此产品的文档集力求使用非歧视性语言。在本文档集中,非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言,文档中可能无法确保完全使用非歧视性语言。 深入了解思科如何使用包容性语言。
思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言,希望全球的用户都能通过各自的语言得到支持性的内容。 请注意:即使是最好的机器翻译,其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任,并建议您总是参考英文原始文档(已提供链接)。
本文档介绍如何使用Catalyst 9000交换机上的智能传输对使用策略(SLP)的智能许可进行故障排除。
思科建议您了解并熟悉以下主题:
在Cisco IOS® XE设备上使用策略的智能许可。
本文档中的信息基于以下软件和硬件版本:
注意:有关在其他思科平台上启用这些功能所使用的命令,请参阅相应的配置指南。
本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始(默认)配置。如果您的网络处于活动状态,请确保您了解所有命令的潜在影响。
使用策略的智能许可是智能许可的增强版本,其设计的主要目标是提供许可解决方案,确保您的网络运营保持不间断。它不是破坏性的,而是建立合规性关系,说明您购买和使用的硬件和软件许可证。
为使智能许可报告正常工作,Catalyst 9000交换机与思科智能软件管理器(CSSM)连接以报告许可证使用情况。CSSM是一个集中式平台,用于管理所有思科软件许可证并审核使用情况,这有助于规划未来的许可需求。
Catalyst 9000交换机可通过多种拓扑连接到CSSM,但本文档重点介绍交换机直接连接到CSSM的特定拓扑。这意味着交换机必须能够与托管在Internet上的CSSM连接并建立连接。
在此直接连接拓扑中,有两个传输选项:Smart Transport和Call Home,建议使用Smart Transport。此外,智能传输支持使用HTTPS代理并允许选择特定VRF来处理与CSSM的智能许可通信。
使用智能传输时,Catalyst 9000交换机在HTTPS消息中与CSSM以JavaScript对象表示法(JSON)格式交换许可证使用信息。此信息称为RUM报告,由交换机发送,来自CSSM的响应称为ACK。
此拓扑的最小报告频率被限制为一天。这意味着产品实例每天最多发送一个RUM报告,从而防止针对某些许可证生成和传输过多的报告。这有助于解决因RUM报告超量生成导致的内存相关问题和系统减速。
如果需要,您可以在特权EXEC模式下使用license smart sync
命令来覆盖此限制
按照以下步骤使用智能传输配置SLP:
将智能配置为传输类型,并使用默认URL。
Switch#configure terminal
Switch(config)#license smart transport smart
Switch(config)#license smart url default
注意:如果将VRF用于智能传输license smart vrf
,则需要配置。
为DNS解析和HTTP客户端连接配置DNS服务器和源接口。
Switch(config)#ip domain lookup
Switch(config)#ip name-server 10.31.104.74
Switch(config)#ip domain name cisco.com
Switch(config)#ip domain lookup source-interface Vlan10
注意:如果将VRF用于智能传输,则需要使用这些命令的VRF变体。
如果需要,请配置HTTPS代理。
Switch(config)#license smart proxy address 192.168.217.105
Switch(config)#license smart proxy port 80
注意:可以使用代理服务器的IP地址或主机名配置代理服务器。
在虚拟帐户中生成令牌。要完成此步骤,请按照本文档中概述的流程操作。
在交换机上安装信任代码。
Switch#license smart trust idtoken NGFkODgzMGUtZmNkMS00NTRjLWI5MjUtYjI0YWYzZjU1ZGQzLTE3NDAyNjU5%0AODA0NTV8VXVHVjdvVjByejY1aVZYa0lCVkl12345FSk9WZTdDb3lhZEZT%0ANjkyST0%3D%0A all force [OK]
使用CSSM成功建立信任后,将显示类似如下的系统日志。
*Jan 24 23:19:05.144: %SMART_LIC-6-TRUST_INSTALL_SUCCESS: A new licensing trust code was successfully installed on P:C9300-48UN,S:<SN>.
此外show license status
,还显示信任代码安装时间。
Switch#show license status | i Trust Trust Code Installed: Jan 24 23:19:05 2025 UTC <--- Trust code was installed
最后,虚拟帐户事件日志显示交换机已添加。
显示设备的虚拟帐户事件日志。
如果使用CSSM建立信任失败,将显示指示失败原因的系统日志。
*Jan 24 15:17:46.341: %SMART_LIC-3-COMM_FAILED: Communications failure with the Cisco Smart Software Manager (CSSM) : <Reason>
通信失败的可能原因包括:
无法解析服务器主机名/域名:DNS未解析智能传输URL或代理服务器主机名。验证DNS服务器的名称解析配置和可达性。
连接超时:已尝试连接,但没有响应。使用数据包捕获验证正在建立与CSSM的HTTPS连接,并检查设备(如代理服务器或防火墙)是否正在阻止连接。如果使用代理服务器,请确保使用正确的端口。
按照以下步骤和验证命令对使用智能传输的SLP进行故障排除:
验证智能许可事件日志。
Switch#show license eventlog 1 **** Event Log **** 2025-01-24 13:58:23.900 UTC SAEVT_INIT_START version="5.5.29_rel/114" 2025-01-24 13:58:23.922 UTC SAEVT_INIT_CRYPTO success="False" error="Crypto Initialization has not been completed" 2025-01-24 13:58:23.922 UTC SAEVT_HA_EVENT eventType="SmartAgentEvtHArmfRegister" 2025-01-24 13:58:27.620 UTC SAEVT_READY 2025-01-24 13:58:27.621 UTC SAEVT_ENABLED 2025-01-24 13:58:27.665 UTC SAEVT_EXPORT_FLAG exportAllowed="False" 2025-01-24 13:58:27.732 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_SYSDATA_FAIL" MSG="Get-SDL: not the active switch" 2025-01-24 13:58:27.742 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_SYSDATA_FAIL" MSG="Get-SDL: not the active switch" 2025-01-24 13:58:27.742 UTC SAEVT_TAG_AUTHORIZED count="1" entitlementTag="regid.2017-05.com.cisco.C9300_48P_NW_Advantagek9,1.0_6a224fe3-c92e-4440-a9c1-5d0e53a54015" 2025-01-24 13:58:27.744 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_SYSDATA_FAIL" MSG="Get-SDL: not the active switch" 2025-01-24 13:58:27.744 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_LICENSE_REQUEST" MSG="License network-advantage, dev C9300_48P, count 1, reslt 0, alt 0" 2025-01-24 13:58:27.763 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_SYSDATA_FAIL" MSG="Get-SDL: not the active switch" 2025-01-24 13:58:27.767 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_SYSDATA_FAIL" MSG="Get-SDL: not the active switch" 2025-01-24 13:58:27.767 UTC SAEVT_TAG_AUTHORIZED count="1" entitlementTag="regid.2017-05.com.cisco.C9300_48P_Dna_Advantage,1.0_60783b06-53ee-484c-b21e-615d3cf6837a" 2025-01-24 13:58:27.767 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_SYSDATA_FAIL" MSG="Get-SDL: not the active switch" 2025-01-24 13:58:27.768 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_LICENSE_REQUEST" MSG="License dna-advantage, dev C9300_48P, count 1, reslt 0, alt 0" 2025-01-24 13:58:30.425 UTC SAEVT_HA_EVENT eventType="SmartAgentEvtHArmfInitialize" 2025-01-24 13:58:30.431 UTC SAEVT_HA_CHASSIS_ROLE udi="PID:C9300-48UN,SN:<SN>" 2025-01-24 13:58:30.431 UTC SAEVT_HA_EVENT eventType="SmartAgentEvtHAchkptRegister" 2025-01-24 13:58:37.975 UTC SAEVT_HA_ROLE udi="PID:C9300-48UN,SN:<SN>" haRole="Active" 2025-01-24 13:58:38.048 UTC SAEVT_HA_CHASSIS_ROLE udi="PID:C9300-48UN,SN:<SN>" haRole="Active" 2025-01-24 13:58:38.048 UTC SAEVT_HA_ROLE udi="PID:C9300-48UN,SN:<SN>" haRole="Active" 2025-01-24 13:58:38.062 UTC SAEVT_INIT_CONFIG_READ_BEGIN 2025-01-24 13:58:40.884 UTC SAEVT_HOSTNAME_CHANGE 2025-01-24 13:58:41.734 UTC SAEVT_HA_EVENT eventType="SmartAgentSetNVPairs" 2025-01-24 13:58:42.408 UTC SAEVT_INIT_CONFIG_READ_DONE 2025-01-24 13:58:42.531 UTC SAEVT_PLATFORM eventSource="INFRA_SL" eventName="INFRA_SL_EVLOG_OIR_ADD" MSG="OIR Add evt 100 with slot-id 1" 2025-01-24 13:58:42.531 UTC SAEVT_HA_CONFIG 2025-01-24 13:58:42.531 UTC SAEVT_HA_UDI udi="PID:C9300-48UN,SN:<SN>" haRole="Active" 2025-01-24 13:58:42.732 UTC SAEVT_LICENSE_USAGE count="0" type="destroy" entitlementTag="regid.2017-05.com.cisco.C9300_48P_NW_Advantagek9,1.0_6a224fe3-c92e-4440-a9c1-5d0e53a54015" 2025-01-24 13:58:42.744 UTC SAEVT_LICENSE_USAGE count="0" type="destroy" entitlementTag="regid.2017-05.com.cisco.C9300_48P_Dna_Advantage,1.0_60783b06-53ee-484c-b21e-615d3cf6837a" 2025-01-24 13:58:43.140 UTC SAEVT_INIT_SYSTEM_INIT 2025-01-24 13:58:44.143 UTC SAEVT_INIT_CRYPTO success="False" error="Crypto Initialization has not been completed" 2025-01-24 13:59:14.143 UTC SAEVT_INIT_CRYPTO success="True" 2025-01-24 13:59:14.144 UTC SAEVT_COMM_RESTORED 2025-01-24 13:59:14.176 UTC SAEVT_INIT_COMPLETE 2025-01-24 14:00:14.145 UTC SAEVT_PRIVACY_CHANGED enabled="True" 2025-01-24 14:00:27.432 UTC SAEVT_UTILITY_REPORT_START 2025-01-24 15:17:46.341 UTC SAEVT_COMM_FAIL error="Connection timed out". <--- Connection timed out
2025-01-24 15:35:22.627 UTC SAEVT_COMM_RESTORED <--- Communication with CSSM restored
通过发送ping和尝试telnet连接验证与CSSM的连接。这将验证名称解析是否正在进行,并且交换机和CSSM之间没有管理块。
Switch#show ip interface brief | exclude unassigned Interface IP-Address OK? Method Status Protocol Vlan10 10.31.121.118 YES DHCP up up Switch#ping smartreceiver.cisco.com source Vlan10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to X.X.X.X, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 364/365/368 ms Switch#telnet smartreceiver.cisco.com 443 /ipv4 /source-interface vlan10 Trying X.X.X.X, 80 ... Open [Connection to X.X.X.X closed by foreign host]
或者,如果使用的是代理服务器,您可以使用代理服务器的IP地址和端口尝试相同的命令。
Switch#ping 192.168.217.105 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.217.105, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 364/365/368 ms Switch#telnet 192.168.217.105 80 /ipv4 /source-interface vlan10 Trying 192.168.217.105, 80 ... Open [Connection to 192.168.217.105 closed by foreign host]
验证RUM报告是否正在发送以及是否有响应。
Switch#show license history message Message History (oldest to newest): ==================================================== Trust Establishment: REQUEST: Jan 24 23:18:59 2025 UTC <--- RUM report was sent {"request":"{\"header\":{\"request_type\":\"ID_TOKEN_TRUST\",\"sudi\":{\"udi_pid\":\"C9300-48UN\",\"udi_serial_number\":\"<SN>\"},\"version\":\"1.3\",\"locale\":\"en_US.UTF-8\",\"product_instance_identifier\":\"\",\"nonce\":\"8620723070430261290\",\"timestamp\":1737760739943,\"connect_info\":{\"name\":\"C_agent\",\"version\":\"5.5.29_rel/114\",\"production\":true,\"additional_info\":\"\",\"capabilities\":[\"UTILITY\",\"DLC\",\"AppHA\",\"MULTITIER\",\"EXPORT_2\",\"OK_TRY_AGAIN\",\"POLICY_USAGE\",\"POLICY_USAGE\"]}},\"request_data\":\"{\\\"sudi\\\":{\\\"udi_pid\\\":\\\"C9300-48UN\\\",\\\"udi_serial_number\\\":\\\"<SN>\\\"},\\\"timestamp\\\":1737760738052,\\\"nonce\\\":\\\"8620723070430261290\\\",\\\"product_instance_identifier\\\":\\\"\\\",\\\"hostname\\\":\\\"Switch\\\",\\\"token\\\":\\\"<TOKEN>\\\",\\\"mode\\\":\\\"PERMANENT\\\",\\\"force\\\":true,\\\"software_tag_identifier\\\":\\\"regid.2017-05.com.cisco.C9300,v1_727af1d9-6c39-4444-b301-863f81445b72\\\",\\\"device_list\\\":[{\\\"sudi\\\":{\\\"udi_pid\\\":\\\"C9300-48UN\\\",\\\"udi_serial_number\\\":\\\"<SN>\\\"},\\\"trust_id\\\":612,\\\"software_tag_identifier\\\":\\\"regid.2017-05.com.cisco.C9300,v1_727af1d9-6c39-4444-b301-863f81445b72\\\",\\\"product_instance_identifier\\\":\\\"\\\",\\\"csr\\\":\\\"MIICnjCCAYYCAQAwODE2MDQGA1UEAxMtOTFEMjVFMTcwRDM5RDAzOUI5M0VFMTE1Q0VDQTA4MEJDRjI4ODg1MTo6MSwyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq7F1KkAKcIUuHDIF+IilYAXIKew4Pz42X3Pz49nVwm93e3lURk7I5f8W9Q6Pe6JiRYsgmpvdZgbQcX6pi57oYw/E50C76JDLChQ4uB9S5NyaYwdj3QaK2Uw9pNlu0JsUXaShtXMi3JC1kcXG1qGfMxYp/LBJUub8BxtOB71b5a4CX0Sz08pB3y4WhYd8o43xT4lxe0LiBITG6Ds6TO228/9LFKD9O65wiVP7Pg2w5A6lsgQjGg1XU0dfNyD5+zmzKK5YiObi2X3wQFgKRBUX6T0v7RkWRmDuRyWz5tiDPZtVxRRXPq91dxTK2C6+jrTZ7HaE9vTunqGFsWNYjxBLXwIDAQABoCEwHwYJKoZIhvcNAQkOMRIwEDAOBgNVHQ8BAf8EBAMCBaAwDQYJKoZIhvcNAQELBQADggEBAD8vAO7LrD2yEubZPE4/OW+8pAHXRSpW4SQGP99dwiGpYT/0+8iD9wjyBWPZU5ysmYSAKlUzFqB57MIqXjHUdMAZnypL59YALXjVkAAJzof+bpwTIgvy2oYxsNvfW4AkuslJOUPINW9crqIMFEKSlNgcmaYHd6u/KO3tk5vufPM0vh2xnIHLyWlwBlga+TOS1VNwZl8PFSHTY7OAzd2d6c6+je+CSl1QvHZVmW5KgrkUIbv+YsAieZD7a2bTWOcdYR3AVqm34c3luzqTn6rq/xaTaGbi1dyR1PlD4uEDQeSewdkpTrmyWhYHUdLuN4c3NhIZqOAoaOk1TE1QGJSSh5s=\\\",\\\"id_cert_sn\\\":\\\"\\\"}]}\"}"} RESPONSE: Jan 24 23:19:05 2025 UTC <--- Response from CSSM was received {"signature":{"type":null,"value":null,"piid":null,"cert_sn":null},"response":"{\"header\":{\"version\":\"1.3\",\"locale\":\"en_US.UTF-8\",\"timestamp\":1737760824972,\"nonce\":\"8620723070430261290\",\"request_type\":\"ID_TOKEN_TRUST\",\"sudi\":{\"udi_pid\":\"C9300-48UN\",\"udi_serial_number\":\"<SN>\"},\"agent_actions\":null,\"connect_info\":{\"name\":\"SSM\",\"version\":\"1.3\",\"production\":true,\"capabilities\":[\"DLC\",\"AppHA\",\"EXPORT_2\",\"POLICY_USAGE\",\"UTILITY\"],\"additional_info\":\"\"},\"product_instance_identifier\":\"\",\"id_cert_serial_number\":null,\"signing_cert_serial_number\":null},\"status_code\":\"OK\",\"status_message\":\"OK\",\"retry_time_seconds\":0,\"response_data\":\"{\\\"nonce\\\":\\\"8620723070430261290\\\",\\\"sudi\\\":{\\\"udi_pid\\\":\\\"C9300-48UN\\\",\\\"udi_serial_number\\\":\\\"<SN>\\\"},\\\"smart_account_name\\\":\\\"<ACCOUNT>\\\",\\\"pool_name\\\":\\\"<VIRTUAL_ACCOUNT>\\\",\\\"device_list\\\":[{\\\"sudi\\\":{\\\"udi_pid\\\":\\\"C9300-48UN\\\",\\\"udi_serial_number\\\":\\\"<SN>\\\"},\\\"smart_license\\\":\\\<LICENSE>\\\",\\\"product_instance_identifier\\\":\\\"6c5ea69b-4881-4396-bfa6-6a53bd5894a4\\\"}]}\"}","sch_response":null} Usage Reporting: No past history Result Polling: No past history Authorization Request: No past history Authorization Return: No past history Trust Sync: No past history Import Message History (oldest to newest): ==================================================== Import POLICY: No past Import history Import AUTH: No past Import history Import TRUST CODE: Received on Jan 24 23:19:05 2025 UTC <TRUST_CODE> Import RUM ACK: No past Import history Import CONVERSION ACK: No past Import history Import ACCOUNT INFO: Last policy received on Jan 24 23:19:05 2025 UTC <ACCOUNT_INFO> Switch#show license tech support | sec Trust Trust Establishment: Attempts: Total=1, Success=1, Fail=0 Ongoing Failure: Overall=0 Communication=0 Last Response: OK on Jan 24 23:19:05 2025 UTC <--- Trust establishment succeeded Failure Reason: Last Success Time: Jan 24 23:19:05 2025 UTC Last Failure Time: Trust Acknowledgement: Attempts: Total=0, Success=0, Fail=0 Ongoing Failure: Overall=0 Communication=0 Last Response: Failure Reason: Last Success Time: Last Failure Time: Trust Sync: Attempts: Total=1, Success=1, Fail=0 Ongoing Failure: Overall=0 Communication=0 Last Response: OK on Jan 24 23:19:50 2025 UTC Failure Reason: Last Success Time: Jan 24 23:19:50 2025 UTC Last Failure Time: Trusted Store Interface: True Local Device: P:C9300-48UN,S:, state[2], Trust Data INSTALLED TrustId:612 Overall Trust: INSTALLED (2) <--- Trust code installed
如果发送了请求但没有CSSM响应,则命令不会显示给定响应的JSON数据show license history message
,并且可以获得有关故障的更多详细信息。
Switch#show license history message ! <--- Output omitted for brevity ---> Trust Establishment: REQUEST: Feb 21 16:54:49 2025 UTC {"request":"{\"header\":{\"request_type\":\"ID_TOKEN_TRUST\",\"sudi\":{\"udi_pid\":\"C9300X-12Y\",\"udi_serial_number\":\"<SN>\"},\"version\":\"1.3\",\"locale\":\"en_US.UTF-8\",\"product_instance_identifier\":\"\",\"nonce\":\"418461674986421033\",\"timestamp\":1740156889326,\"connect_info\":{\"name\":\"C_agent\",\"version\":\"5.5.29_rel/114\",\"production\":true,\"additional_info\":\"\",\"capabilities\":[\"UTILITY\",\"DLC\",\"AppHA\",\"MULTITIER\",\"EXPORT_2\",\"OK_TRY_AGAIN\",\"POLICY_USAGE\",\"POLICY_USAGE\"]}},\"request_data\":\"{\\\"sudi\\\":{\\\"udi_pid\\\":\\\"C9300X-12Y\\\",\\\"udi_serial_number\\\":\\\"<SN>\\\"},\\\"timestamp\\\":1740156888584,\\\"nonce\\\":\\\"418461674986421033\\\",\\\"product_instance_identifier\\\":\\\"\\\",\\\"hostname\\\":\\\"F241.24.06-9300-1\\\",\\\"token\\\":\\\"MzgwMDAwMTItOGVkOC00OWExLTgzZmEtMzVhNTZkMDAyNTJhLTE3NDI3NDgy%0ANDkyMTF8U1N4MFV0RDgzdytvY0EwL1FrRHBEaDJ6bW8yTDlpa3BsazJKbkxE%0ASXpwND0%3D%0A\\\",\\\"mode\\\":\\\"PERMANENT\\\",\\\"force\\\":true,\\\"software_tag_identifier\\\":\\\"regid.2017-05.com.cisco.C9300,v1_727af1d9-6c39-4444-b301-863f81445b72\\\",\\\"device_list\\\":[{\\\"sudi\\\":{\\\"udi_pid\\\":\\\"C9300X-12Y\\\",\\\"udi_serial_number\\\":\\\"<SN>\\\"},\\\"trust_id\\\":497,\\\"software_tag_identifier\\\":\\\"regid.2017-05.com.cisco.C9300,v1_727af1d9-6c39-4444-b301-863f81445b72\\\",\\\"product_instance_identifier\\\":\\\"\\\",\\\"csr\\\":\\\"MIICnjCCAYYCAQAwODE2MDQGA1UEAxMtODhFMzcyODRBOTYwN0U1MDhERDJCMTdERkYyNTJBOTZDQjA1ODNENzo6MSwyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxTl8H93Q05evxmYkBYIq1hwyXqmkw24AHfnxGLFw7SaiN3bCKmYnG31vYzAbgcq3fq2LD6dtzFLrXm7t43wiF+kLtkgh4a+W9cl6PaiPXr9pxEBSxuMokfUZBd9OU7e83wCtH+0bUeSsdFHpTyIiynodF92NHwjsR4eRB5fAnx1qqbZBNa4ntgj11HQ1X9pN31PY7Wc18iEGRhYgR5ljGpgvhnfzno6M8jG4wplxuiA3oWvYO8BaXkQHRf6QofQIXfmsgGAddtJqw2UzcSLWaelbuHB1yhnhWTD5mpRFQYxuLU87ndr/G8PaCreJ/RzjikSLgEes4hF34i13ab8LGwIDAQABoCEwHwYJKoZIhvcNAQkOMRIwEDAOBgNVHQ8BAf8EBAMCBaAwDQYJKoZIhvcNAQEFBQADggEBAAOUiLz9nZ+C2mGI31ZqrK1iV/C1GWNXJajWisRhFBgSANgFs7cLfAJhZtEXF1PY+0PQGRAeR/zwCpYwIq/cI7jLjqXAaHkNmEeRsidWv+pMxNwjR4csSJk+PNqeqwXzVIhsJTEU5E8jchwzI1i26STUDjKJhHW+Z1wgDYBCPldl2CA2D7c71s4/UirEPoEEiFtrxtGi8KvldRPFEis8vaX8OGNV4H/t1+SSU4UW5resHpABusJSM2SJNTOsX6f+7IULqPQJjoGs0pqu+EyHcjglSYolMsIqE1x9jzdKGN+wy3p4my3a0PNfiHF3RofSkXMk++idw9v8+kHV9m+Ym9A=\\\",\\\"id_cert_sn\\\":\\\"\\\"}]}\"}"} RESPONSE: Feb 21 16:54:49 2025 UTC <--- The line is empty, which means there was no response from CSSM REQUEST: Feb 21 16:55:19 2025 UTC {"request":"{\"header\":{\"request_type\":\"ID_TOKEN_TRUST\",\"sudi\":{\"udi_pid\":\"C9300X-12Y\",\"udi_serial_number\":\"<SN>\"},\"version\":\"1.3\",\"locale\":\"en_US.UTF-8\",\"product_instance_identifier\":\"\",\"nonce\":\"17639638978924380272\",\"timestamp\":1740156919824,\"connect_info\":{\"name\":\"C_agent\",\"version\":\"5.5.29_rel/114\",\"production\":true,\"additional_info\":\"\",\"capabilities\":[\"UTILITY\",\"DLC\",\"AppHA\",\"MULTITIER\",\"EXPORT_2\",\"OK_TRY_AGAIN\",\"POLICY_USAGE\",\"POLICY_USAGE\"]}},\"request_data\":\"{\\\"sudi\\\":{\\\"udi_pid\\\":\\\"C9300X-12Y\\\",\\\"udi_serial_number\\\" ! <--- Output omitted for brevity --->
Switch#show license tech support | sec Trust
Trust Establishment:
Attempts: Total=2, Success=0, Fail=2 Ongoing Failure: Overall=2 Communication=2
Last Response: NO REPLY on Feb 21 16:55:39 2025 UTC <--- Failure reason was NO REPLY
Failure Reason: <none>
Last Success Time: <none>
Last Failure Time: Feb 21 16:55:39 2025 UTC
Trust Acknowledgement:
Attempts: Total=0, Success=0, Fail=0 Ongoing Failure: Overall=0 Communication=0
Last Response: <none>
Failure Reason: <none>
Last Success Time: <none>
Last Failure Time: <none>
Trust Sync:
Attempts: Total=0, Success=0, Fail=0 Ongoing Failure: Overall=0 Communication=0
Last Response: <none>
Failure Reason: <none>
Last Success Time: <none>
Last Failure Time: <none>
Trusted Store Interface: True
Local Device: P:C9300-48UN,S:<SN>, state[1], NOT INSTALLED TrustId:605 <--- Trust point exists but it is not installed yet
Overall Trust: No ID
触发交换机发送RUM报告以与CSSM同步。
Switch#show clock
*23:38:54.683 UTC Fri Jan 24 2025
Switch#show license tech support | i Utility Utility: Start Utility Measurements: Jan 24 23:35:55 2025 UTC (4 minutes, 38 seconds remaining) Send Utility RUM reports: Feb 23 23:20:56 2025 UTC (29 days, 23 hours, 49 minutes, 39 seconds remaining) <--- Next RUM report to be sent in 29 days Process Utility RUM reports: Jan 25 23:30:58 2025 UTC (23 hours, 59 minutes, 41 seconds remaining) Switch#show license history message | i REQUEST REQUEST: Jan 24 23:18:59 2025 UTC REQUEST: Jan 24 23:20:50 2025 UTC REQUEST: Jan 24 23:25:55 2025 UTC REQUEST: Jan 24 23:19:41 2025 UTC Switch#license smart sync all <--- Trigger synchronization Switch#show license history message | i REQUEST REQUEST: Jan 24 23:18:59 2025 UTC REQUEST: Jan 24 23:20:50 2025 UTC REQUEST: Jan 24 23:25:55 2025 UTC REQUEST: Jan 24 23:19:41 2025 UTC REQUEST: Jan 24 23:39:05 2025 UTC <--- New RUM report was sent Switch#show license tech support | sec Trust Trust Establishment: Attempts: Total=1, Success=1, Fail=0 Ongoing Failure: Overall=0 Communication=0 Last Response: OK on Jan 24 23:19:05 2025 UTC Failure Reason: Last Success Time: Jan 24 23:19:05 2025 UTC Last Failure Time: Trust Acknowledgement: Attempts: Total=0, Success=0, Fail=0 Ongoing Failure: Overall=0 Communication=0 Last Response: Failure Reason: Last Success Time: Last Failure Time: Trust Sync: Attempts: Total=2, Success=2, Fail=0 Ongoing Failure: Overall=0 Communication=0 Last Response: OK on Jan 24 23:39:14 2025 UTC <--- Successful response from CSSM Failure Reason: Last Success Time: Jan 24 23:39:14 2025 UTC Last Failure Time: Trusted Store Interface: True Local Device: P:C9300-48UN,S:<SN>, state[2], Trust Data INSTALLED TrustId:612 Overall Trust: INSTALLED (2)
要验证交换机是否正在与CSSM建立HTTPS连接,可以捕获数据包。这是使用代理服务器成功连接的数据包捕获示例。
Switch#sh ip cef 10.31.104.78 0.0.0.0/0 nexthop 10.31.121.65 Vlan10 Switch#sh ip arp 10.31.121.65 Protocol Address Age (min) Hardware Addr Type Interface Internet 10.31.121.65 0 2c31.24b1.6bc6 ARPA Vlan10 Switch#show mac address-table address 2c31.24b1.6bc6 Mac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 10 2c31.24b1.6bc6 DYNAMIC Fi1/0/48 Total Mac Addresses for this criterion: 1 Switch#monitor capture CSSM interface Fi1/0/48 both match any Switch#monitor capture CSSM start Started capture point : CSSM Switch#show clock *15:41:10.058 UTC Fri Jan 24 2025 Switch#license smart sync all Switch#sh license hist mess | i REQUEST REQUEST: Jan 24 15:35:17 2025 UTC
REQUEST: Jan 24 15:41:58 2025 UTC Switch#monitor capture CSSM stop
Switch#monitor capture CSSM export location flash:slp-proxy-https-connection.pcap
Export Started Successfully
使用代理服务器成功与CSSM建立HTTPS连接的数据包捕获。
如果数据包捕获显示HTTPS连接正在尝试建立,但失败,则可能是因为TLS或SSL握手失败。这些调试可用于进一步调查。
debug ip http client all debug ssl openssl states debug ssl openssl errors debug crypto pki messages debug crypto pki transactions
如果任何时候需要从交换机删除已安装的信任代码,则可以执行智能许可工厂重置。此过程需要重新加载。重置出厂设置后,可以安装新的信任代码。使用此命令可删除所有许可信息,包括策略。
Switch#license smart factory reset %Warning: reload required after "license smart factory reset" command Switch#show license status | include Trust
Trust Code Installed:<--- Installed trust code now shows none
Switch#reload
版本 | 发布日期 | 备注 |
---|---|---|
1.0 |
14-Mar-2025
|
初始版本 |