High Security (HSEC) License Support

The HSEC license removes the curtailment enforced by the U.S. government export restrictions on the encrypted tunnel count and encrypted throughput. Based on export compliance requirement, customers need to purchase an HSEC license to be provided with unlimited encrypted throughput, and unlimited number of crypto resources like encrypted tunnels and sessions.

HSEC implementation on the 5921 restricts encrypted throughput to 250Mbps for non-HSEC licenses. Existing licenses with a throughput level greater than 250Mbps, will be HSEC licenses from this point forward. This requires new mapping between some of the PIDs.

Permanent License Reservation (PLR)

Note : PLR support began with the 15.6(3)M1 release, with Unlimited throughput level. Starting with15.9(3)M, support was added for different throughput levels.

Note : The sale of PLR licenses is limited to government defense and intelligence agency customers.

The PLR licensing feature allows the use of reserved licenses in a disconnected mode. You can optionally request permanent licenses for each 5921. Permanent licenses do not require periodic access to the License Authority. PLR is supported on the universalk9 and universalk9_npe images.

You can have a pool of PLR entitlements from which to draw from in the virtual account on the Cisco Smart Software Manager (CSSM). When the CSSM validates the reservation request code generated by a product instance doing Universal PLR, it will allocate one of these entitlements to the product instance and generate a string (authorization code) to enter (install) on that product instance.

When you install the authorization code, generated by the CSSM, on the product instance any entitlement request made by the product to the Smart Agent will be authorized.

Licensing caveats are as follows:

■Smart license 500Mbps is an HSEC license, therefore, it will not be supported in Evaluation mode

■For non-HSEC licenses the crypto resource restrictions are:

–Encrypted tunnels - 225

–Encrypted sessions - 1000

■Crypto resources reserve and free are handled using common PI implementation CERM.

Additional Throughput Level - C5921

The 15.9(3)M2 release supports a new PLR throughput level of 500 Mbps. See PLR Entitlement.

PLR licensing feature allows using the reserved licenses in a disconnected mode. There are two types of reservation available, specific reservation and Universal reservation. At this time, PLR supports only Universal reservation. To enhance existing PLR feature the request is to provide support of different throughput levels, where as it support only unlimited/max throughput in current implementation. Base PLR support available only with universalk9 and univeralk9_npe images.

In Universal PLR, once license smart reservation cli is configured and license smart reservation install has been successful, the below unlimited throughput entitlement will be activated based on throughput configured, before generating reservation request code.

Table 1 PLR Entitlement

Command Line Interface

The following lists some of the CLIs that pertain to this feature.

Enable/disable license reservation feature:

Configure platform plr-throughput level with appropriate throughput before generating request code:

Prints the “Reservation Request Code” that must be pasted into the portal to start the reservation process:

Enters the “Reservation Authorization Code” into the device to complete the process.

Prints the “Reservation Return Code” that must be pasted into the portal to return licenses and delete product instance:

Note : Uses the authorization code previously installed.

Prints the “Reservation Return Code” that must be pasted into the portal to return licenses and delete product instance.

Note : Uses the authorization code from the command line.

Cancels a reservation that is in progress and allows entitlement changes.

In order to switch between license throughputs, the old reservation should be returned if it is already installed:

Note : Take the return code and paste it into the CSSM portal to remove the license.

To switch between license throughputs, when license is not installed but a request code is generated, the old reservation code should be canceled and then generate a new one:

Cisco IOS Release 15.9(3)M

The following sections list caveats for Cisco IOS Release 15.9(3)M:

Open Caveats

■ CSCvu99656

In DLEP, any restart of the routing protocol process is not updating the metrics.

Symptoms : In a DLEP environment, if there is an OSPFv3 or eigrp protocol reset between two routers, it is not updating the metrics with DLEP peers.

Workaround : None

■ CSCvv15904

On the C5921, a crash is seen when setting CNS id using TCL script.

Workaround : None

Resolved Caveats

None