在Catalyst 8300在线（自治）模式下安装HSEC许可证

简介

本文档介绍如何在在线模式下在Catalyst 8300路由器中安装HSEC许可证。

先决条件

有关以下主题的知识：

• 智能许可知识
• Cisco IOS® XE知识
• HSEC许可证知识。此许可证也称为出口管制许可证。

路由器必备条件：

• 路由器在自主模式下运行。使用show version命令进行验证。
• 路由器需要预先加载和配置Cisco DNA许可证引导级别。请参阅配置Catalyst 8000系列物理平台的许可证和吞吐量
• 路由器需要已与Cisco软件智能管理器(CSSM)进行对话并收到确认信息。请参阅直接连接到CSSM的路由器部分在Cisco IOS XE路由器上使用策略配置智能许可。

背景信息

配置Catalyst 8000系列物理平台的许可证和吞吐量中有官方指南，但是它描述了不同Catalyst 8000路由器平台之间的许可功能的混合。

本指南仅针对直接连接到思科智能软件管理器(CSSM)的实例在自主模式下运行的8300。

使用的组件

在本文中，请使用以下元素：

• C8300-1N1S-4T2X路由器。但是，所述的步骤适用于任何8300 catalyst路由器

• 思科IOS XE版本17.15.03a
• 在自主模式下运行的路由器

注意：确保您拥有最新版本的软件，是稳定的Golden Star或推荐版本。

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。

概念

智能许可证授权码(SLAC)

智能许可证授权码是需要安装到设备才能使用HSEC许可证的代码。

此代码需要由设备请求并安装在设备上。然后，它允许您为加密流量配置更高的吞吐量级别。

请参阅配置Catalyst 8000系列物理平台的许可证和吞吐量的官方文档指南中的HSECK9许可证使用指南部分。

有关章节的详细信息：使用策略的智能许可任务库。

思科软件智能管理器(CSSM)

这是管理许可证的云中的远程服务器实体。

CSSM可在Cisco Software Central中访问，您可以在此处访问旧版智能软件管理器，也可以在Cisco License Central中访问更新的网页版本。

注意：确保为您的域拥有智能帐户。请参阅如何创建智能帐户？。

步骤

步骤1.确保设备具有Cisco DNA引导级别

请参阅Matrix Cisco DNA Software、SD-WAN and Routing Matrix，了解Cisco DNA引导级别和功能。

使用命令show version确保您的设备具有引导级别：

Router#show version

Technology Package License Information: 
          
-----------------------------------------------------------------
Technology     Type         Technology-package Technology-package
                            Current            Next Reboot       
-----------------------------------------------------------------
Smart License  Perpetual    network-advantage  network-advantage 
Smart License  Subscription dna-advantage      dna-advantage

步骤2.定义智能传输和默认URL

Router(config)#license smart transport smart 
Router(config)#license smart url default 

步骤3.定义代理（如果需要）

Router(config)#license smart proxy address 

Router(config)#license smart proxy port 

步骤4.确保令牌用于注册允许的导出控制功能

当设备注册到CSSM时，请确保允许使用允许导出控制功能的令牌，如下屏幕截图所示：

步骤5.在设备中配置令牌

Router#license smart trust idtoken  all force   

在show log中您可以看到与CSSM的通信已恢复，并且信任代码已安装

*Dec  1 23:42:28.633: %SMART_LIC-5-COMM_RESTORED: Communications with Cisco Smart Software Manager (CSSM) restored
*Dec  1 23:42:28.656: %SMART_LIC-6-POLICY_INSTALL_SUCCESS: A new licensing policy was successfully installed 
*Dec  1 23:42:28.720: %SMART_LIC-6-TRUST_INSTALL_SUCCESS: A new licensing trust code was successfully installed on P:C8300-1N1S-4T2X,S:.

步骤6.使用show license status命令检验已安装的信任代码和已收到的ACK

Router#show license status
Utility:
  Status: DISABLED

Smart Licensing Using Policy:
  Status: ENABLED

Account Information:
  Smart Account:  As of Dec 01 23:41:50 2025 UTC
  Virtual Account: 

Data Privacy:
  Sending Hostname: yes
    Callhome hostname privacy: DISABLED
    Smart Licensing hostname privacy: DISABLED
  Version privacy: DISABLED

Transport:
  Type: Smart
  URL: https://smartreceiver.cisco.com/licservice/license
  Proxy:
    Address: 

    Port: 
    Username: 
    Password: 
  VRF: 

Policy:
  Policy in use: Installed On Dec 01 23:42:28 2025 UTC
  Policy name: SLE Policy
  Reporting ACK required: yes (Customer Policy)
  Unenforced/Non-Export Perpetual Attributes:
    First report requirement (days): 30 (Customer Policy)
    Reporting frequency (days): 60 (Customer Policy)
    Report on change (days): 60 (Customer Policy)
  Unenforced/Non-Export Subscription Attributes:
    First report requirement (days): 120 (Customer Policy)
    Reporting frequency (days): 111 (Customer Policy)
    Report on change (days): 111 (Customer Policy)
  Enforced (Perpetual/Subscription) License Attributes:
    First report requirement (days): 30 (Customer Policy)
    Reporting frequency (days): 90 (Customer Policy)
    Report on change (days): 60 (Customer Policy)
  Export (Perpetual/Subscription) License Attributes:
    First report requirement (days): 30 (Customer Policy)
    Reporting frequency (days): 30 (Customer Policy)
    Report on change (days): 30 (Customer Policy)
          
Miscellaneous:
  Custom Id: 

Usage Reporting:
  Last ACK received: Dec 01 23:48:00 2025 UTC<<<<<<<< ACK
  Next ACK deadline: Jan 30 23:48:00 2026 UTC
  Reporting push interval: 30  days
  Next ACK push check: 
  Next report push: Dec 31 23:43:03 2025 UTC
  Last report push: Dec 01 23:43:03 2025 UTC
  Last report file write: 

Trust Code Installed: Dec 01 23:42:28 2025 UTC<<<<<<<<<<
 
Device Telemetry Report Summary:
================================
Data Channel: AVAILABLE
Reports on disk: 1

步骤7.使用show license authorization命令检验现有授权

Show license authorization显示是否已安装HSEC或导出控制的授权代码。

注意：某些设备已在工厂安装此智能许可证授权码(SLAC)（如果订单中包含此授权码）。

Router#show license authorization
Last Data Push: 
Last File Export: 

Overall status:
  Active: PID:C8300-1N1S-4T2X,SN:
    Status: NOT INSTALLED

Purchased Licenses:
  No Purchase Information Available



Router#

如果未安装，请继续执行下一步。

步骤8.请求SLAC

如果尚未安装授权码，请从产品实例（即设备）请求SLAC代码。

要请求SLAC，请使用命令license feature hseck9:

Router(config)#license feature hseck9

之后，您可以看到SLAC代码已成功导入：

Router(config)#
*Dec  1 23:55:06.978: %SMART_LIC-6-AUTHORIZATION_INSTALL_SUCCESS: A new licensing authorization code was successfully installed on PID:C8300-1N1S-4T2X,SN:
*Dec  1 23:55:07.004: %SMART_LIC-6-EXPORT_CONTROLLED: Usage of export controlled features is allowed for feature hseck9

步骤9.检验授权

请求SLAC后，您可以通过运行show license authorization来验证是否已正确安装授权代码：

Router#show license authorization 
Last Data Push: Dec 01 23:55:06 2025 UTC via Smart
Last File Export: 

Overall status:
  Active: PID:C8300-1N1S-4T2X,SN:
    Status: SMART AUTHORIZATION INSTALLED on Dec 01 23:55:06 2025 UTC
    Last Confirmation code: 

Authorizations:
  Router US Export Lic. for DNA (DNA_HSEC):
    Description: U.S. Export Restriction Compliance license for DNA based Routers
    Total available count: 1
    Enforcement type: EXPORT RESTRICTED
    Term information:
      Active: PID:C8300-1N1S-4T2X,SN:
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1

Purchased Licenses:
  No Purchase Information Available

          

Router#

在门户中，验证许可证已使用和保留：

更改吞吐量

成功安装SLAC后，相应地更改吞吐量：

Router(config)#platform hardware throughput crypto 2.5G
% These values don't take effect until the next reboot. Please save the configuration.
Router(config)#
*Dec  2 00:01:19.108: %CRYPTO_SL_TP_LEVELS-6-SAVE_CONFIG_AND_RELOAD: New throughput level not applied until reload; please save config
Router(config)#do wr
Building configuration...
[OK]
Router(config)#
*Dec  2 00:01:28.776: %SYS-6-PRIVCFG_ENCRYPT_SUCCESS: Successfully encrypted private config file
Router(config)#do reload
WARNING: 
Boot variable either does not exist or buffer is too small
This may impact autoboot of the router. Proceed with caution
Do you wish to proceed with reload anyway[confirm]
Proceed with reload? [confirm]

注意：默认情况下，非加密流量不受限制。

通过show platform hardware throughput crypto命令验证当前的加密吞吐量：

Router#show platform hardware throughput crypto 
Current configured crypto throughput level: 2.5G