Identificar e Solucionar Problemas de Transporte Inteligente SLP nos Switches Catalyst 9000

Introdução

Este documento descreve como solucionar problemas do Smart Licensing Using Policy (SLP) usando o Smart Transport em switches Catalyst 9000.

Pré-requisitos

Requisitos

A Cisco recomenda que você tenha conhecimento e familiaridade com este tópico:

• Licenciamento inteligente usando política em dispositivos Cisco IOS® XE.

Componentes Utilizados

As informações neste documento são baseadas nestas versões de software e hardware:

• Catalyst 9200
• Catalyst 9300
• Catalyst 9400
• Catalyst 9500
• Catalyst 9600
• Cisco IOS XE 17.9.1 e versões posteriores

Note: Consulte o guia de configuração apropriado para obter os comandos usados para ativar esses recursos em outras plataformas da Cisco.

As informações neste documento foram criadas a partir de dispositivos em um ambiente de laboratório específico. Todos os dispositivos utilizados neste documento foram iniciados com uma configuração (padrão) inicial. Se a rede estiver ativa, certifique-se de que você entenda o impacto potencial de qualquer comando.

Informações de Apoio

O Smart Licensing Using Policy é uma versão aprimorada do Smart Licensing, projetada com o objetivo principal de fornecer uma solução de licenciamento que garanta que as operações da sua rede permaneçam ininterruptas. Em vez de causar interrupções, ele estabelece uma relação de conformidade para contabilizar as licenças de hardware e software que você adquire e utiliza.

Para que os relatórios do Smart Licensing funcionem corretamente, o switch Catalyst 9000 conecta-se ao Cisco Smart Software Manager (CSSM) para relatar o uso da licença. O CSSM serve como uma plataforma centralizada para gerenciar todas as licenças de software da Cisco e revisar o uso, o que ajuda a planejar futuras necessidades de licenciamento.

Há várias topologias através das quais um switch Catalyst 9000 pode se conectar ao CSSM, mas este documento enfoca a topologia específica na qual o switch está diretamente conectado ao CSSM. Isso significa que o switch deve ser capaz de acessar e estabelecer uma conexão com o CSSM, que é hospedado na Internet.

Nessa topologia de conexão direta, há duas opções de transporte: Smart Transport e Call Home, com o Smart Transport sendo o método recomendado. Além disso, o Smart Transport suporta o uso de um proxy HTTPS e permite a seleção de um VRF específico para lidar com a comunicação do Smart Licensing com o CSSM.

Ao usar o Transporte Inteligente, o switch Catalyst 9000 troca informações de uso de licença com o CSSM no formato JSON (JavaScript Object Notation) em uma mensagem HTTPS. Essas informações, conhecidas como Relatório RUM, são enviadas pelo switch e a resposta do CSSM é chamada de ACK.

A frequência mínima de relatório para esta topologia é limitada a um dia. Isso significa que a instância do produto não enviará mais de um relatório RUM por dia, evitando que um número excessivo de relatórios seja gerado e transmitido para determinadas licenças. Isso ajuda a resolver problemas relacionados à memória e a lentidão do sistema causados por uma superprodução de relatórios RUM.

Se necessário, você pode substituir essa restrição de limitação usando olicense smart synccomando no modo EXEC privilegiado

Configurar

Siga estas etapas para configurar o SLP com Transporte Inteligente:

1. Configure Smart como o tipo de transporte e use o URL padrão.

   Switch#configure terminal
   Switch(config)#license smart transport smart
   Switch(config)#license smart url default

   

   Note: Se um VRF for usado para Transporte Inteligente,license smart vrf precisará ser configurado.

2. Configure o servidor DNS e a interface de origem para a resolução DNS e as conexões de cliente HTTP.

   Switch(config)#ip domain lookup
   Switch(config)#ip name-server 10.31.104.74
   Switch(config)#ip domain name cisco.com
   Switch(config)#ip domain lookup source-interface Vlan10
   

   

   Note: Se um VRF for usado para Transporte Inteligente, a variante VRF desses comandos precisará ser usada.

3. Se necessário, configure um proxy HTTPS.

   Switch(config)#license smart proxy address 192.168.217.105
   Switch(config)#license smart proxy port 80
   

   

   Note: O servidor proxy pode ser configurado usando seu endereço IP ou nome de host.

4. Gere um token na Virtual Account. Para concluir esta etapa, siga o processo descrito neste documento.

5. Instale o código de confiança no switch.

   Switch#license smart trust idtoken NGFkODgzMGUtZmNkMS00NTRjLWI5MjUtYjI0YWYzZjU1ZGQzLTE3NDAyNjU5%0AODA0NTV8VXVHVjdvVjByejY1aVZYa0lCVkl12345FSk9WZTdDb3lhZEZT%0ANjkyST0%3D%0A all force
   
   [OK]
   
   

   Após o estabelecimento confiável bem-sucedido com o CSSM, um syslog semelhante a este é mostrado.

   *Jan 24 23:19:05.144: %SMART_LIC-6-TRUST_INSTALL_SUCCESS: A new licensing trust code was successfully installed on P:C9300-48UN,S:<SN>.
   

   Além disso,show license statusmostra o horário de instalação do código de confiança.

   Switch#show license status  | i Trust
   Trust Code Installed: Jan 24 23:19:05 2025 UTC  <--- Trust code was installed
   

   Por fim, o Log de Eventos de Contas Virtuais mostra que o switch foi adicionado.

   Log de Eventos de Conta Virtual que Mostra o Dispositivo.

Troubleshooting

Se o estabelecimento confiável com CSSM falhar, um syslog indicando o motivo da falha será exibido.

*Jan 24 15:17:46.341: %SMART_LIC-3-COMM_FAILED: Communications failure with the Cisco Smart Software Manager (CSSM) : <Reason>

As possíveis razões para a falha de comunicação incluem:

• Não é possível resolver o nome de host/nome de domínio do servidor: O URL de Transporte Inteligente ou o nome de host do servidor proxy não foi resolvido pelo DNS. Validar configurações de resolução de nome e acessibilidade do servidor DNS.

• Tempo limite da conexão: Houve uma tentativa de conexão, mas não houve resposta. Valide se a conexão HTTPS com o CSSM está sendo estabelecida usando capturas de pacotes e verifique se um dispositivo, como um servidor proxy ou firewall, está bloqueando a conectividade. Se estiver usando um servidor proxy, verifique se a porta correta está em uso.

Siga estas etapas e os comandos de validação para solucionar problemas do SLP com o Smart Transport:

1. Validar logs de eventos do Smart Licensing.

   Switch#show license eventlog 1
   **** Event Log ****
   
   2025-01-24 13:58:23.900 UTC SAEVT_INIT_START version="5.5.29_rel/114"
   2025-01-24 13:58:23.922 UTC SAEVT_INIT_CRYPTO success="False" error="Crypto Initialization has not been completed"
   2025-01-24 13:58:23.922 UTC SAEVT_HA_EVENT eventType="SmartAgentEvtHArmfRegister"
   2025-01-24 13:58:27.620 UTC SAEVT_READY
   2025-01-24 13:58:27.621 UTC SAEVT_ENABLED
   2025-01-24 13:58:27.665 UTC SAEVT_EXPORT_FLAG exportAllowed="False"
   2025-01-24 13:58:27.732 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_SYSDATA_FAIL" MSG="Get-SDL: not the active switch"
   2025-01-24 13:58:27.742 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_SYSDATA_FAIL" MSG="Get-SDL: not the active switch"
   2025-01-24 13:58:27.742 UTC SAEVT_TAG_AUTHORIZED count="1" entitlementTag="regid.2017-05.com.cisco.C9300_48P_NW_Advantagek9,1.0_6a224fe3-c92e-4440-a9c1-5d0e53a54015"
   2025-01-24 13:58:27.744 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_SYSDATA_FAIL" MSG="Get-SDL: not the active switch"
   2025-01-24 13:58:27.744 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_LICENSE_REQUEST" MSG="License network-advantage, dev C9300_48P, count 1, reslt 0, alt 0"
   2025-01-24 13:58:27.763 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_SYSDATA_FAIL" MSG="Get-SDL: not the active switch"
   2025-01-24 13:58:27.767 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_SYSDATA_FAIL" MSG="Get-SDL: not the active switch"
   2025-01-24 13:58:27.767 UTC SAEVT_TAG_AUTHORIZED count="1" entitlementTag="regid.2017-05.com.cisco.C9300_48P_Dna_Advantage,1.0_60783b06-53ee-484c-b21e-615d3cf6837a"
   2025-01-24 13:58:27.767 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_SYSDATA_FAIL" MSG="Get-SDL: not the active switch"
   2025-01-24 13:58:27.768 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_LICENSE_REQUEST" MSG="License dna-advantage, dev C9300_48P, count 1, reslt 0, alt 0"
   2025-01-24 13:58:30.425 UTC SAEVT_HA_EVENT eventType="SmartAgentEvtHArmfInitialize"
   2025-01-24 13:58:30.431 UTC SAEVT_HA_CHASSIS_ROLE udi="PID:C9300-48UN,SN:<SN>"
   2025-01-24 13:58:30.431 UTC SAEVT_HA_EVENT eventType="SmartAgentEvtHAchkptRegister"
   2025-01-24 13:58:37.975 UTC SAEVT_HA_ROLE udi="PID:C9300-48UN,SN:<SN>" haRole="Active"
   2025-01-24 13:58:38.048 UTC SAEVT_HA_CHASSIS_ROLE udi="PID:C9300-48UN,SN:<SN>" haRole="Active"
   2025-01-24 13:58:38.048 UTC SAEVT_HA_ROLE udi="PID:C9300-48UN,SN:<SN>" haRole="Active"
   2025-01-24 13:58:38.062 UTC SAEVT_INIT_CONFIG_READ_BEGIN
   2025-01-24 13:58:40.884 UTC SAEVT_HOSTNAME_CHANGE
   2025-01-24 13:58:41.734 UTC SAEVT_HA_EVENT eventType="SmartAgentSetNVPairs"
   2025-01-24 13:58:42.408 UTC SAEVT_INIT_CONFIG_READ_DONE
   2025-01-24 13:58:42.531 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_OIR_ADD" MSG="OIR Add evt 100 with slot-id 1"
   2025-01-24 13:58:42.531 UTC SAEVT_HA_CONFIG
   2025-01-24 13:58:42.531 UTC SAEVT_HA_UDI udi="PID:C9300-48UN,SN:<SN>" haRole="Active"
   2025-01-24 13:58:42.732 UTC SAEVT_LICENSE_USAGE count="0" type="destroy" entitlementTag="regid.2017-05.com.cisco.C9300_48P_NW_Advantagek9,1.0_6a224fe3-c92e-4440-a9c1-5d0e53a54015"
   2025-01-24 13:58:42.744 UTC SAEVT_LICENSE_USAGE count="0" type="destroy" entitlementTag="regid.2017-05.com.cisco.C9300_48P_Dna_Advantage,1.0_60783b06-53ee-484c-b21e-615d3cf6837a"
   2025-01-24 13:58:43.140 UTC SAEVT_INIT_SYSTEM_INIT
   2025-01-24 13:58:44.143 UTC SAEVT_INIT_CRYPTO success="False" error="Crypto Initialization has not been completed"
   2025-01-24 13:59:14.143 UTC SAEVT_INIT_CRYPTO success="True"
   2025-01-24 13:59:14.144 UTC SAEVT_COMM_RESTORED
   2025-01-24 13:59:14.176 UTC SAEVT_INIT_COMPLETE
   2025-01-24 14:00:14.145 UTC SAEVT_PRIVACY_CHANGED enabled="True"
   2025-01-24 14:00:27.432 UTC SAEVT_UTILITY_REPORT_START
   2025-01-24 15:17:46.341 UTC SAEVT_COMM_FAIL error="Connection timed out".  <--- Connection timed out
   2025-01-24 15:35:22.627 UTC SAEVT_COMM_RESTORED <--- Communication with CSSM restored
   
   

2. Valide a conectividade com o CSSM enviando um ping e tentando uma conexão telnet. Isso verifica se a resolução de nomes está ocorrendo e se não há nenhum bloco administrativo entre o switch e o CSSM.

   Switch#show ip interface brief | exclude unassigned
   Interface              IP-Address      OK? Method Status                Protocol
   Vlan10                 10.31.121.118   YES DHCP   up                    up      
   
   Switch#ping  smartreceiver.cisco.com source Vlan10
   Type escape sequence to abort.
   Sending 5, 100-byte ICMP Echos to X.X.X.X, timeout is 2 seconds:
   !!!!!
   Success rate is 100 percent (5/5), round-trip min/avg/max = 364/365/368 ms
   
   Switch#telnet  smartreceiver.cisco.com 443 /ipv4 /source-interface vlan10
   Trying X.X.X.X, 80 ... Open
   
   [Connection to X.X.X.X closed by foreign host]
   
   

   Como alternativa, se um servidor proxy estiver sendo usado, você poderá tentar os mesmos comandos usando o endereço IP e a porta do servidor proxy.

   Switch#ping  192.168.217.105
   Type escape sequence to abort.
   Sending 5, 100-byte ICMP Echos to 192.168.217.105, timeout is 2 seconds:
   !!!!!
   Success rate is 100 percent (5/5), round-trip min/avg/max = 364/365/368 ms
   
   Switch#telnet  192.168.217.105 80 /ipv4 /source-interface vlan10
   Trying 192.168.217.105, 80 ... Open
   
   [Connection to 192.168.217.105 closed by foreign host]
   

3. Valide se os relatórios RUM estão sendo enviados e se há uma resposta.

   Switch#show license history message        
   
   Message History (oldest to newest):
   ====================================================
   Trust Establishment:
     REQUEST: Jan 24 23:18:59 2025 UTC    <--- RUM report was sent
   {"request":"{\"header\":{\"request_type\":\"ID_TOKEN_TRUST\",\"sudi\":{\"udi_pid\":\"C9300-48UN\",\"udi_serial_number\":\"<SN>\"},\"version\":\"1.3\",\"locale\":\"en_US.UTF-8\",\"product_instance_identifier\":\"\",\"nonce\":\"8620723070430261290\",\"timestamp\":1737760739943,\"connect_info\":{\"name\":\"C_agent\",\"version\":\"5.5.29_rel/114\",\"production\":true,\"additional_info\":\"\",\"capabilities\":[\"UTILITY\",\"DLC\",\"AppHA\",\"MULTITIER\",\"EXPORT_2\",\"OK_TRY_AGAIN\",\"POLICY_USAGE\",\"POLICY_USAGE\"]}},\"request_data\":\"{\\\"sudi\\\":{\\\"udi_pid\\\":\\\"C9300-48UN\\\",\\\"udi_serial_number\\\":\\\"<SN>\\\"},\\\"timestamp\\\":1737760738052,\\\"nonce\\\":\\\"8620723070430261290\\\",\\\"product_instance_identifier\\\":\\\"\\\",\\\"hostname\\\":\\\"Switch\\\",\\\"token\\\":\\\"<TOKEN>\\\",\\\"mode\\\":\\\"PERMANENT\\\",\\\"force\\\":true,\\\"software_tag_identifier\\\":\\\"regid.2017-05.com.cisco.C9300,v1_727af1d9-6c39-4444-b301-863f81445b72\\\",\\\"device_list\\\":[{\\\"sudi\\\":{\\\"udi_pid\\\":\\\"C9300-48UN\\\",\\\"udi_serial_number\\\":\\\"<SN>\\\"},\\\"trust_id\\\":612,\\\"software_tag_identifier\\\":\\\"regid.2017-05.com.cisco.C9300,v1_727af1d9-6c39-4444-b301-863f81445b72\\\",\\\"product_instance_identifier\\\":\\\"\\\",\\\"csr\\\":\\\"MIICnjCCAYYCAQAwODE2MDQGA1UEAxMtOTFEMjVFMTcwRDM5RDAzOUI5M0VFMTE1Q0VDQTA4MEJDRjI4ODg1MTo6MSwyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq7F1KkAKcIUuHDIF+IilYAXIKew4Pz42X3Pz49nVwm93e3lURk7I5f8W9Q6Pe6JiRYsgmpvdZgbQcX6pi57oYw/E50C76JDLChQ4uB9S5NyaYwdj3QaK2Uw9pNlu0JsUXaShtXMi3JC1kcXG1qGfMxYp/LBJUub8BxtOB71b5a4CX0Sz08pB3y4WhYd8o43xT4lxe0LiBITG6Ds6TO228/9LFKD9O65wiVP7Pg2w5A6lsgQjGg1XU0dfNyD5+zmzKK5YiObi2X3wQFgKRBUX6T0v7RkWRmDuRyWz5tiDPZtVxRRXPq91dxTK2C6+jrTZ7HaE9vTunqGFsWNYjxBLXwIDAQABoCEwHwYJKoZIhvcNAQkOMRIwEDAOBgNVHQ8BAf8EBAMCBaAwDQYJKoZIhvcNAQELBQADggEBAD8vAO7LrD2yEubZPE4/OW+8pAHXRSpW4SQGP99dwiGpYT/0+8iD9wjyBWPZU5ysmYSAKlUzFqB57MIqXjHUdMAZnypL59YALXjVkAAJzof+bpwTIgvy2oYxsNvfW4AkuslJOUPINW9crqIMFEKSlNgcmaYHd6u/KO3tk5vufPM0vh2xnIHLyWlwBlga+TOS1VNwZl8PFSHTY7OAzd2d6c6+je+CSl1QvHZVmW5KgrkUIbv+YsAieZD7a2bTWOcdYR3AVqm34c3luzqTn6rq/xaTaGbi1dyR1PlD4uEDQeSewdkpTrmyWhYHUdLuN4c3NhIZqOAoaOk1TE1QGJSSh5s=\\\",\\\"id_cert_sn\\\":\\\"\\\"}]}\"}"}
     RESPONSE: Jan 24 23:19:05 2025 UTC   <--- Response from CSSM was received
   {"signature":{"type":null,"value":null,"piid":null,"cert_sn":null},"response":"{\"header\":{\"version\":\"1.3\",\"locale\":\"en_US.UTF-8\",\"timestamp\":1737760824972,\"nonce\":\"8620723070430261290\",\"request_type\":\"ID_TOKEN_TRUST\",\"sudi\":{\"udi_pid\":\"C9300-48UN\",\"udi_serial_number\":\"<SN>\"},\"agent_actions\":null,\"connect_info\":{\"name\":\"SSM\",\"version\":\"1.3\",\"production\":true,\"capabilities\":[\"DLC\",\"AppHA\",\"EXPORT_2\",\"POLICY_USAGE\",\"UTILITY\"],\"additional_info\":\"\"},\"product_instance_identifier\":\"\",\"id_cert_serial_number\":null,\"signing_cert_serial_number\":null},\"status_code\":\"OK\",\"status_message\":\"OK\",\"retry_time_seconds\":0,\"response_data\":\"{\\\"nonce\\\":\\\"8620723070430261290\\\",\\\"sudi\\\":{\\\"udi_pid\\\":\\\"C9300-48UN\\\",\\\"udi_serial_number\\\":\\\"<SN>\\\"},\\\"smart_account_name\\\":\\\"<ACCOUNT>\\\",\\\"pool_name\\\":\\\"<VIRTUAL_ACCOUNT>\\\",\\\"device_list\\\":[{\\\"sudi\\\":{\\\"udi_pid\\\":\\\"C9300-48UN\\\",\\\"udi_serial_number\\\":\\\"<SN>\\\"},\\\"smart_license\\\":\\\<LICENSE>\\\",\\\"product_instance_identifier\\\":\\\"6c5ea69b-4881-4396-bfa6-6a53bd5894a4\\\"}]}\"}","sch_response":null}
   
   
   Usage Reporting:
     No past history
   Result Polling:
     No past history
   Authorization Request:
     No past history
   Authorization Return:
     No past history
   Trust Sync:
     No past history
   
   Import Message History (oldest to newest):
   ====================================================
   Import POLICY:
     No past Import history
   
   Import AUTH:
     No past Import history
   
   Import TRUST CODE:
   Received on Jan 24 23:19:05 2025 UTC
     <TRUST_CODE>
   
   
   Import RUM ACK:
     No past Import history
   
   Import CONVERSION ACK:
     No past Import history
   
   Import ACCOUNT INFO:
     Last policy received on Jan 24 23:19:05 2025 UTC
     <ACCOUNT_INFO>
   
   
   Switch#show license tech support | sec Trust
   Trust Establishment:
     Attempts: Total=1, Success=1, Fail=0  Ongoing Failure: Overall=0 Communication=0
     Last Response: OK on Jan 24 23:19:05 2025 UTC  <--- Trust establishment succeeded
       Failure Reason: 
     Last Success Time: Jan 24 23:19:05 2025 UTC
     Last Failure Time: 
   Trust Acknowledgement:
     Attempts: Total=0, Success=0, Fail=0  Ongoing Failure: Overall=0 Communication=0
     Last Response: 
       Failure Reason: 
     Last Success Time: 
     Last Failure Time: 
   Trust Sync:
     Attempts: Total=1, Success=1, Fail=0  Ongoing Failure: Overall=0 Communication=0
     Last Response: OK on Jan 24 23:19:50 2025 UTC
       Failure Reason: 
     Last Success Time: Jan 24 23:19:50 2025 UTC
     Last Failure Time: 
   Trusted Store Interface: True
   Local Device: P:C9300-48UN,S:, state[2], Trust Data INSTALLED  TrustId:612
   Overall Trust: INSTALLED (2) <--- Trust code installed
   
   

   Se a solicitação for enviada, mas não houver resposta do CSSM, oshow license history messagecomando não mostrará dados JSON para a resposta fornecida e mais detalhes sobre a falha poderão ser obtidos.

   Switch#show license history message                     
   ! <--- Output omitted for brevity --->
   Trust Establishment:
     REQUEST: Feb 21 16:54:49 2025 UTC
   {"request":"{\"header\":{\"request_type\":\"ID_TOKEN_TRUST\",\"sudi\":{\"udi_pid\":\"C9300X-12Y\",\"udi_serial_number\":\"<SN>\"},\"version\":\"1.3\",\"locale\":\"en_US.UTF-8\",\"product_instance_identifier\":\"\",\"nonce\":\"418461674986421033\",\"timestamp\":1740156889326,\"connect_info\":{\"name\":\"C_agent\",\"version\":\"5.5.29_rel/114\",\"production\":true,\"additional_info\":\"\",\"capabilities\":[\"UTILITY\",\"DLC\",\"AppHA\",\"MULTITIER\",\"EXPORT_2\",\"OK_TRY_AGAIN\",\"POLICY_USAGE\",\"POLICY_USAGE\"]}},\"request_data\":\"{\\\"sudi\\\":{\\\"udi_pid\\\":\\\"C9300X-12Y\\\",\\\"udi_serial_number\\\":\\\"<SN>\\\"},\\\"timestamp\\\":1740156888584,\\\"nonce\\\":\\\"418461674986421033\\\",\\\"product_instance_identifier\\\":\\\"\\\",\\\"hostname\\\":\\\"F241.24.06-9300-1\\\",\\\"token\\\":\\\"MzgwMDAwMTItOGVkOC00OWExLTgzZmEtMzVhNTZkMDAyNTJhLTE3NDI3NDgy%0ANDkyMTF8U1N4MFV0RDgzdytvY0EwL1FrRHBEaDJ6bW8yTDlpa3BsazJKbkxE%0ASXpwND0%3D%0A\\\",\\\"mode\\\":\\\"PERMANENT\\\",\\\"force\\\":true,\\\"software_tag_identifier\\\":\\\"regid.2017-05.com.cisco.C9300,v1_727af1d9-6c39-4444-b301-863f81445b72\\\",\\\"device_list\\\":[{\\\"sudi\\\":{\\\"udi_pid\\\":\\\"C9300X-12Y\\\",\\\"udi_serial_number\\\":\\\"<SN>\\\"},\\\"trust_id\\\":497,\\\"software_tag_identifier\\\":\\\"regid.2017-05.com.cisco.C9300,v1_727af1d9-6c39-4444-b301-863f81445b72\\\",\\\"product_instance_identifier\\\":\\\"\\\",\\\"csr\\\":\\\"MIICnjCCAYYCAQAwODE2MDQGA1UEAxMtODhFMzcyODRBOTYwN0U1MDhERDJCMTdERkYyNTJBOTZDQjA1ODNENzo6MSwyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxTl8H93Q05evxmYkBYIq1hwyXqmkw24AHfnxGLFw7SaiN3bCKmYnG31vYzAbgcq3fq2LD6dtzFLrXm7t43wiF+kLtkgh4a+W9cl6PaiPXr9pxEBSxuMokfUZBd9OU7e83wCtH+0bUeSsdFHpTyIiynodF92NHwjsR4eRB5fAnx1qqbZBNa4ntgj11HQ1X9pN31PY7Wc18iEGRhYgR5ljGpgvhnfzno6M8jG4wplxuiA3oWvYO8BaXkQHRf6QofQIXfmsgGAddtJqw2UzcSLWaelbuHB1yhnhWTD5mpRFQYxuLU87ndr/G8PaCreJ/RzjikSLgEes4hF34i13ab8LGwIDAQABoCEwHwYJKoZIhvcNAQkOMRIwEDAOBgNVHQ8BAf8EBAMCBaAwDQYJKoZIhvcNAQEFBQADggEBAAOUiLz9nZ+C2mGI31ZqrK1iV/C1GWNXJajWisRhFBgSANgFs7cLfAJhZtEXF1PY+0PQGRAeR/zwCpYwIq/cI7jLjqXAaHkNmEeRsidWv+pMxNwjR4csSJk+PNqeqwXzVIhsJTEU5E8jchwzI1i26STUDjKJhHW+Z1wgDYBCPldl2CA2D7c71s4/UirEPoEEiFtrxtGi8KvldRPFEis8vaX8OGNV4H/t1+SSU4UW5resHpABusJSM2SJNTOsX6f+7IULqPQJjoGs0pqu+EyHcjglSYolMsIqE1x9jzdKGN+wy3p4my3a0PNfiHF3RofSkXMk++idw9v8+kHV9m+Ym9A=\\\",\\\"id_cert_sn\\\":\\\"\\\"}]}\"}"}
     RESPONSE: Feb 21 16:54:49 2025 UTC
                                               <--- The line is empty, which means there was no response from CSSM
   
     REQUEST: Feb 21 16:55:19 2025 UTC
   {"request":"{\"header\":{\"request_type\":\"ID_TOKEN_TRUST\",\"sudi\":{\"udi_pid\":\"C9300X-12Y\",\"udi_serial_number\":\"<SN>\"},\"version\":\"1.3\",\"locale\":\"en_US.UTF-8\",\"product_instance_identifier\":\"\",\"nonce\":\"17639638978924380272\",\"timestamp\":1740156919824,\"connect_info\":{\"name\":\"C_agent\",\"version\":\"5.5.29_rel/114\",\"production\":true,\"additional_info\":\"\",\"capabilities\":[\"UTILITY\",\"DLC\",\"AppHA\",\"MULTITIER\",\"EXPORT_2\",\"OK_TRY_AGAIN\",\"POLICY_USAGE\",\"POLICY_USAGE\"]}},\"request_data\":\"{\\\"sudi\\\":{\\\"udi_pid\\\":\\\"C9300X-12Y\\\",\\\"udi_serial_number\\\"
   ! <--- Output omitted for brevity --->
   
   
   Switch#show license tech support | sec Trust
   Trust Establishment:
   Attempts: Total=2, Success=0, Fail=2 Ongoing Failure: Overall=2 Communication=2
   Last Response: NO REPLY on Feb 21 16:55:39 2025 UTC <--- Failure reason was NO REPLY
   Failure Reason: <none>
   Last Success Time: <none>
   Last Failure Time: Feb 21 16:55:39 2025 UTC
   Trust Acknowledgement:
   Attempts: Total=0, Success=0, Fail=0 Ongoing Failure: Overall=0 Communication=0
   Last Response: <none>
   Failure Reason: <none>
   Last Success Time: <none>
   Last Failure Time: <none>
   Trust Sync:
   Attempts: Total=0, Success=0, Fail=0 Ongoing Failure: Overall=0 Communication=0
   Last Response: <none>
   Failure Reason: <none>
   Last Success Time: <none>
   Last Failure Time: <none>
   Trusted Store Interface: True
   Local Device: P:C9300-48UN,S:<SN>, state[1], NOT INSTALLED TrustId:605 <--- Trust point exists but it is not installed yet
   Overall Trust: No ID

4. Acione o switch para enviar um relatório RUM para sincronizar com o CSSM.

   Switch#show clock 
   *23:38:54.683 UTC Fri Jan 24 2025
   
   Switch#show license tech support | i Utility             
   Utility:
   Start Utility Measurements: Jan 24 23:35:55 2025 UTC (4 minutes, 38 seconds remaining)
   Send Utility RUM reports: Feb 23 23:20:56 2025 UTC (29 days, 23 hours, 49 minutes, 39 seconds remaining) <--- Next RUM report to be sent in 29 days
   Process Utility RUM reports: Jan 25 23:30:58 2025 UTC (23 hours, 59 minutes, 41 seconds remaining)
   
   
   Switch#show license history message | i REQUEST
     REQUEST: Jan 24 23:18:59 2025 UTC
     REQUEST: Jan 24 23:20:50 2025 UTC
     REQUEST: Jan 24 23:25:55 2025 UTC
     REQUEST: Jan 24 23:19:41 2025 UTC
   
   Switch#license smart sync all <--- Trigger synchronization
   
   Switch#show license history message | i REQUEST
     REQUEST: Jan 24 23:18:59 2025 UTC
     REQUEST: Jan 24 23:20:50 2025 UTC
     REQUEST: Jan 24 23:25:55 2025 UTC
     REQUEST: Jan 24 23:19:41 2025 UTC
     REQUEST: Jan 24 23:39:05 2025 UTC <--- New RUM report was sent
   
   
   Switch#show license tech support | sec Trust
   Trust Establishment:
     Attempts: Total=1, Success=1, Fail=0  Ongoing Failure: Overall=0 Communication=0
     Last Response: OK on Jan 24 23:19:05 2025 UTC
       Failure Reason: 
     Last Success Time: Jan 24 23:19:05 2025 UTC
     Last Failure Time: 
   Trust Acknowledgement:
     Attempts: Total=0, Success=0, Fail=0  Ongoing Failure: Overall=0 Communication=0
     Last Response: 
       Failure Reason: 
     Last Success Time: 
     Last Failure Time: 
   Trust Sync:
     Attempts: Total=2, Success=2, Fail=0  Ongoing Failure: Overall=0 Communication=0
     Last Response: OK on Jan 24 23:39:14 2025 UTC  <--- Successful response from CSSM
       Failure Reason: 
     Last Success Time: Jan 24 23:39:14 2025 UTC
     Last Failure Time: 
   Trusted Store Interface: True
   Local Device: P:C9300-48UN,S:<SN>, state[2], Trust Data INSTALLED  TrustId:612
   Overall Trust: INSTALLED (2)
   
   

5. Para confirmar que o switch está estabelecendo a conexão HTTPS com o CSSM, você pode fazer uma captura de pacote. Este é um exemplo de captura de pacote de uma conexão bem-sucedida usando um servidor proxy.

   Switch#sh ip cef 10.31.104.78
   0.0.0.0/0
     nexthop 10.31.121.65 Vlan10
     
   Switch#sh ip arp 10.31.121.65
   Protocol  Address          Age (min)  Hardware Addr   Type   Interface
   Internet  10.31.121.65            0   2c31.24b1.6bc6  ARPA   Vlan10
   
   Switch#show mac address-table address 2c31.24b1.6bc6
             Mac Address Table
   -------------------------------------------
   
   Vlan    Mac Address       Type        Ports
   ----    -----------       --------    -----
     10    2c31.24b1.6bc6    DYNAMIC     Fi1/0/48
   Total Mac Addresses for this criterion: 1
   
   Switch#monitor capture CSSM interface Fi1/0/48 both match any 
   Switch#monitor capture CSSM start
   Started capture point : CSSM
   
   Switch#show clock
   *15:41:10.058 UTC Fri Jan 24 2025
   
   Switch#license smart sync all
   
   Switch#sh license hist mess | i REQUEST
    REQUEST: Jan 24 15:35:17 2025 UTC
    REQUEST: Jan 24 15:41:58 2025 UTC
   
   Switch#monitor capture CSSM stop
   
   Switch#monitor capture CSSM export location flash:slp-proxy-https-connection.pcap
   Export Started Successfully

   Captura de pacote de conexão HTTPS bem-sucedida com o CSSM usando um servidor proxy.

6. Se a captura de pacote mostrar que a conexão HTTPS está tentando ser estabelecida, mas falhar, isso pode ser devido a uma falha de handshake TLS ou SSL. Essas depurações podem ser usadas para investigação adicional.

   debug ip http client all
   debug ssl openssl states 
   debug ssl openssl errors 
   debug crypto pki messages 
   debug crypto pki transactions
   

7. Se, em algum momento, o código de confiança instalado precisar ser removido do switch, uma redefinição de fábrica do Smart Licensing poderá ser executada. Este processo requer um recarregamento. Após a redefinição de fábrica, um novo código de confiança pode ser instalado. O uso desse comando remove todas as informações de licenciamento, incluindo a política.

   Switch#license smart factory reset 
   %Warning: reload required after "license smart factory reset" command
   
   Switch#show license status | include Trust
   Trust Code Installed:   <--- Installed trust code now shows none
   
   Switch#reload

Informações Relacionadas

• Licenciamento inteligente usando política para switches Cisco Catalyst 9000 Series
• Entender o Smart Licensing para switches Catalyst
• Cisco Live: Introdução ao Smart Licensing usando políticas
• Suporte técnico e downloads da Cisco