在Catalyst 8300線上（自治）模式下安裝HSEC許可證

簡介

本文說明如何在聯機模式下在Catalyst 8300路由器中安裝HSEC許可證。

必要條件

有關以下主題的知識：

• 智慧許可知識
• Cisco IOS® XE知識
• HSEC許可證知識。此許可證也稱為出口管制許可證。

路由器前提條件：

• 在自治模式下運行的路由器。使用show version指令進行驗證。
• 路由器需要預先載入和配置Cisco DNA許可證引導級別。請參閱設定Catalyst 8000系列實體平台的授權和輸送量
• 路由器需要已經與思科軟體智慧管理員(CSSM)通話，並且收到其確認訊息。請參閱直接連線到CSSM的路由器部分，在Cisco IOS XE路由器上使用策略配置智慧許可。

背景資訊

Configure Licenses and Throughput for Catalyst 8000 Series Physical Platforms（為Catalyst 8000系列物理平台配置許可證和吞吐量）中有官方指南，但它描述了不同Catalyst 8000路由器平台之間混合的許可功能。

本指南僅針對例項直接連線到思科智慧軟體管理器(CSSM)時以自主模式運行的8300。

採用元件

在本文中，使用以下元素：

• C8300-1N1S-4T2X路由器。但是所述的步驟適用於任何8300 catalyst路由器

• Cisco IOS XE版本17.15.03a
• 在自治模式下運行的路由器

附註：確保您擁有最新版本的軟體，該軟體是穩定的golden star或推薦的版本。

本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。

概念

智慧授權碼(SLAC)

智慧許可證授權碼是需要安裝到裝置才能使用HSEC許可證的代碼。

此代碼需要由裝置請求並安裝在其上。然後，它允許您為加密流量配置更高的吞吐量級別。

請參閱為Catalyst 8000系列物理平台配置許可證和吞吐量的官方文檔指南的HSECK9許可證使用指南。

有關章節的更多資訊：使用策略進行智慧許可的任務庫。

思科軟體智慧管理員(CSSM)

這是管理許可證的雲中的遠端伺服器實體。

CSSM可在思科軟體中心(可訪問舊版Smart Software Manager)訪問，也可在思科許可證中心(Cisco License Central)訪問更新的網頁版本。

附註：確保為您的域擁有智慧帳戶。請參閱如何建立智慧帳戶？。

步驟

步驟1.確保裝置具有Cisco DNA引導級別

請參閱矩陣Cisco DNA軟體、SD-WAN和路由矩陣，瞭解Cisco DNA引導級別和功能。

使用命令show version確保您的裝置具有啟動級別

Router#show version

Technology Package License Information: 
          
-----------------------------------------------------------------
Technology     Type         Technology-package Technology-package
                            Current            Next Reboot       
-----------------------------------------------------------------
Smart License  Perpetual    network-advantage  network-advantage 
Smart License  Subscription dna-advantage      dna-advantage

步驟2.定義智慧傳輸和預設URL

Router(config)#license smart transport smart 
Router(config)#license smart url default 

步驟3.定義代理（如果需要）

Router(config)#license smart proxy address 

Router(config)#license smart proxy port 

步驟4.確保註冊使用的令牌允許匯出控制功能

當裝置註冊到CSSM時，請確保允許匯出控制功能的令牌被允許，如下螢幕截圖所示：

步驟5.在裝置中配置令牌

Router#license smart trust idtoken  all force   

您可以在show log中看到與CSSM的通訊已恢復，並且信任代碼已安裝

*Dec  1 23:42:28.633: %SMART_LIC-5-COMM_RESTORED: Communications with Cisco Smart Software Manager (CSSM) restored
*Dec  1 23:42:28.656: %SMART_LIC-6-POLICY_INSTALL_SUCCESS: A new licensing policy was successfully installed 
*Dec  1 23:42:28.720: %SMART_LIC-6-TRUST_INSTALL_SUCCESS: A new licensing trust code was successfully installed on P:C8300-1N1S-4T2X,S:.

步驟6.使用show license status命令驗證是否已安裝信任代碼並已收到ACK

Router#show license status
Utility:
  Status: DISABLED

Smart Licensing Using Policy:
  Status: ENABLED

Account Information:
  Smart Account:  As of Dec 01 23:41:50 2025 UTC
  Virtual Account: 

Data Privacy:
  Sending Hostname: yes
    Callhome hostname privacy: DISABLED
    Smart Licensing hostname privacy: DISABLED
  Version privacy: DISABLED

Transport:
  Type: Smart
  URL: https://smartreceiver.cisco.com/licservice/license
  Proxy:
    Address: 

    Port: 
    Username: 
    Password: 
  VRF: 

Policy:
  Policy in use: Installed On Dec 01 23:42:28 2025 UTC
  Policy name: SLE Policy
  Reporting ACK required: yes (Customer Policy)
  Unenforced/Non-Export Perpetual Attributes:
    First report requirement (days): 30 (Customer Policy)
    Reporting frequency (days): 60 (Customer Policy)
    Report on change (days): 60 (Customer Policy)
  Unenforced/Non-Export Subscription Attributes:
    First report requirement (days): 120 (Customer Policy)
    Reporting frequency (days): 111 (Customer Policy)
    Report on change (days): 111 (Customer Policy)
  Enforced (Perpetual/Subscription) License Attributes:
    First report requirement (days): 30 (Customer Policy)
    Reporting frequency (days): 90 (Customer Policy)
    Report on change (days): 60 (Customer Policy)
  Export (Perpetual/Subscription) License Attributes:
    First report requirement (days): 30 (Customer Policy)
    Reporting frequency (days): 30 (Customer Policy)
    Report on change (days): 30 (Customer Policy)
          
Miscellaneous:
  Custom Id: 

Usage Reporting:
  Last ACK received: Dec 01 23:48:00 2025 UTC<<<<<<<< ACK
  Next ACK deadline: Jan 30 23:48:00 2026 UTC
  Reporting push interval: 30  days
  Next ACK push check: 
  Next report push: Dec 31 23:43:03 2025 UTC
  Last report push: Dec 01 23:43:03 2025 UTC
  Last report file write: 

Trust Code Installed: Dec 01 23:42:28 2025 UTC<<<<<<<<<<
 
Device Telemetry Report Summary:
================================
Data Channel: AVAILABLE
Reports on disk: 1

步驟7.使用show license authorization命令驗證現有授權

Show license authorization顯示是否已安裝HSEC或匯出控制的授權代碼。

附註：某些裝置已在工廠安裝此智慧許可證授權代碼(SLAC)（如果訂單中包含此代碼）。

Router#show license authorization
Last Data Push: 
Last File Export: 

Overall status:
  Active: PID:C8300-1N1S-4T2X,SN:
    Status: NOT INSTALLED

Purchased Licenses:
  No Purchase Information Available



Router#

如果未安裝，請繼續執行下一步。

步驟8.請求SLAC

如果尚未安裝授權碼，請從產品例項（即裝置）請求SLAC代碼。

要請求SLAC，請使用命令license feature hseck9:

Router(config)#license feature hseck9

之後，您可以看到已成功匯入SLAC代碼：

Router(config)#
*Dec  1 23:55:06.978: %SMART_LIC-6-AUTHORIZATION_INSTALL_SUCCESS: A new licensing authorization code was successfully installed on PID:C8300-1N1S-4T2X,SN:
*Dec  1 23:55:07.004: %SMART_LIC-6-EXPORT_CONTROLLED: Usage of export controlled features is allowed for feature hseck9

步驟9.驗證授權

請求SLAC後，您可以通過運行show license authorization來驗證是否已正確安裝了授權代碼：

Router#show license authorization 
Last Data Push: Dec 01 23:55:06 2025 UTC via Smart
Last File Export: 

Overall status:
  Active: PID:C8300-1N1S-4T2X,SN:
    Status: SMART AUTHORIZATION INSTALLED on Dec 01 23:55:06 2025 UTC
    Last Confirmation code: 

Authorizations:
  Router US Export Lic. for DNA (DNA_HSEC):
    Description: U.S. Export Restriction Compliance license for DNA based Routers
    Total available count: 1
    Enforcement type: EXPORT RESTRICTED
    Term information:
      Active: PID:C8300-1N1S-4T2X,SN:
        Authorization type: SMART AUTHORIZATION INSTALLED 
        License type: PERPETUAL
          Term Count: 1

Purchased Licenses:
  No Purchase Information Available

          

Router#

在門戶中，驗證許可證已使用且已保留：

更改吞吐量

成功安裝SLAC後，相應地更改吞吐量：

Router(config)#platform hardware throughput crypto 2.5G
% These values don't take effect until the next reboot. Please save the configuration.
Router(config)#
*Dec  2 00:01:19.108: %CRYPTO_SL_TP_LEVELS-6-SAVE_CONFIG_AND_RELOAD: New throughput level not applied until reload; please save config
Router(config)#do wr
Building configuration...
[OK]
Router(config)#
*Dec  2 00:01:28.776: %SYS-6-PRIVCFG_ENCRYPT_SUCCESS: Successfully encrypted private config file
Router(config)#do reload
WARNING: 
Boot variable either does not exist or buffer is too small
This may impact autoboot of the router. Proceed with caution
Do you wish to proceed with reload anyway[confirm]
Proceed with reload? [confirm]

附註：預設情況下，未加密流量不受限制。

通過show platform hardware throughput crypto命令驗證當前的加密吞吐量：

Router#show platform hardware throughput crypto 
Current configured crypto throughput level: 2.5G