, you can manually update the licenses by connecting to the CSSM portal directly or through the Smart Software Manager On-prem through these steps:

Procedure

Step 1

On the License Usage Information page, click Renew Operations > Renew Authorization.

Step 2

To confirm, click Yes.

After you refresh the License Usage Information page, you can view the updated licenses along with the date and time of the last successful synchronization with CSSM.