C H A P T E R
3
License Management
Cisco Smart Software Licensing lets you purchase and manage a pool of licenses centrally. You can easily deploy or retire devices without having to manage each unit
’ s license key. Smart Software Licensing also lets you see your license usage and needs at a glance.
•
About Smart Software Licensing, page 11
•
Prerequisites for Smart Software Licensing, page 13
•
Defaults for Smart Software Licensing, page 14
•
Configure Smart Software Licensing, page 14
•
Smart License Manager Satellite for the FXOS chassis, page 15
•
Permanent License Reservation, page 16
•
History for Smart Software Licensing, page 18
About Smart Software Licensing
This section describes how Smart Software Licensing works.
Note
This section only applies to ASA logical devices on the FXOS chassis. For more information on licensing for Firepower Threat Defense logical devices, see the Firepower Management Center Configuration Guide.
Smart Software Licensing for Applications on the FXOS Chassis
For the application on the FXOS chassis, Smart Software Licensing configuration is split between the FXOS chassis supervisor and the application.
•
FXOS chassis
—
Configure all Smart Software Licensing infrastructure in the supervisor, including parameters for communicating with the License Authority. The FXOS chassis itself does not require any licenses to operate.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
11
License Management
Smart Software Manager and Accounts
For offline licensing, you can deploy a Cisco Smart Software Manager satellite server that is accessible to your local network, and that syncs with the License Authority on demand or on a schedule you set.
The three Smart License models supported on the FXOS chassis are Smart License default mode, Proxy mode, and Smart License Satellite mode. Inter-chassis clustering requires that you enable the same Smart
Licensing mode type on each FXOS chassis in the cluster.
•
Application
—
Configure all license entitlements in the application.
Smart Software Manager and Accounts
When you purchase 1 or more licenses for the device, you manage them in the Cisco Smart Software Manager: https://software.cisco.com/#module/SmartLicensing
The Smart Software Manager lets you create a master account for your organization.
Note
If you do not yet have an account, click the link to set up a new account . The Smart Software Manager lets you create a master account for your organization.
By default, your licenses are assigned to the
Default Virtual Account
under your master account. As the account administrator, you can optionally create additional virtual accounts; for example, you can create accounts for regions, departments, or subsidiaries. Multiple virtual accounts let you more easily manage large numbers of licenses and devices.
Licenses and Devices Managed per Virtual Account
Licenses and devices are managed per virtual account: only that virtual account
’ s devices can use the licenses assigned to the account. If you need additional licenses, you can transfer an unused license from another virtual account. You can also transfer devices between virtual accounts.
Only the FXOS chassis registers as a device, while the applications in the chassis request their own licenses.
For example, for a Firepower 9300 chassis with 3 security modules, the chassis counts as one device, but the modules use 3 separate licenses.
Device Registration and Tokens
For each virtual account, you can create a registration token. This token is valid for 30 days by default. Enter this token ID plus entitlement levels when you deploy each device, or when you register an existing device.
You can create a new token if an existing token is expired.
Note
Device registration is configured in the FXOS chassis supervisor, not on the security module.
At startup after deployment, or after you manually configure these parameters on an existing device, the device registers with the Cisco License Authority. When the device registers with the token, the License Authority issues an ID certificate for communication between the device and the License Authority. This certificate is valid for 1 year, although it will be renewed every 6 months.
12
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
License Management
Periodic Communication with the License Authority
Periodic Communication with the License Authority
The device communicates with the License Authority every 30 days. If you make changes in the Smart Software
Manager, you can refresh the authorization on the device so the change takes place immediately. Or you can wait for the device to communicate as scheduled.
You can optionally configure an HTTP proxy.
The FXOS chassis must have Internet access either directly or through an HTTP proxy at least every 90 days.
Normal license communication occurs every 30 days, but with the grace period, your device will operate for up to 90 days without calling home. After the grace period, you must contact the Licensing Authority, or you will not be able to make configuration changes to features requiring special licenses; operation is otherwise unaffected.
Note
Offline licensing is not supported.
Out-of-Compliance State
The device can become out of compliance in the following situations:
• Over-utilization — When the device uses unavailable licenses.
•
License expiration
—
When a time-based license expires.
•
Lack of communication
—
When the device cannot reach the Licensing Authority for re-authorization.
To verify whether your account is in, or approaching, an Out-of-Compliance state, you must compare the entitlements currently in use by your FXOS chassis against those in your Smart Account.
In an out-of-compliance state, the device will be limited in some way, depending on the application.
Smart Call Home Infrastructure
By default, a Smart Call Home profile exists in the configuration that specifies the URL for the Licensing
Authority. You cannot remove this profile. Note that the only configurable option for the License profile is the destination address URL for the License Authority. Unless directed by Cisco TAC, you should not change the License Authority URL.
You cannot disable Smart Call Home for Smart Software Licensing.
Prerequisites for Smart Software Licensing
• Create a master account on the Cisco Smart Software Manager: https://software.cisco.com/#module/SmartLicensing
If you do not yet have an account, click the link to set up a new account . The Smart Software Manager lets you create a master account for your organization.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
13
License Management
Defaults for Smart Software Licensing
• Purchase 1 or more licenses from Cisco Software Central.
• Ensure Internet access or HTTP proxy access from the device, so the device can contact the Licensing
Authority. Offline licensing is not supported.
• Configure a DNS server so the device can resolve the name of the licensing authority server.
• Set the clock for the device.
• Note that this section only applies to ASA logical devices on the FXOS chassis. For more information on licensing for Firepower Threat Defense logical devices, see the Firepower Management Center
Configuration Guide.
Defaults for Smart Software Licensing
The FXOS chassis default configuration includes a Smart Call Home profile called “ SLProf ” that specifies the URL for the Licensing Authority.
Configure Smart Software Licensing
To communicate with the Cisco License Authority, you can optionally configure an HTTP proxy. To register with the License Authority, you must enter the registration token ID on the FXOS chassis that you obtained from your Smart Software License account.
Procedure
Step 1
(Optional) Configure the HTTP Proxy, on page 14
.
Step 2
Register the Firepower Security Appliance with the License Authority, on page 15
.
(Optional) Configure the HTTP Proxy
If your network uses an HTTP proxy for Internet access, you must configure the proxy address for Smart
Software Licensing. This proxy is also used for Smart Call Home in general.
Note
HTTP proxy with authentication is not supported.
Procedure
Step 1
Choose
System
>
Licensing
>
Call Home
.
The Call Home page provides fields for configuring the destination address URL for the License Authority and for configuring an HTTP proxy.
Note
Unless directed by Cisco TAC, you should not change the License Authority
URL.
14
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
License Management
Register the Firepower Security Appliance with the License Authority
Step 2
In the Server Enable drop-down list, select
on
.
Step 3
Enter the proxy IP address and port in the
Server URL
and
Server Port
fields. For example, enter port 443 for an HTTPS server.
Step 4
Click
Save
.
Register the Firepower Security Appliance with the License Authority
When you register the FXOS chassis, the License Authority issues an ID certificate for communication between the FXOS chassis and the License Authority. It also assigns the FXOS chassis to the appropriate virtual account. Normally, this procedure is a one-time instance. However, you might need to later re-register the
FXOS chassis if the ID certificate expires because of a communication problem, for example.
Procedure
Step 1
In the Smart Software Manager, request and copy a registration token for the virtual account to which you want to add this FXOS chassis.
Step 2
In Firepower Chassis Manager, choose
System
>
Licensing
>
Smart License
.
Step 3
Enter the registration token in the
Enter Product Instance Registration Token
field.
Step 4
Click
Register
.
The FXOS chassis attempts to register with the License Authority.
To unregister the device, click
Unregister
.
Deregistering the FXOS chassis removes the device from your account. All license entitlements and certificates on the device are removed. You might want to deregister to free up a license for a new FXOS chassis.
Alternatively, you can remove the device from the Smart Software Manager.
Smart License Manager Satellite for the FXOS chassis
Cisco Smart Software Manager satellite is a component of Cisco Smart Licensing that works in conjunction with Cisco Smart Software Manager (SSM) . It helps you intelligently manage customer product licenses, providing near real-time visibility and reporting of Cisco licenses that customers purchase and consume.
Customers who, either for policy or network reachability reasons, do not want to manage their Cisco products directly using the Cisco Smart Software Manager residing at software.cisco.com, can choose to install the
Cisco Smart Software Manager satellite on-premises. When enabled, the FXOS chassis sends report license consumption to the Smart Software Manager satellite as though it were a replicate of the Cisco Smart Software
Manager hosted within your premises.
Once you download and deploy the satellite application, you can perform the following functions without sending data to Cisco SSM using the Internet:
• Activate or register a license
• View your company's licenses
• Transfer licenses between company entities
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
15
License Management
Configure a Smart License Satellite Server for the FXOS chassis
For more information, see the Smart Software Manager satellite installation and configuration guides on Smart
Account Manager satellite .
Configure a Smart License Satellite Server for the FXOS chassis
The following procedure shows how to configure the FXOS chassis to use a Smart Licence Manager satellite.
Before You Begin
• Complete all prerequisites listed in the
Prerequisites for Smart Software Licensing, on page 13
.
• Download the Smart License Satellite OVA file from Cisco.com and install and configure it on a
VMwareESXi server. For more information, see the Smart Software Manager satellite Install Guide .
Procedure
Step 1
Choose
System
>
Licensing
>
Call Home
.
Step 2
Under Call home Configuration, replace the default URL in the Address field with the satellite URL.
Step 3
Create a new trust point using the CLI. (See the Smart License Satellite manager configuration steps in the
FXOS CLI Configuration Guide for more information).
Step 4
Register the Firepower Security Appliance with the License Authority, on page 15
. Note that you must request and copy the registration token from the Smart License Manager satellite.
Permanent License Reservation
You can assign a permanent license to your FXOS chassis. This universal reservation allows you to use any entitlement for an unlimited count on your device.
Note
Before you begin, you must purchase the permanent licenses so they are available in the Smart Software
Manager. Not all accounts are approved for permanent license reservation. Make sure you have approval from Cisco for this feature before you attempt to configure it.
Configure Permanent License Reservation
The following procedure shows how to assign a permanent license to your FXOS chassis.
16
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
License Management
(Optional) Return the FXOS Permanent License
Procedure
Step 1
Choose
System
>
Licensing
>
Permanent License
.
Step 2
Click
Generate
to generate a reservation request code. Copy the reservation request code to your clipboard.
Step 3
Go to the Smart Software Manager Inventory screen in the Cisco Smart Software Manager portal, and click the
Licenses
tab: https://software.cisco.com/#SmartLicensing-Inventory
The
Licenses
tab displays all existing licenses related to your account, both regular and permanent.
Step 4
Click
License Reservation
, and paste the generated reservation request code into the box.
Step 5
Click
Reserve License
.
The Smart Software Manager generates an authorization code. You can download the code or copy it to the clipboard. At this point, the license is now in use according to the Smart Software Manager.
If you do not see the
License Reservation
button, then your account is not authorized for permanenet license reservation. In this case, you should disable permanent license reservation and re-enter the regular smart license commands.
Step 6
In the FXOS chassis supervisor, enter the generated authorization code into the
Authorization Code
text box.
Step 7
Click
Install
.
Once your FXOS chassis is fully licensed with PLR, the Permanenet License page displays your license status and offers the option to return your permanent license.
(Optional) Return the FXOS Permanent License
If you no longer need a permanent license, you must officially return it to the Smart Software Manager using this procedure. If you do not follow all steps, the license stays in an in-use state and cannot be used elsewhere.
Procedure
Step 1
Choose
System
>
Licensing
>
Permanent License
.
Step 2
Click
Return
to generate a return code. Copy the return code to your clipboard.
The FXOS chassis immediately becomes unlicensed and moves to the Evaluation state.
Step 3
Go to the Smart Software Manager Inventory screen, and click on the
Product Instances
tab: https://software.cisco.com/#SmartLicensing-Inventory
Step 4
Search for your FXOS chassis using its universal device identifier (UDI).
Step 5
Choose
Actions
>
Remove
, and paste the generated return code into the box.
Step 6
Click
Remove Product Instance
.
The permanent license is returned to the available pool.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
17
License Management
History for Smart Software Licensing
History for Smart Software Licensing
Feature Name Description
Cisco Smart Software Licensing for the FXOS chassis
Platform
Releases
1.1(1) Smart Software Licensing lets you purchase and manage a pool of licenses. Smart licenses are not tied to a specific serial number. You can easily deploy or retire devices without having to manage each unit
’ s license key. Smart Software Licensing also lets you see your license usage and needs at a glance. Smart
Software Licensing configuration is split between the FXOS chassis supervisor and the security module.
We introduced the following screens:
System
>
Licensing
>
Call Home
System
>
Licensing
>
Smart License
18
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
