Scope of this document

This document provides information on licensing for Cisco C9350, Cisco C9550, and C9610 Series Smart Switches.

Cisco C9350 Series Smart Switches and Cisco C9550 Series Smart Switches support Cisco Networking Subscription licenses as well as Meraki Classic Licensing, while Cisco C9610 Series Smart Switches support only Cisco Networking Subscription licenses.

If you opted for Cisco Networking Subscription, refer to this document to learn how to manage your licenses.

If you chose Classic Meraki licensing, refer to Meraki Licensing.

Before you begin

Before you begin your Cisco C9000 Smart Switches license management, ensure:

Cisco Networking Subscription

Cisco C9000 Series Smart Switches support Cisco Networking Subscription. This unified, subscription-based licensing model simplifies the purchase, deployment, and management of Cisco networking software, hardware, and services.

This subscription-based licensing streamlines the management of Cisco software, hardware, services, and platforms. It also provides unified product support and RMA support.

  • Cisco Switching OS license: This is a perpetual software license that grants you the right to use some platform-specific features in the OS indefinitely without an expiration date. This license is available in two tiers: Essentials and Advantage.
  • Cisco Networking Subscription license: Cisco Networking Subscription is a licensing model available for Cisco C9000 Series Smart Switches, with a minimum term length of 3 years. It includes your choice of subscription-based licenses, available in two tiers: Essentials and Advantage. To view the full list of features, refer to the Cisco Switching Licensing Feature Matrix.

Benefits

This licensing model allows you to:

  • Set up your network on-premises or in the cloud.
  • Add or upgrade licenses mid-term seamlessly.
  • Manage a single, per-device license with flexible management options such as on-premises management with Cisco Smart Software Manager (Cisco SSM), or cloud management using the Meraki dashboard.
  • Avail use of product support for both software and the associated hardware, along with RMA upgrade service for hardware replacement.

License tiers

Cisco C9000 Series Smart Switches support the two tiers listed here, which unlock different platform features and capabilities.

  • Switching Essentials: Provides fundamental features and functionalities to manage a network.
  • Switching Advantage: Enables management of a network with all essential features, plus advanced capabilities such as Cloud-delivered security and Cisco AI Network Analytics.
Supported license tiers for Cisco C9350 Series Smart Switches - OS licenses (seen only on device)

Cisco Switching OS license

License tag

Cisco C9350 Switching IOS-XE Essentials

C9350-OS-ESS

Cisco C9350 Switching IOS-XE Advantage

C9350-OS-ADV
Supported license tiers for Cisco C9550 Series Smart Switches - OS licenses (seen only on device)

Cisco Switching OS license

License tag

Cisco C9550 Switching IOS-XE Advantage

C9550-OS-ADV
Supported license tiers for Cisco C9610 Series Smart Switches - OS licenses (seen only on device)

Cisco Switching OS license

License tag

Cisco C9610 Switching IOS-XE Advantage

C9610-OS-ADV
Supported license tiers for Cisco C9350 Series Smart Switches - Networking Subscription licenses

License tier

License tag

Cisco Switching Essentials License Access Tier 1, Large (48 port)

LIC-CS-AC1-L-E

Cisco Switching Essentials License Access Tier 1, Medium (up to 24 port)

LIC-CS-AC1-M-E

Cisco Switching Advantage License Access Tier 1, Large (48 port)

LIC-CS-AC1-L-A

Cisco Switching Advantage License Access Tier 1, Medium (up to 24 port)

LIC-CS-AC1-M-A
Supported license tiers for Cisco C9550 Series Smart Switches - Cisco Networking Subscription licenses

License tier

License tag

Cisco Switching Advantage Core Fixed License, Medium

LIC-CS-CO-M-A

Cisco Switching Advantage Core Fixed License, Large

LIC-CS-CO-L-A

Cisco Switching Advantage Core Fixed License, XL

LIC-CS-CO-XL-A
Supported license tiers for Cisco C9610 Series Smart Switches - Cisco Networking Subscription licenses

License tier

License tag

Cisco Switching Advantage License Core Modular

LIC-CS-CO-MO-A

To view the feature matrix for the license tiers, see Cisco Switching Licensing Feature Matrix.

Cisco Switching OS licenses

Cisco Switching OS license is a perpetual license that allows you to use networking features contained within a device’s operating system. In Cisco IOS XE 17.18.1 release, the switches are set to Cisco Switching OS Advantage boot level before shipping.

  • Cisco C9350 Series Smart Switches support both Switching Essentials and Switching Advantage tiers. If Cisco Switching OS Essentials license is ordered, the boot level license must be modified to Cisco Switching OS Essentials by using the license boot level essentials command in the config terminal mode. Remember to exit configuration mode, save the configuration, and reload the device to apply the Switching OS Essentials tier.
  • Cisco C9550 Series Smart Switches and Cisco C9610 Series Smart Switches support only Switching Advantage tier. You can directly boot the switch and proceed to the next step. Boot level modification is not required.
 Remember

If you modify the license boot level for your Cisco C9350 Series Smart Switch, it is recommended that you report this change to Cisco SSM via your preferred method of reporting.

View Cisco Switching OS license details

To view the details of your Cisco Switching OS license, run the show commands described in this section in the privileged EXEC mode.

 Important

This task does not apply to Meraki switches or subscription licenses.

Step 1

To view the license type, license tier, and total, run the show license summary command for your Cisco Switching OS license

Example:

Device# show license summary
Account Information:
  Smart Account: Test As of Sep 10 17:12:16 2025 UTC
  Virtual Account: Test Acc

License Usage:
  License                 Entitlement Tag                Count Status
  -----------------------------------------------------------------------------
  essentials              (Switching OS Essentials)         3 IN USE

Step 2

To view the usage summary, run the show license usage command.

Example:

Device# show license usage
essentials (Switching OS Essentials):
  Description: Cisco C9350 Switching IOS-XE Essentials
  Count: 3
  Version: 1.0
  Status: IN USE
  Export status: NOT RESTRICTED
  Feature Name: essentials
  Feature Description: Cisco C9350 Switching IOS-XE Essentials
  Enforcement type: NOT ENFORCED
  License type: Perpetual

Note the Status, which shows that the license is IN USE.

Manage Cisco Switching OS licenses through Cisco SSM

Cisco SSM is a centralized cloud-based platform that enables you to manage all your Cisco Switching OS licenses from a single dashboard. You can organize and view your licenses in groups called Virtual Accounts and perform several license management tasks. Use Cisco SSM to manage the Cisco Switching OS licenses for your device.

Perform these steps to manage the Cisco Switching OS licenses through Cisco SSM.

Step 1

Go to software.cisco.com and log in with your Cisco.com credentials.

Step 2

On the Smart Software Licensing dashboard, click Manage Licenses to view your assets in a single dashboard.

Step 3

In this dashboard, choose Inventory > Licenses to view your Virtual Account and the assets in your account.

This Cisco SSM Licenses dashboard also allows you to:

  • View all your Cisco assets, including device information, license ownership, and license consumption data.
  • Monitor the usage of your licenses and reallocate them to different devices as needed.
  • Move licenses between Virtual Accounts.
  • Generate and view detailed reports on licenses, including license status, license subscriptions, and upcoming expiration dates.
  • Generate and view reports for all your connected Cisco devices and services.

Manage subscription licenses through cloud

The Meraki cloud solution is a centralized management service that allows you to manage your subscription licenses through a single and secure platform.

Perform the tasks outlined in this section to manage your Cisco Networking Subscription licenses by using the cloud dashboard.

Claim your license

Step 1

Log in to the Meraki dashboard.

The devices you have claimed are visible in the dashboard, and these devices can now be added to your network.

Step 2

Use your devices’ serial number to claim your device by performing one of these steps:

Choose from:

  • Scan the barcode: Open your Meraki app and scan the barcode to claim your device.
  • Use the Meraki dashboard: Claim your device by logging into the dashboard and navigating to Network-wide > Configure > Add Devices OR Organization > Configure > Inventory.

The devices you have claimed are visible in the dashboard, and these devices can now be added to your network.

Create a network and add devices

A network holds devices and information related to those devices. To create a network in the Meraki dashboard, you need to have administrator privileges.

Before Meraki devices can be monitored and configured, you must first add them to your network in the dashboard. Perform these steps to add devices to networks in the dashboard.

Step 1

From the Meraki dashboard, navigate to the Organization tab and then choose Create network.

Step 2

In the Name field, specify a name for the network.

Step 3

From the Network type drop-down list, choose an appropriate option:

Choose from:

  • Combined hardware: Can contain a combination of different device types. Useful for locations with each type of device.
  • Switch: Contains only switches.

Step 4

Select the appropriate configuration from the Configuration drop-down list.

Step 5

In the Devices section, select the check box against the devices that you want to add to this network.

Step 6

Click Create Network.

The devices operate in the management mode of the selected network and consume licenses from the subscription that the network is linked to.

Assign your licenses to an organization

An organization is a logical container for Meraki networks managed by one or more accounts. To manage your licenses, add your devices to your organization before you manage them.

Before you begin

Create an organization by performing the steps mentioned here.

Step 1

From the Meraki dashboard, navigate to Organization > Configure > License Info.

Step 2

Click Add licenses and add the licenses to your organization.

Once this setup is complete, you can view and manage your licenses on cloud, from the Meraki dashboard.

Meraki Classic Licensing

The Meraki Classic Licensing or Meraki co-termination is based on co-termination, which means that for any given organization, regardless of how many licenses were applied or when they were applied, the license expiration date for all licenses will be exactly the same.

The co-termination licenses are available in Essentials and Advantage tiers for Cisco C9350 Series Smart Switches, and in the Advantage tier for Cisco C9550 Series Smart Switches and Cisco C9610 Series Smart Switches. These licenses allow you to manage your licenses through the cloud, and they are intended to support current Meraki customers who use co-term licensing and cannot yet onboard to subscriptions.

For detailed workflows on how to onboard and manage these licenses, see Meraki Licensing.

Export Control Key for High Security or HSECK9

U.S. export control laws, including the U.S. Government Encryption and Export Administration Regulations (EAR), regulate products and features that provide cryptographic functionality.

The Export Control Key for High Security (HSECK9) is an export-controlled license that authorizes the use of cryptographic functionality.

This document provides information about the Cisco 9000 Series Smart Switches that support HSECK9. It describes the cryptographic features on these products that require HSECK9, outlines important considerations when ordering it, lists prerequisites, and explains how to configure it on supported platforms.

HSECK9 and product support

HSECK9 is required only if you want to use certain cryptographic features that are restricted by U.S. export control laws. You cannot enable restricted cryptographic features without it.

This table lists the products that support HSECK9, the release when support was introduced, and the cryptographic features on the products that require HSECK9.

HSECK9 product support and releases

Product

Release

Cryptographic feature

Cisco C9350 Series Smart Switches

For information about the SKUs in this series, see the Switch Models in the hardware installation guide.

Cisco IOS XE 26.2.1

IPsec

Prerequisites for HSECK9

  • Platform support: The device must support HSECK9. See HSECK9 and product support.
  • License configuration: OS Advantage license must be configured on the device; HSECK9 cannot be used without OS Advantage.
  • Availability of HSECK9: The required number of HSECK9 must be available in the appropriate Smart Account and Virtual Account within Cisco Smart Software Manager (Cisco SSM).

    Platform

    How to assess the required number of HSECK9

    Cisco C9350 Series Smart Switches

    One HSECK9 is required for each UDI where you want to use a cryptographic feature.

    To understand and evaluate this requirement in the context of a stacking set-up, see Stacking setup for Cisco C9350 Series Smart Switches.

  • Smart Licensing using policy topology: Devices must be connected via a supported Smart Licensing Using Policy topology to Cisco SSM to obtain SLAC (Smart Licensing Authorization Code). Installing SLAC activates the HSECK9. Installing SLAC on the device enables activation and use of the HSECK9. There are multiple ways in which a device can be connected to Cisco SSM, to obtain a SLAC. Each way of connecting to Cisco SSM is referred to as a topology, and is within the framework of the Smart Licensing Using Policy solution. Implement one of the supported Smart Licensing using policy topologies, so that you can obtain a SLAC.
     Note

    To obtain and install SLAC on supported platforms that are within the scope of this document, refer to the configuration section in this document. There are differences in the configuration process when compared to other Cisco products.

  • Sequence of installation: Install the SLAC before configuring the cryptographic feature on the device. If you configure the feature first, you must reconfigure it after SLAC installation.

HSECK9 ordering requirements

If you plan to use cryptographic features on new supported hardware, provide your Smart Account and Virtual Account details at the time of order. Cisco will then factory-install SLAC, eliminating the need for you to do so.

Stacking setup for Cisco C9350 Series Smart Switches

This section covers HSECK9 considerations and requirements that apply to a device stack with an active, a standby, and one or more members. This is therefore applicable only to Cisco C9350 Series Smart Switches.

SLAC installation methods for HSECK9

This section lists the various methods of installing SLAC for an HSECK9 for Cisco C9000 Series Smart Switches.

Prerequisites for installing SLAC

Ensure that you meet these prerequisites:

Restrictions for installing SLAC

The only unsupported topology for using an HSECK9 is when the product instance is connected to Cisco SSM through a controller, specifically Cisco Catalyst Center. Cisco Catalyst Center does not provide an option to generate a SLAC for Cisco C9000 Series Smart Switches that support HSECK9.

Install SLAC when connected to Cisco SSM over the internet

This task shows you how to request and install SLAC when the device (product instance) is connected to Cisco SSM. The product instance may connect to Cisco SSM in any of these ways.

  • Connected to Cisco SSM over the internet.
  • Connected to Cisco SSM through CSLU, and the product instance initiates communication, that is, the product instance is configured to push the required information to CSLU.
  • Connected to Cisco SSM through SSM On-Prem, and the product instance initiates communication.

Step 1

enable

Enables privileged EXEC mode. Enter your password, if prompted.

Example:

Device> enable

Step 2

license smart authorization request {add | replace} feature_name {all | local}

Requests a SLAC from Cisco SSM, CSLU, or SSM On-Prem.

  • Specify if you want to add to or replace an existing SLAC:
    • add : This adds the requested HSECK9 to an existing SLAC. The new SLAC will contain all the HSECK9 of the existing SLAC, and the requested HSECK9.
    • replace : This replaces the existing SLAC. The new SLAC will contain only the requested HSECK9. All HSECK9 in the existing SLAC are returned. When you enter this keyword, the product instance checks if these existing HSECK9 are in-use. If they are, an error message is displayed, telling you to first disable the corresponding cryptographic feature. In a stacking setup, if you have added a device where SLAC is not installed, to a stack where SLAC is already installed, use the replace and all keywords. This action returns all HSECK9 in the existing SLAC and requests SLAC for every device in the stack. You cannot request SLAC for an individual member. You can request SLAC for either the active device or the entire stack.
  • feature_name : Enter hseck9, to request and install SLAC for HSECK9.
  • Specify the device by entering one of these options:
    • all : Gets the authorization code for all devices in a High Availability and stacking set-up. In case of a stacking setup, we recommend that you use this option and install SLAC for the active and the standby. This ensures uninterrupted use of the cryptographic feature in the event of a switchover.
    • local : Gets the authorization code for the active device in a High Availability and stacking set-up. This is the default option.

Example:

Device# license smart authorization request add hseck9 all

Step 3

(Optional) license smart sync {all | local}

This command prompts the product instance to synchronize with Cisco SSM, CSLU, or SSM On-Prem to send and receive any pending data.

By synchronizing immediately, the SLAC installation process can complete soon after. Otherwise, SLAC is applied the next time the product instance contacts Cisco SSM, CSLU, or SSM On-Prem.

Example:

Device# license smart sync all

What to do next

See Verify SLAC installation and HSECK9 usage.

Install SLAC without connectivity to Cisco SSM or CSLU

Request and install a SLAC on a product instance located in an isolated (air-gapped) network.

When a device cannot access external networks, Smart License Authorization Codes (SLACs) must be requested, downloaded, and installed manually. This task outlines the process for generating the request, handling it via the CSSM Web UI, and installing the SLAC on the isolated device.

Step 1

enable

Enables privileged EXEC mode. Enter your password, if prompted.

Example:

Device> enable

Step 2

license smart authorization request {add | replace} feature_name {all | local}

Generates a SLAC request with all the required information.

Specify whether to add to or replace an existing SLAC.

  • add : Adds the requested HSECK9 to an existing SLAC. The new authorization code will contain all the HSECK9 of the existing SLAC, and the requested license.
  • replace : Replaces the existing SLAC. The new SLAC will contain only the requested HSECK9. All HSECK9 in the existing SLAC are returned. When you enter this keyword, the product instance checks if these existing HSECK9 are in-use. If they are, an error message is displayed, telling you to first disable the corresponding feature.
     Note

    In a stacking scenario, if you add a device without SLAC to a stack where SLAC is installed, use the replace and all keywords. This option returns all HSECK9 in the existing SLAC and requests SLAC for all devices in the stack. The system does not allow you to request SLAC for only one member. The available options are the active device or the entire stack.

For feature_name , enter the name of the export-controlled license for which you are requesting an addition or replacement of the SLAC. Enter "hseck9" to request and install SLAC for the HSECK9.

Specify the device by entering one of these options:

  • all : Gets the SLAC for all devices in a High Availability set-up In case of a stacking setup, we recommend that you use this option and install SLAC for the active and the standby. This ensures uninterrupted use of the cryptographic feature in the event of a switchover.
  • local : Gets the SLAC for the active device in a High Availability set-up. This is the default option.

Example:

Device# license smart authorization request add hseck9 all

Step 3

license smart authorization request save path

Saves the required UDI information for the SLAC request in a .txt file, in the specified location.

Example:

evice# license smart authorization request save bootflash:slac.txt

Step 4

Upload the request file to Cisco SSM and download the SLAC file.

This part of the task is performed on the Cisco SSM Web UI.

  1. Log in to the Cisco SSM Web UI at https://software.cisco.com. Under Smart Software Licensing, click the Manage licenses link.

  2. Select the Smart Account that will receive the report.

  3. Select Smart Software Licensing > Reports > Usage Data Files.

  4. Click Upload Usage Data. Browse to the file location (RUM report in tar format), select, and click Upload Data.

    You cannot delete a file after it has been uploaded. You can however upload another file, if required.

  5. From the Select Virtual Accounts pop-up, select the Virtual Account that will receive the uploaded file.

    After the file uploads, it appears in the Usage Data Files table in the Reports screen. Displayed details include the file name, report time, recipient Virtual Account, reporting status, number of product instances reported, and acknowledgement status.

  6. In the Acknowledgement column, click Download to save the ACK or SLAC file for the report or request you uploaded.

    You may have to wait for the file to appear in the Acknowledgement column. If there are many RUM reports or requests to process, Cisco SSM may take a few minutes.

    After you download the file, import and install the file on the product instance, or transfer it to CSLU or SSM On-Prem.

Step 5

copy source filename bootflash:

(Optional) Copies the file from its source location or directory to the flash memory of the product instance. You can also import the file directly from a remote location and install it on the product instance (next step).

  • source : This is the source location of file. The source can be either local or remote.
  • bootflash: : This is the destination for boot flash memory.

Example:

evice# copy tftp://10.8.0.6/user01/example.txt bootflash:

Step 6

license smart import filepath_filename

Imports and installs the file on the product instance. For filepath_filename, specify the location, including the filename. After installation, a system message displays the type of file you installed.

 Note

If you generated SLAC for multiple product instances (as in a stacking set-up) in the CSSM Web UI, ensure that you download a separate .txt SLAC file for each UDI. Import and install one file at a time.

Example:

Device# license smart import bootflash:example.txt

What to do next

See Verify SLAC installation and HSECK9 usage.

Install SLAC when connected to Cisco SSM through CSLU

Install SLAC to enable license enforcement and compliance for product instances that communicate with Cisco SSM via CSLU.

This task applies when product instances are connected to Cisco SSM through CSLU, and CSLU initiates communication by pulling information from the devices. You will carry out tasks in both Cisco SSM and the CSLU interface.

Step 1

In CSLU, request authorization codes for one or more devices.

  1. Log in to CSLU and navigate to the Inventory tab.

  2. Select one or more product instances for authorization code request.

  3. Select Actions for Selected > Authorization Code Request > Accept.

    Another modal opens to select a local .csv file for uploading.

Step 2

Log in to Cisco SSM at https://software.cisco.com. Under Smart Software Licensing, click the Manage licenses link.

Step 3

Click Inventory > Product Instances > Authorize License Enforced Features

Step 4

Generate SLAC for a single product instance or for multiple product instances (choose one).

Choose from:

  • Generating SLAC for a single product instance:
    1. Enter the PID and Serial Number.
       Note

      Do not populate any of the other fields.

    2. Choose the license, and in the corresponding Reserve column, and enter 1. Ensure that you choose the correct license for a PID. If you are working with Cisco Catalyst Access, Core, and Aggregation Switches that support HSECK9, select 'C9K HSEC'.
    3. Click Next
    4. Click Generate Authorization Code.
    5. Download the authorization code and save as a .csv file.
  • Generating SLAC for multiple product instances (you should have a .csv file to upload in this case):
    1. From the dropdown list that says “Single Device” (by default), change the selection to “Multiple Devices”. At this point, a "Download a template" link is displayed. If you don't already have the required template or file, you can download it. Only the serial number and PID are mandatory.
    2. Click Choose File and navigate to the .csv file, which contains the list of product instances that require SLAC.
    3. Once uploaded, the list of devices is displayed in Cisco SSM. All the devices will have the checkbox enabled (implying that you want to request a SLAC for all of them), and click Next.
    4. Specify the license quantity required for each product instance, and click Next.
       Note

      For the "C9K HSEC" license, one SLAC is required for each UDI.

    5. Click Reserve Licenses.
    6. Click Download Authorization Codes > Close A.csv file containing all the authorization codes is downloaded.

Step 5

Return to the CSLU interface and go to Data > Import from CSSM

Drag and drop a file that resides on your local drive, or browse and select the appropriate *.xml file.

If the upload is successful, you will get a message indicating that the file was successfully sent to the server. If the upload is not successful, you will get an import error.

If the upload is successful, CSLU applies the codes to the product instances the next time it runs an update.

What to do next

See Verify SLAC installation and HSECK9 usage.

Install SLAC when connected to Cisco SSM through SSM on-prem

This task explains how to request and install SLAC when the device (product instance) is connected to SSM On-Prem, and SSM On-Prem initiates communication. In this scenario, SSM On-Prem is configured to pull the required information from the product instance.

In this process, you create a request file in SSM On-Prem, upload the request in the Cisco SSM Web UI, generate SLAC, and import it into the SSM On-Prem server. Finally, synchronize SSM On-Prem with the product instance.

Step 1

Log into SSM On-Prem and navigate to Smart Licensing > Inventory > SL Using Policy.

  1. Select all the product instances for which you want to request SLAC.

  2. Click Actions for Selected… > Authorization Code Request > Accept.

    The saved .csv file includes the list of selected product instances with the required device information, in the necessary format, to generate SLAC in Cisco SSM. Save this file in a location that is accessible when you access Cisco SSM in the next step.

Step 2

Log in to Cisco SSM at https://software.cisco.com. Under Smart Software Licensing, click the Manage licenses link.

Step 3

Click Inventory > Product Instances > Authorize License Enforced Features

Step 4

Generate SLAC for multiple product instances

  1. From the dropdown list that says “Single Device” (by default), change the selection to “Multiple Devices”.

    A "Download a template" link appears. If you do not already have the required template or file, download it. Only the serial number and PID are mandatory.

  2. Click Choose File and navigate to the .csv file, which contains the list of product instances that require SLAC.

  3. After uploading, the list of devices appears in Cisco SSM. The checkbox is enabled for all devices, which means a SLAC will be requested for each one. Then, click Next.

  4. Specify the license quantity required for each product instance, and click Next.

     Note

    For the "C9K HSEC" license, one SLAC is required for each UDI.

  5. Click Reserve Licenses > Download Authorization Codes > Close

    A .csv file containing all the authorization codes is downloaded.

Step 5

Return to the SSM On-Prem UI to import the file containing all the authorization codes.

  1. Navigate to Inventory > SL Using Policy

  2. Click Export/Import All… > Import From Cisco.

    Go to Inventory > SL Using Policy , and see the Alerts column to verify import status: Authorization message received from CSSM.

Step 6

Apply SLAC on all the product instances, by navigating to Reports > Synchronisation pull schedule with the devices > Synchronise now with the device.

If you do not synchronize immediately after importing the codes, the uploaded codes are applied to the product instances the next time SSM On-Prem runs an update.

What to do next

See Verify SLAC installation and HSECK9 usage.

Verify SLAC installation and HSECK9 usage

After installing SLAC, you must verify both the installation and the status of HSECK9. These steps are required for all SLAC installation types.

Step 1

Verify SLAC installation and HSECK9 usage.

  1. Note the system messages displayed after you install SLAC.

    %SMART_LIC-6-AUTHORIZATION_INSTALL_SUCCESS: A new licensing authorization code was successfully installed on: [chars].

    [chars] is the UDI where the SLAC was installed

    %SMART_LIC-6-EXPORT_CONTROLLED: Usage of export controlled features is allowed for feature hseck9

  2. Check if the output of the show license authorization privileged EXEC command displays a timestamp and a confirmation code.

    In the Overall Status section of the output, look for Status: SMART AUTHORIZATION INSTALLED on <timestamp> and Last Confirmation code: <code>. This means SLAC is installed.

    Example:

    If you have installed more than one SLAC in a stacking setup, the status, timestamp, and confirmation code is displayed for each UDI where SLAC is installed. In this sample output, SLAC is installed only on the active and not the standby or member switch.

    Device# show license authorization

Last Data Push: <none>
Last File Export: <none>

Overall status:
  Active: PID:C9350-24P,SN:FVH2944L3CA
    Status: SMART AUTHORIZATION INSTALLED on Aug 10 2026 21:41:51 UTC
    Last return code: <none>
    Last Confirmation code: EFXaV-Gmaki-T2aaG-RngPd-k6RPf-JgUuX-SqzYJ-BrKiX-n9vm8-eCsSF-swM4d
  Standby: PID:C9350-48T,SN:FVH2933LB8X
    Status: SMART AUTHORIZATION INSTALLED on Aug 10 2026 22:04:00 UTC
    Last return code: <none>
    Last Confirmation code: EFaTv-kz69h-Do3X7-qdxqx-9pnQG-bgDyf-Hx1nT-wtLip-rz1Jx-Y3MqG-haxAx
  Member: PID:C9350-48TX,SN:FVH2942L8M8
    Status: NOT INSTALLED
    Last return code: <none>

Authorizations:
  C9K HSEC (Cat9K HSEC):
    Description: HSEC Key for Export Compliance on Cat9K Series Switches
    Total available count: 2
    Enforcement type: EXPORT RESTRICTED
    Term information:
      Active: PID:C9350-24P,SN:FVH2944L3CA
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1
      Standby: PID:C9350-48T,SN:FVH2933LB8X
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1

Purchased Licenses:
  No Purchase Information Available

Device# show license summary

Account Information:
  Smart Account: BU Production Test As of Aug 11 2026 18:49:09 UTC
  Virtual Account: Cat9K-Test

License Usage:
  License                 Entitlement Tag               Count Status
  -----------------------------------------------------------------------------
  advantage               (Switching OS Advantage)          3 IN USE
  C9K HSEC                (Cat9K HSEC)                      1 NOT IN USE

  3. Check that the usage count and status for "C9K HSEC" in the output of the show license summary privileged EXEC command displays 0 and NOT IN USE , respectively. This means that the HSECK9 is available but is not in-use yet.

Step 2

Configure the cryptographic feature.

For information about configuring the feature, refer to the corresponding platform's configuration guide.

Step 3

Again check HSECK9 usage.

After you configure the cryptographic feature, the usage count and status of HSECK9 in the output of the show license summary privileged EXEC command changes to 1 and IN USE, respectively.

Example:

Even if you have obtained more than one HSECK9 in stacking set-ups, the usage count in the output of the show license summary command displays only 1. This is because only one HSECK9 is used at a given point in time - the one on the active. The HSECK9 on the standby is used when a switchover occurs. When the standby becomes the new active, usage count remains 1, because it is still only one HSECK9 that is used.

What to do next

Complete usage reporting if required. To know if reporting is required, you can wait for a system message or refer to the policy by using show commands.

  • The system message, which indicates that reporting is required: %SMART_LIC-6-REPORTING_REQUIRED: A Usage report acknowledgment will be required in [dec] days. [dec] is the amount of time (in days) left to meet reporting requirements.
  • To check reporting requirements in a show command, refer to the output of the show license status privileged EXEC command and check the Next ACK deadline field. This means a RUM report must be sent and the ACK must be installed by this date. The method that you can use to send the RUM report depends on the topology you have implemented.

Remove SLAC and return HSECK9

Use this task to remove a SLAC and return the HSECK9 license to your license pool in Cisco SSM, for all topologies. Return a SLAC and the HSECK9 if any of these circumstances apply:

  • You no longer want to use the cryptographic feature, which requires an HSECK9.
  • You want to return the device for Return Material Authorization (RMA), or decommission it permanently. When you return a device to Cisco, configure the licence smart factory reset privileged EXEC command to remove all licensing information, except the active licenses, from the product instance. This action includes removing authorization codes and RUM reports. Before performing a factory reset, return the SLAC code. Cisco also recommends sending a RUM report to Cisco SSM before you remove licensing information from the product instance.

Before you begin

  1. Disable or unconfigure the cryptographic feature for which you used the HSECK9. For information about disabling the feature, refer to the corresponding platform's configuration guide.
  2. Verify the license usage status of the HSECK9 using the show license summary privileged EXEC command.
    • If the status of the HSECK9 is displayed as NOT IN USE, proceed with the steps in the task.
    • If the status of the HSECK9 is displayed as IN USE after you disable the cryptographic feature, enter the required command to release the HSECK9.

    For this platform...

    Enter this command to release the HSECK9 forcibly

    Cisco C9350 Series Smart Switches

    platform hsec-license-release 

    Device# configure terminal
Device(config)# platform hsec-license-release
HSEC license is released
Device(config)# exit

Step 1

show license summary

(Optional) Displays license usage summary. This step applies only if you are returning a SLAC.

Ensure that the status of the license that you want to return is NOT IN USE.

Example:

Device# show license summary

Account Information:
  Smart Account: BU Test As of Aug 11 2026 18:49:09 UTC
  Virtual Account: Cat9K-Test

License Usage:
  License                 Entitlement Tag               Count Status
  -----------------------------------------------------------------------------
  advantage               (Switching OS Advantage)          3 IN USE
  C9K HSEC                (Cat9K HSEC)                      1 NOT IN USE

Step 2

license smart authorization return {all | local} {offline [path] | online}

Example:

Device# license smart authorization return all online
OR
Device# license smart authorization return all offline
Enter this return code in Cisco Smart Software Manager portal: 
UDI: PID:C9350-48TX,SN:FVH2942L8M8
Return code: Cr9JHx-L1x5Rj-ftwzg1-h9QZAU-LE5DT1-babWeL-FABPt9-Wr1Dn7-Rp7
OR
Device# license smart authorization return all offline bootflash:return-code.txt

Returns an authorization code back to the license pool in Cisco SSM. A return code is displayed after you enter this command.

Specify the product instance:

  • all: Performs the action for all connected product instances in a High Availability or stacking set-up.
  • local: Performs the action for the active product instance. This is the default option.

Specify if you are connected to Cisco SSM or not:

  • If the product instance is directly connected to Cisco SSM, or it is connected to Cisco SSM through CSLU or SSM On-Prem and the product instance-initiates communication, enter online. The code is automatically returned to Cisco SSM and a confirmation is returned and installed on the product instance. If you select this option, the return code is automatically submitted to Cisco SSM.
  • If the product instance is not connected to Cisco SSM, or you have implemented a topology with CSLU-initiated or SSM On-Prem initiated communication, enter offline [filepath_filename] . If you choose the offline option, you must complete the additional step of submitting this to Cisco SSM.

Step 3

If you choose the offline option, upload the return information in Cisco SSM.

  1. Log in to the CSSM Web UI at https://software.cisco.com. Under Smart Software Licensing , click the Manage licenses link.

    Log in using the username and password provided by Cisco.

  2. Select the Smart Account that will receive the report.

  3. Select Smart Software Licensing > Reports > Usage Data Files > Upload Usage Data.

  4. Browse to the file location (RUM report in tar format), select, and click Upload Data.

  5. Click ... to upload the SLAC return request file ( .txt format).

    You cannot delete a file after it has been uploaded. However, you can upload another file if needed.

  6. From the Select Virtual Accounts pop-up, select the Virtual Account that will receive the uploaded file.

    The file is uploaded to Cisco SSM and is listed under Reports > Usage Data Files with the file name, the time is was reported, and the Virtual Account it was uploaded to, and so on.

  7. In the Acknowledgement column, click Download to save the ACK.

    You may have to wait for the file to appear in the Acknowledgement column. If there are many RUM reports or requests to process, CSSM may take a few minutes.

    After you download the file, import and install the file on the product instance by using the license smart import filepath_filename command in privileged EXEC mode or import it to CSLU or SSM On-Prem.

Step 4

show license authorization

Displays licensing information. If the return process is completed correctly, the Last return code: field displays the return code.

Example:

Device# show license authorization

Last Data Push: <none>
Last File Export: <none>

Overall status:
  Active: PID:C9350-24P,SN:FVH2944L3CA
    Status: SMART AUTHORIZATION INSTALLED on Aug 10 2026 21:41:51 UTC
    Last return code: <none>
    Last Confirmation code: EFXaV-Gmaki-T2aaG-RngPd-k6RPf-JgUuX-SqzYJ-BrKiX-n9vm8-eCsSF-swM4d
  Standby: PID:C9350-48T,SN:FVH2933LB8X
    Status: SMART AUTHORIZATION INSTALLED on Aug 10 2026 22:04:00 UTC
    Last return code: <none>
    Last Confirmation code: EFaTv-kz69h-Do3X7-qdxqx-9pnQG-bgDyf-Hx1nT-wtLip-rz1Jx-Y3MqG-haxAx
  Member: PID:C9350-48TX,SN:FVH2942L8M8
    Status: NOT INSTALLED
    Last return code: <none>

<output truncated>

HSECK9 configuration examples

Example for C9350: Stack member addition with HSECK9 in use

This example demonstrates how to add a device to an existing stack when a cryptographic feature is configured and HSECK9 are in use.

This is the overall sequence of tasks for this method: Add a new member to the existing stack > Request and install SLAC for the entire stack again.

  1. Display and check information about the existing stack. The output of the show switch detail command shows that this is a two-member stack. The output of the show license authorisation command shows that SLAC is installed on the active (C9300X-24HX,SN:FOC2519L8R7) and the standby (PID:C9300X-48HXN,SN:FOC2524L39P). The output of the show license summary command shows that the cryptographic functionality has been configured (C9K HSEC - IN USE). The output of the show license all command (truncated output) shows that the device is directly connected to Cisco SSM and the smart transport option is used for communication with Cisco SSM. 
    Device# show switch detail

Switch/Stack Mac Address : b08b.d02b.5b80 - Local Mac Address
Mac persistency wait time: Indefinite
                                             H/W   Current
Switch#   Role    Mac Address     Priority Version  State 
-------------------------------------------------------------------------------------
*1       Active   b08b.d02b.5b80     5      V01     Ready                               
 2       Standby  b08b.d08d.bb00     1      V01     Ready                               
 3       Member   0000.0000.0000     0      V01     Ready                               



         Stack Port Status             Neighbors     
Switch#  Port 1     Port 2           Port 1   Port 2 
--------------------------------------------------------
  1         OK         OK               3        2 
  2         OK         OK               1        3 
  3         OK         OK               1        2 

    Device# show license authorization

Last Data Push: <none>
Last File Export: <none>

Overall status:
  Active: PID:C9350-24P,SN:FVH2944L3CA
    Status: SMART AUTHORIZATION INSTALLED on Aug 10 2026 21:41:51 UTC
    Last return code: <none>
    Last Confirmation code: EFXaV-Gmaki-T2aaG-RngPd-k6RPf-JgUuX-SqzYJ-BrKiX-n9vm8-eCsSF-swM4d
  Standby: PID:C9350-48T,SN:FVH2933LB8X
    Status: SMART AUTHORIZATION INSTALLED on Aug 10 2026 22:04:00 UTC
    Last return code: <none>
    Last Confirmation code: EFaTv-kz69h-Do3X7-qdxqx-9pnQG-bgDyf-Hx1nT-wtLip-rz1Jx-Y3MqG-haxAx
  Member: PID:C9350-48TX,SN:FVH2942L8M8
    Status: NOT INSTALLED
    Last return code: <none>

Authorizations:
  C9K HSEC (Cat9K HSEC):
    Description: HSEC Key for Export Compliance on Cat9K Series Switches
    Total available count: 2
    Enforcement type: EXPORT RESTRICTED
    Term information:
      Active: PID:C9350-24P,SN:FVH2944L3CA
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1
      Standby: PID:C9350-48T,SN:FVH2933LB8X
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1

Purchased Licenses:
  No Purchase Information Available

    Device# show license summary

Account Information:
  Smart Account: BU Test As of Aug 11 2026 18:49:09 UTC
  Virtual Account: Cat9K-Test

License Usage:
  License                 Entitlement Tag               Count Status
  -----------------------------------------------------------------------------
  advantage               (Switching OS Advantage)          3 IN USE
  C9K HSEC                (Cat9K HSEC)                      1 AUTHORIZED

    Device# show license all

Smart Licensing Status
======================

Smart Licensing is ENABLED

License Conversion:
  Automatic Conversion Enabled: False
  Last Data Push: <none>
  Last File Export: <none>

Export Authorization Key:
  Features Authorized:
    <none>

Utility:
  Status: DISABLED

Smart Licensing Using Policy:
  Status: ENABLED
  Reporting Mode: STANDARD

<output truncated>
  2. Add a new member to the stack. The syslogs show the sequence of events after the new member is added to the stack. Note the successful trust code installation on the newly added member (%SMART_LIC-6-TRUST_INSTALL_SUCCESS). The output of the show switch stack-ports and show switch detail commands show the status of switch 3, which is the newly added member. The output of the show license udi command shows the PIDs of all the connected devices in the stacking set-up including the new member, C9300X-48HX,SN:FOC2516LC92. The output of the show license authorisation command shows that SLAC is installed on the active (C9300X-24HX,SN:FOC2519L8R7) and the standby (PID:C9300X-48HXN,SN:FOC2524L39P), but not on the newly added member. 
    <output truncated>
Dec  3 18:42:49.885: %STACKMGR-6-STACK_LINK_CHANGE: Switch 2 R0/0: stack_mgr: Stack port 2 on Switch 2 is up
Dec  3 18:42:57.213: %STACKMGR-6-STACK_LINK_CHANGE: Switch 1 R0/0: stack_mgr: Stack port 1 on Switch 1 is up
Dec  3 18:42:57.229: %STACKMGR-4-SWITCH_ADDED: Switch 1 R0/0: stack_mgr: Switch 3 has been added to the stack.
Dec  3 18:42:57.228: %STACKMGR-4-SWITCH_ADDED: Switch 2 R0/0: stack_mgr: Switch 3 has been added to the stack.
Applying config on Switch 3...[DONE]
Dec  3 18:42:59.179: %STACKMGR-4-SWITCH_ADDED: Switch 2 R0/0: stack_mgr: Switch 3 has been added to the stack.
.
.
.
Dec  3 18:42:36.633: %STACKMGR-6-STACK_LINK_CHANGE: Switch 3 R0/0: stack_mgr: Stack port 1 on Switch 3 is down
Dec  3 18:42:36.633: %STACKMGR-6-STACK_LINK_CHANGE: Switch 3 R0/0: stack_mgr: Stack port 2 on Switch 3 is down
Dec  3 18:42:50.369: %STACKMGR-6-STACK_LINK_CHANGE: Switch 3 R0/0: stack_mgr: Stack port 1 on Switch 3 is up
Dec  3 18:42:57.067: %STACKMGR-6-STACK_LINK_CHANGE: Switch 3 R0/0: stack_mgr: Stack port 2 on Switch 3 is up
Dec  3 18:42:57.070: %STACKMGR-4-SWITCH_ADDED: Switch 3 R0/0: stack_mgr: Switch 3 has been added to the stack.
.
.
.
Dec  3 18:43:04.079: Slot add triggered 3
Dec  3 18:43:06.233: ILP:: switch 3 POE mode : IEEE BT
Dec  3 18:43:06.233: ILP:: POE POST detail for switch 3: PASS
Dec  3 18:43:06.233: ILP::   Able to get POE POST from switch 3 MCU
.
.
.
Dec  3 18:43:29.665: %SMART_LIC-6-TRUST_INSTALL_SUCCESS: A new licensing trust code was successfully installed on P:C9300X-48HX,S:FOC2516LC92.
Dec  3 18:43:45.239: %LINK-3-UPDOWN: Interface TenGigabitEthernet3/0/4, changed state to up
Dec  3 18:43:46.239: %LINEPROTO-5-UPDOWN: Line protocol on Interface TenGigabitEthernet3/0/4, changed state to up
<output truncated>
    Device# show switch stack-ports

Switch#   Port1     Port2
----------------------------
1         OK        OK   
2         OK        OK   
3         OK        OK   

Device# show switch detail

Switch/Stack Mac Address : b08b.d02b.5b80 - Local Mac Address
Mac persistency wait time: Indefinite
                                             H/W   Current
Switch#   Role    Mac Address     Priority Version  State 
-------------------------------------------------------------------------------------
*1       Active   b08b.d02b.5b80     15     P2B     Ready                               
 2       Standby  b08b.d08d.bb00     14     P2B     Ready                               
 3       Member   f87a.414b.5580     1      PP      Ready                               

         Stack Port Status             Neighbors     
Switch#  Port 1     Port 2           Port 1   Port 2 
--------------------------------------------------------
  1         OK         OK               3        2 
  2         OK         OK               1        3 
  3         OK         OK               2        1 

    Device# show license udi

UDI: PID:C9300X-24HX,SN:FOC2519L8R7

HA UDI List:
    Active:PID:C9300X-24HX,SN:FOC2519L8R7
    Standby:PID:C9300X-48HXN,SN:FOC2524L39P
    Member:PID:C9300X-48HX,SN:FOC2516LC92
                        
    Device# show license authorization

Overall status:
  Active: PID:C9300X-24HX,SN:FOC2519L8R7
      Status: SMART AUTHORIZATION INSTALLED on Dec 03 18:34:03 2021 UTC
      Last Confirmation code: 72ad37d5
  Standby: PID:C9300X-48HXN,SN:FOC2524L39P
      Status: SMART AUTHORIZATION INSTALLED on Dec 03 18:34:03 2021 UTC
      Last Confirmation code: 842584db
  Member: PID:C9300X-48HX,SN:FOC2516LC92
      Status: NOT INSTALLED

Authorizations:
  C9K HSEC (Cat9K HSEC):
    Description: HSEC Key for Export Compliance on Cat9K Series Switches
    Total available count: 2
    Enforcement type: EXPORT RESTRICTED
    Term information:
      Active: PID:C9300X-24HX,SN:FOC2519L8R7
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1
      Standby: PID:C9300X-48HXN,SN:FOC2524L39P
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1

Purchased Licenses:
  No Purchase Information Available
  3. Request SLAC for the entire stack again. This approach applies to topologies where the device is directly connected to Cisco SSM. Use the procedure appropriate for your topology. The system messages show that SLAC is installed on all the connected devices in the set-up - the active (SN:FOC2519L8R7), the standby (SN:FOC2524L39P), and the member (SN:FOC2516LC92). The output of the show license authorisation command displayes the updated timestamp and the new confirmation codes for SLAC installation. The confirmation codes for SN:FOC2519L8R7 and SN:FOC2524L39P , which are the existing devices in the stack, have changed from 72ad37d5 and 842584db, to f6c6978d and 7ae69c8c, respectively. The confirmation code for the new member, which is SN:FOC2516LC92, is e3fd6642. 
    Device# license smart authorization request replace hseck9 all

Dec  3 18:45:33.145: %SMART_LIC-6-AUTHORIZATION_INSTALL_SUCCESS: A new licensing authorization code was successfully installed on PID:C9300X-24HX,SN:FOC2519L8R7
Dec  3 18:45:33.235: %SMART_LIC-6-AUTHORIZATION_INSTALL_SUCCESS: A new licensing authorization code was successfully installed on PID:C9300X-48HXN,SN:FOC2524L39P
Dec  3 18:45:33.319: %SMART_LIC-6-AUTHORIZATION_INSTALL_SUCCESS: A new licensing authorization code was successfully installed on PID:C9300X-48HX,SN:FOC2516LC92
                        
    Device# show license authorization

Overall status:
  Active: PID:C9300X-24HX,SN:FOC2519L8R7
      Status: SMART AUTHORIZATION INSTALLED on Dec 03 18:45:33 2021 UTC
      Last Confirmation code: f6c6978d
  Standby: PID:C9300X-48HXN,SN:FOC2524L39P
      Status: SMART AUTHORIZATION INSTALLED on Dec 03 18:45:33 2021 UTC
      Last Confirmation code: 7ae69c8c
  Member: PID:C9300X-48HX,SN:FOC2516LC92
      Status: SMART AUTHORIZATION INSTALLED on Dec 03 18:45:33 2021 UTC
      Last Confirmation code: e3fd6642

Authorizations:
  C9K HSEC (Cat9K HSEC):
    Description: HSEC Key for Export Compliance on Cat9K Series Switches
    Total available count: 3
    Enforcement type: EXPORT RESTRICTED
    Term information:
      Active: PID:C9300X-24HX,SN:FOC2519L8R7
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1
      Standby: PID:C9300X-48HXN,SN:FOC2524L39P
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1
      Member: PID:C9300X-48HX,SN:FOC2516LC92
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1

Purchased Licenses:
  No Purchase Information Available

There is another way of adding a member to a stack where HSECK9 are in use, see Example for C9350: Request SLAC on a standalone and add it to a stack where HSECK9 are in use.

Example for C9350: Request SLAC on a standalone and add it to a stack where HSECK9 are in use

This example shows you one way of adding a device to an existing stack where cryptographic functionality is being used.

This is the overall sequence of tasks for this method: Install SLAC on the standalone > Configure the cryptographic functionality on the standalone > Add the device to the existing stack where cryptographic functionality is being used.

  1. Display and check information about the existing stack. The output of the show switch detail command shows that this is a two-member stack. The output of the show license authorisation command shows that SLAC is installed on the active (C9300X-24HX,SN:FOC2519L8R7) and the standby (PID:C9300X-48HXN,SN:FOC2524L39P). The output of the show license summary command shows that the cryptographic functionality has been configured (C9K HSEC - IN USE). The output of the show license all command (truncated output) shows that the device is directly connected to Cisco SSM. The smart transport option is used for communication with Cisco SSM. 
    Device# show switch detail

Switch/Stack Mac Address : b08b.d02b.5b80 - Local Mac Address
Mac persistency wait time: Indefinite
                                             H/W   Current
Switch#   Role    Mac Address     Priority Version  State 
-------------------------------------------------------------------
*1       Active   b08b.d02b.5b80     15     P2B     Ready
 2       Standby  b08b.d08d.bb00     14     P2B     Ready
 3       Member   0000.0000.0000     0      PP      Removed        

         Stack Port Status             Neighbors     
Switch#  Port 1     Port 2           Port 1   Port 2 
--------------------------------------------------------
  1       DOWN         OK             None       2 
  2         OK       DOWN               1      None

    Device# show license authorization

Overall status:
  Active: PID:C9300X-24HX,SN:FOC2519L8R7
      Status: SMART AUTHORIZATION INSTALLED on Dec 03 18:34:03 2021 UTC
      Last Confirmation code: 72ad37d5
  Standby: PID:C9300X-48HXN,SN:FOC2524L39P
      Status: SMART AUTHORIZATION INSTALLED on Dec 03 18:34:03 2021 UTC
      Last Confirmation code: 842584db


Authorizations:
  C9K HSEC (Cat9K HSEC):
    Description: HSEC Key for Export Compliance on Cat9K Series Switches
    Total available count: 2
    Enforcement type: EXPORT RESTRICTED
    Term information:
      Active: PID:C9300X-24HX,SN:FOC2519L8R7
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1
      Standby: PID:C9300X-48HXN,SN:FOC2524L39P
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1

Purchased Licenses:
  No Purchase Information Available

    Device# show license summary

Account Information:
  Smart Account: Eg-SA As of Dec 03 18:51:59 2021 UTC
  Virtual Account: Eg-VA
 
License Usage:
  License                 Entitlement Tag               Count Status
  -----------------------------------------------------------------------------
  network-advantage       (C9300-24 Network Advan...)       1 IN USE
  dna-advantage           (C9300-24 DNA Advantage)          1 IN USE
  network-advantage       (C9300-48 Network Advan...)       1 IN USE
  dna-advantage           (C9300-48 DNA Advantage)          1 IN USE
  C9K HSEC                (Cat9K HSEC)                      1 IN USE

    Device# show license all

Smart Licensing Status
======================

Smart Licensing is ENABLED

<output truncated>

Transport:
  Type: Smart
  URL: https://smartreceiver-stage.cisco.com/licservice/license
  Proxy:
    Not Configured
  VRF:
    Not Configured

Miscellaneous:
  Custom Id: <empty>

<output truncated>
  2. Boot the third switch as a standalone. The syslogs show the boot-up sequence. The output of the show switch detail command shows that this is a standalone set-up. 
    <output truncated>
switch:boot
boot: attempting to boot from [flash:packages.conf]
boot: reading file packages.conf
#
Waiting for 120 seconds for other switches to boot
#######################################################################################################################
Switch number is 3
.
.
.
Press RETURN to get started!
*Dec  3 18:29:30.097: %SMART_LIC-6-AGENT_ENABLED: Smart Agent for Licensing is enabled 
*Dec  3 18:29:30.145: %SMART_LIC-6-EXPORT_CONTROLLED: Usage of export controlled features is not allowed
*Dec  3 18:29:41.412: %SYS-5-RESTART: System restarted —
<output truncated>
    Device# show switch detail

Switch/Stack Mac Address : f87a.414b.5580 - Local Mac Address
Mac persistency wait time: Indefinite
                                             H/W   Current
Switch#   Role    Mac Address     Priority Version  State 
-------------------------------------------------------------------------------------
 1       Member   0000.0000.0000     0              Provisioned                         
 2       Member   0000.0000.0000     0              Provisioned                         
*3       Active   f87a.414b.5580     1      PP      Ready                               

         Stack Port Status             Neighbors     
Switch#  Port 1     Port 2           Port 1   Port 2 
--------------------------------------------------------
  3       DOWN       DOWN             None     None
  3. Configure a Smart Licensing Using Policy topology on the standalone. The sample configuration demonstrates the "No Connectivity to Cisco SSM and No CSLU topology." Enter commands based on your specific topology. The output of the show license authorisation command shows that SLAC is not installed on the standalone. 
    Device(config)# license smart transport off
Device(config)# exit
Device# copy running-config startup-config

    Device# show license authorization

Overall status:
  Active: PID:C9300X-48HX,SN:FOC2516LC92
      Status: NOT INSTALLED
Purchased Licenses:
  No Purchase Information Available
  4. Import and install SLAC The SLAC file is obtained from Cisco SSM and not shown here. The sample configuration shows how the SLAC file is installed on the device by using the license smart import command. The output of the show license authorisation command shows that SLAC is installed. 
    Device# license smart import tftp://10.8.0.6/user-01/SLAC-standalone.txt
Import Data Successful
Last Confirmation code UDI: PID:C9300X-48HX,SN:FOC2516LC92
    Confirmation code: 59e155ae
Device#
*Dec  3 18:58:39.026: %SMART_LIC-6-AUTHORIZATION_INSTALL_SUCCESS: A new licensing authorization code was successfully installed on PID:C9300X-48HX,SN:FOC2516LC92

Device# show license authorization
Overall status:
  Active: PID:C9300X-48HX,SN:FOC2516LC92
      Status: SMART AUTHORIZATION INSTALLED on Dec 03 18:58:39 2021 UTC
      Last Confirmation code: 59e155ae


Authorizations:
  C9K HSEC (Cat9K HSEC):
    Description: HSEC Key for Export Compliance on Cat9K Series Switches
    Total available count: 1
    Enforcement type: EXPORT RESTRICTED
    Term information:
      Active: PID:C9300X-48HX,SN:FOC2516LC92
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1

Purchased Licenses:
  No Purchase Information Available
  5. Configure the cryptographic feature The outputs of the show license summary commands show the status of the HSECK9 before (NOT IN USE) and after (IN USE) configuration of the cryptographic feature. 
    Device# show license summary

Account Information:
  Smart Account: Eg-SA As of Dec 03 18:57:27 2021 UTC
  Virtual Account: Eg-VA
License Usage:
  License                 Entitlement Tag               Count Status
  -----------------------------------------------------------------------------
  network-advantage       (C9300-48 Network Advan...)       1 IN USE
  dna-advantage           (C9300-48 DNA Advantage)          1 IN USE
  C9K HSEC                (Cat9K HSEC)                      0 NOT IN USE
 
Device# configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Device(config)# interface Tunnel13
Device(config-if)# ip address 11.0.1.1 255.255.255.0
Device(config-if)# tunnel source 110.0.1.1
Device(config-if)# tunnel mode ipsec ipv4
Device(config-if)# tunnel destination 110.0.1.2
Device(config-if)# tunnel protection ipsec profile ipsec_prof
Device(config-if)# end

*Dec  3 18:59:29.309: %SMART_LIC-6-EXPORT_CONTROLLED: Usage of export controlled features is allowed for feature hseck9

Device# show license summary
Account Information:
  Smart Account: Eg-SA As of Dec 03 18:57:27 2021 UTC
  Virtual Account: Eg-VA
License Usage:
  License                 Entitlement Tag               Count Status
  -----------------------------------------------------------------------------
  network-advantage       (C9300-48 Network Advan...)       1 IN USE
  dna-advantage           (C9300-48 DNA Advantage)          1 IN USE
  C9K HSEC                (Cat9K HSEC)                      1 IN USE
  6. Add the standalone switch to the existing stack The output of the show switch detail command shows that a new member has been added to the stack. The output of the show license all command shows that the SLAC on the new member is retained. Compare the “Status” and “Last Confirmation code” fields in the output here, with the output of the show license authorization command after SLAC installation on the standalone (above). The output of the show license summary shows that the cryptographic feature continues to be operational (the HSECK9 is IN-USE). 
    Chassis 3 reloading, reason - stack merge
*Dec  3 19:00:59.575: %STACKMGR-6-STACK_LINK_CHANGE: Switch 3 R0/0: stack_mgr: Stack port 1 on Switch 3 is up
*Dec  3 19:00:59.577: %STACKMGR-1-RELOAD: Switch 3 R0/0: stack_mgr: Reloading due to reason stack merge
Dec  3 19:01:08.683: %PMAN-5-EXITACTION: F0/0: pvp: Process manager is exiting: reload fp action requested
Dec  3 19:01:10.171: %PMAN-5-EXITACTION: R0/vp: Process manager is exiting: rp processes exit with reload switch code

Initializing Hardware......

<output truncated>

Device# show switch detail

Switch/Stack Mac Address : b08b.d02b.5b80 - Local Mac Address
Mac persistency wait time: Indefinite
                                             H/W   Current
Switch#   Role    Mac Address     Priority Version  State 
-------------------------------------------------------------------------------------
*1       Active   b08b.d02b.5b80     15     P2B     Ready                               
 2       Standby  b08b.d08d.bb00     14     P2B     Ready                               
 3       Member   f87a.414b.5580     1      PP      Ready                               

         Stack Port Status             Neighbors     
Switch#  Port 1     Port 2           Port 1   Port 2 
--------------------------------------------------------
  1         OK         OK               3        2 
  2         OK         OK               1        3 
  3         OK         OK               2        1 

    Device# show license all

Smart Licensing Status
======================


Smart Licensing is ENABLED


Export Authorization Key:
  Features Authorized:
    <none>


Utility:
  Status: DISABLED


Smart Licensing Using Policy:
  Status: ENABLED


Account Information:
  Smart Account: Eg-SA As of Dec 03 18:51:59 2021 UTC
  Virtual Account: Eg-VA


Data Privacy:
  Sending Hostname: yes
    Callhome hostname privacy: DISABLED
    Smart Licensing hostname privacy: DISABLED
  Version privacy: DISABLED


Transport:
  Type: Smart
  URL: https://smartreceiver-stage.cisco.com/licservice/license
  Proxy:
    Not Configured
  VRF:
    Not Configured


Miscellaneous:
  Custom Id: <empty>


Policy:
  Policy in use: Installed On Dec 03 18:32:37 2021 UTC
  Policy name: Custom Policy
  Reporting ACK required: yes (Customer Policy)
  Unenforced/Non-Export Perpetual Attributes:
    First report requirement (days): 365 (Customer Policy)
    Reporting frequency (days): 0 (Customer Policy)
    Report on change (days): 90 (Customer Policy)
  Unenforced/Non-Export Subscription Attributes:
    First report requirement (days): 90 (Customer Policy)
    Reporting frequency (days): 90 (Customer Policy)
    Report on change (days): 90 (Customer Policy)
  Enforced (Perpetual/Subscription) License Attributes:
    First report requirement (days): 365 (Customer Policy)
    Reporting frequency (days): 90 (Customer Policy)
    Report on change (days): 90 (Customer Policy)
  Export (Perpetual/Subscription) License Attributes:
    First report requirement (days): 365 (Customer Policy)
    Reporting frequency (days): 90 (Customer Policy)
    Report on change (days): 90 (Customer Policy)


Usage Reporting:
  Last ACK received: Dec 03 18:37:21 2021 UTC
  Next ACK deadline: Mar 03 18:37:21 2022 UTC
  Reporting push interval: 30  days
  Next ACK push check: Dec 03 19:04:55 2021 UTC
  Next report push: Dec 03 19:05:03 2021 UTC
  Last report push: Dec 03 18:52:53 2021 UTC
  Last report file write: <none>


Trust Code Installed:
  Active: PID:C9300X-24HX,SN:FOC2519L8R7
    INSTALLED on Dec 03 18:32:37 2021 UTC
  Standby: PID:C9300X-48HXN,SN:FOC2524L39P
    INSTALLED on Dec 03 18:32:37 2021 UTC
  Member: PID:C9300X-48HX,SN:FOC2516LC92
    INSTALLED on Dec 03 18:43:29 2021 UTC


License Usage
=============


network-advantage (C9300-24 Network Advantage):
  Description: C9300-24 Network Advantage
  Count: 1
  Version: 1.0
  Status: IN USE
  Export status: NOT RESTRICTED
  Feature Name: network-advantage
  Feature Description: C9300-24 Network Advantage
  Enforcement type: NOT ENFORCED
  License type: Perpetual


dna-advantage (C9300-24 DNA Advantage):
  Description: C9300-24 DNA Advantage
  Count: 1
  Version: 1.0
  Status: IN USE
  Export status: NOT RESTRICTED
  Feature Name: dna-advantage
  Feature Description: C9300-24 DNA Advantage
  Enforcement type: NOT ENFORCED
  License type: Subscription


network-advantage (C9300-48 Network Advantage):
  Description: C9300-48 Network Advantage
  Count: 2
  Version: 1.0
  Status: IN USE
  Export status: NOT RESTRICTED
  Feature Name: network-advantage
  Feature Description: C9300-48 Network Advantage
  Enforcement type: NOT ENFORCED
  License type: Perpetual


dna-advantage (C9300-48 DNA Advantage):
  Description: C9300-48 DNA Advantage
  Count: 2
  Version: 1.0
  Status: IN USE
  Export status: NOT RESTRICTED
  Feature Name: dna-advantage
  Feature Description: C9300-48 DNA Advantage
  Enforcement type: NOT ENFORCED
  License type: Subscription


C9K HSEC (Cat9K HSEC):
  Description: HSEC Key for Export Compliance on Cat9K Series Switches
  Count: 1
  Version: 1.0
  Status: IN USE
  Export status: RESTRICTED - ALLOWED
  Feature Name: hseck9
  Feature Description: hseck9
  Enforcement type: EXPORT RESTRICTED
  License type: Export


Product Information
===================
UDI: PID:C9300X-24HX,SN:FOC2519L8R7


HA UDI List:
    Active:PID:C9300X-24HX,SN:FOC2519L8R7
    Standby:PID:C9300X-48HXN,SN:FOC2524L39P
    Member:PID:C9300X-48HX,SN:FOC2516LC92


Agent Version
=============
Smart Agent for Licensing: 5.3.15_rel/49


License Authorizations
======================
Overall status:
  Active: PID:C9300X-24HX,SN:FOC2519L8R7
      Status: SMART AUTHORIZATION INSTALLED on Dec 03 18:51:56 2021 UTC
      Last Confirmation code: fa4c0d80
  Standby: PID:C9300X-48HXN,SN:FOC2524L39P
      Status: SMART AUTHORIZATION INSTALLED on Dec 03 18:51:56 2021 UTC
      Last Confirmation code: 450243e2
  Member: PID:C9300X-48HX,SN:FOC2516LC92
      Status: SMART AUTHORIZATION INSTALLED on Dec 03 18:58:39 2021 UTC
      Last Confirmation code: 59e155ae


Authorizations:
  C9K HSEC (Cat9K HSEC):
    Description: HSEC Key for Export Compliance on Cat9K Series Switches
    Total available count: 3
    Enforcement type: EXPORT RESTRICTED
    Term information:
      Active: PID:C9300X-24HX,SN:FOC2519L8R7
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1
      Standby: PID:C9300X-48HXN,SN:FOC2524L39P
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1
      Member: PID:C9300X-48HX,SN:FOC2516LC92
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1


Purchased Licenses:
  No Purchase Information Available


Usage Report Summary:
=====================
Total: 58,  Purged: 0
Total Acknowledged Received: 20,  Waiting for Ack: 33
Available to Report: 5  Collecting Data: 0

    Device# show license summary

Load for five secs: 1%/0%; one minute: 9%; five minutes: 5%
Time source is NTP, 19:05:29.741 UTC Fri Dec 3 2021

Account Information:
  Smart Account: Eg-SA As of Dec 03 19:04:56 2021 UTC
  Virtual Account: Eg-VA


License Usage:
  License                 Entitlement Tag               Count Status
  -----------------------------------------------------------------------------
  network-advantage       (C9300-24 Network Advan...)       1 IN USE
  dna-advantage           (C9300-24 DNA Advantage)          1 IN USE
  network-advantage       (C9300-48 Network Advan...)       2 IN USE
  dna-advantage           (C9300-48 DNA Advantage)          2 IN USE
  C9K HSEC                (Cat9K HSEC)                      1 IN USE

To see the other method of adding a member to a stack where HSECK9 are in use, see Example for C9350: Stack member addition with HSECK9 in use.