CISCO Catalyst 9300 Series Switches User Guide June 15, 2024 Cisco Table of Contents CISCO Catalyst 9300 Series Switches Product Information Usage Instructions Information About Available Licenses How to Configure Available Licenses **Installing SLAC: Connected Directly to CSSM Installing SLAC: No Connectivity to CSSM and No CSLU Installing SLAC: Connected to CSSM Through CSLU (Product Instance- **Installing SLAC: Connected to CSSM Through CSLU (CSLU-Initiated) Installing SLAC: SSM On-Prem Deployment (Product Instance-Initiated) Installing SLAC: SSM On-Prem Deployment (SSM On-Prem-Initiated) Examples for Configuring Available Licenses **Example: Requesting and Installing SLAC – Adding a Member and Example: Requesting and Installing SLAC – Requesting SLAC on a Feature History for Available Licenses Read User Manual Online (PDF format) Download This Manual (PDF format) CISCO Catalyst 9300 Series Switches Product Information Specifications Product: Cisco Catalyst 9300 Series Switches Software: Cisco IOS-XE Licenses: Base Licenses, Add-On Licenses Supported Platforms: Cisco Catalyst 9300X Series Switches Supported Releases: Cisco IOS XE Bengaluru 17.6.2 and above Available Licenses The Cisco Catalyst 9300 Series Switches offer both base licenses and add-on licenses: Base Licenses A base license is a perpetually valid, or permanent license. It does not have an expiration date. Add-On Licenses An add-on license provides Cisco innovations on the switch and the Cisco Digital Network Architecture Center (Cisco DNA Center). An add-on license is valid only until a certain date and can be purchased for a three, five, or seven-year subscription period. Export Control Key for High Security The Export Control Key for High Security (HSECK9 key) is an export-controlled license that authorizes the use of cryptographic functionality on the Cisco Catalyst 9300 Series Switches. Supported Platforms and Releases The HSECK9 key is available on the Cisco Catalyst 9300X Series Switches, starting with Cisco IOS XE Bengaluru 17.6.2. Usage Instructions Guidelines for Using Base and Add-On Licenses When ordering an add-on license with a base license, please refer to Table 4 for permitted combinations. Base License Add-On License Permitted DNA Essentials Network Essentials Yes DNA Advantage Network Essentials No DNA Advantage Network Advantage Yes When an HSECK9 Key Is Required An HSECK9 key is required if you want to use certain cryptographic features that are restricted by U.S. export control laws. Without the HSECK9 key, you cannot enable these restricted cryptographic features. The IPsec feature specifically requires the HSECK9 key. Prerequisites for Using an HSECK9 Key Before using an HSECK9 key, make sure to obtain and install SLAC (Security License Authorization Code) on supported platforms. Refer to the configuration section in the user manual for specific instructions. Ordering Considerations Consider the licensing requirements and restrictions when ordering licenses for the Cisco Catalyst 9300 Series Switches. Stacking Considerations If you have a device stack with an active, standby, and one or more members, please consider the following: Scenario 1: In a device stack where the standby has an HSECK9 key and SLAC, when a switchover occurs, the system will continue the operation of the cryptographic functionality on the new active without any interruptions. FAQ Q: What are the available licenses for the Cisco Catalyst 9300 Series Switches? A: The available licenses are base licenses and add-on licenses. Q: Are base licenses perpetual? A: Yes, base licenses are perpetually valid and do not have an expiration date. Q: What is the Export Control Key for High Security? A: The Export Control Key for High Security (HSECK9 key) is an export- controlled license that enables the use of cryptographic functionality. Information About Available Licenses This section provides information about the licenses that are available on Cisco Catalyst 9300 Series Switches running Cisco IOS-XE software. The information applies to all models in the series, unless indicated otherwise. Base and Add-On Licenses The following base and add-on licenses are available: Base Licenses A base license is a perpetually valid, or permanent license. There is no expiration date for such a license. Network Essentials Network Advantage: Includes features available with the Network Essentials license and more. Add-On Licenses An add-on license provides Cisco innovations on the switch, and on the Cisco Digital Network Architecture Center (Cisco DNA Center). An add-on license is valid only until a certain date. You can purchase an add-on license for a three, five, or seven year subscription period. DNA Essentials DNA Advantage: Includes features available with the DNA Essentials license and more. Guidelines for Using Base and Add-On Licenses Base licenses (Network Essentials and Network-Advantage) are ordered and fulfilled only with a perpetual or permanent license type. Add-on licenses (DNA Essentials and DNA Advantage) are ordered and fulfilled only with a subscription or term license type. An add-on license level is included when you choose a network license level. If you use DNA features, renew the license before term expiry, to continue using it. If you don’t want to continue using DNA features, deactivate the add-on license and then reload the switch to continue operating with the base license capabilities. When ordering an add-on license with a base license, note the combinations that are permitted and those that are not permitted: Table 1: Table 4. Permitted Combinations | DNA Essentials| DNA Advantage ---|---|--- Network Essentials| Yes| No Network Advantage| Yes1| Yes You will be able to purchase this combination only at the time of DNA license renewal and not when you purchase DNA-Essentials the first time To know which license levels a feature is available with, use Cisco Feature Navigator. To access Cisco Feature Navigator, go to https://cfnng.cisco.com. An account on cisco.com is not required. Export Control Key for High Security Products and features that provide cryptographic functionality are within the purview of U.S. export control laws 2. The Export Control Key for High Security (HSECK9 key) is an export-controlled license, which authorizes the use of cryptographic functionality. This subsection provides information about the Cisco Catalyst 9300 Series Switches that support the HSECK9 key, the cryptographic features that require the HSECK9 key, what to consider when ordering it, prerequisites, and how to configure it on supported platforms. Supported Platforms and Releases The HSECK9 key is available only on Cisco Catalyst 9300X Series Switches, starting with Cisco IOS XE Bengaluru 17.6.2. For information about the available SKUs in the series, see the Cisco Catalyst 9300 Series Switches Hardware Installation Guide. When an HSECK9 Key Is Required An HSECK9 key is required only if you want to use certain cryptographic features that are restricted by U.S. export control laws. You cannot enable restricted cryptographic features without it. The IPsec feature requires an HSECK9 key. Prerequisites for Using an HSECK9 Key Ensure you meet the following requirements: The device is one that supports the HSECK9 key. See Supported Platforms and Releases, on page 2. You have configured the DNA Advantage license on the device. You cannot use an HSECK9 key without DNA Advantage configured. You have the required number of HSECK9 keys in the applicable Smart Account and Virtual Account in Cisco Smart Software Manager (CSSM). Each UDI where you want to use a cryptographic feature requires one HSECK9 key. Ensure that you have read the stacking considerations for the number of keys you require. See Stacking Considerations, on page 4. You have implemented one of the supported Smart Licensing Using Policy topologies. This enables you to install a Smart Licensing Authorization Code (SLAC) for each HSECK9 key you want to use. An HSECK9 key requires authorization before use, because it is restricted by U.S. trade-control laws (export-controlled). A SLAC provides this authorization and allows activation and continued use of an export-controlled license. A SLAC is generated in and obtained from CSSM. There are multiple ways in which a device can be connected to CSSM, to obtain a SLAC. Each way of connecting to CSSM is called a topology. The configuration section shows you how to obtain a SLAC with each topology (Installing SLAC for an HSECK9 Key, on page 7). Note To obtain and install SLAC on supported platforms that are within the scope of this document (Supported Platforms and Releases, on page 2), refer to the configuration section in this document. There are differences in the configuration process when compared to other Cisco products. You configure the cryptographic feature only after you have installed SLAC. If not, you have to reconfigure the cryptographic feature after installing SLAC. Ordering Considerations This section covers important ordering considerations for an HSECK9 key. A separate HSECK9 key is required for each UDI where you want to use a cryptographic feature. If you have a device stack see the Stacking Considerations, on page 4 section for information about the number of keys you require. If you plan to use cryptographic functionality on new hardware that you are ordering (supported platforms), provide your Smart Account and Virtual Account information with the order. This enables Cisco to factory-install SLAC. For information about ordering the key, see the Cisco Catalyst 9300 Series Ordering Guide. Stacking Considerations This section covers HSECK9 considerations and requirements that apply to a device stack with an active, a standby, and one or more members. Mixed stacking is not supported – all the devices in the stack must be Cisco Catalyst 9300X SeriesSwitches. For information about the available C9300X SKUs in the series, see the Cisco Catalyst 9300 Series Switches Hardware Installation Guide. At a minimum, you must obtain an HSECK9 key and install SLAC for the active device in a stack. For uninterrupted use of the cryptographic feature in the event of a switchover, we recommend that you obtain an HSECK9 key for the standby also. Consider the following scenarios: Scenario 1: Device stack where the standby has an HSECK9 key and SLAC. When a switchover occurs, the system continues operation of the cryptographic functionality on the new active without any interruptions. Scenario 2: Device stack where the standby does not have an HSECK9 key. A daily system message is displayed to alert you to the fact that the current standby does not have the requisite HSECK9 key and cryptographic functionality may be disabled when a switchover occurs. It does not affect the functioning of HSECK9-enabled features on the currently active device: %IOSXE_SMART_AGENT-6-STANDBY_NOT_AUTHORIZED: Standby is in ‘not authorized’ state for license hseck9 After the switchover occurs and the standby (without an HSCECK9 key) becomes the new active, the following system messages are displayed. They alert you to the fact that the new active does not have an HSECK9 key and that the device is reloading: %PLATFORM_IPSEC_HSEC-3-UNAUTHORIZED_HSEC: Switchover happened with IPSec configured but HSEC unauthorized, reloading. %PMAN-5-EXITACTION: F0/0: pvp: Process manager is exiting: reload fp action requested %PMAN-5-EXITACTION: R0/0: pvp: Process manager is exiting: rp processes exit with reload switch code There are two possible outcomes at stack bootup after reload: If the next new active selected at stack bootup after reload has an HSECK9 key, then the cryptographic functionality in the startup configuration is applied or accepted and the system resumes operation of the cryptographic functionality. If the next new active selected at stack bootup after reload does not have an HSECK9 key either, then the cryptographic functionality in the startup configuration is rejected and cryptographic functionality is disabled in the entire stack. To add a device to an existing stack where cryptographic functionality is already being used, follow either one of these sequences: Add the device to the stack, and request SLAC for the entire stack again. See Example: Requesting and Installing SLAC – Adding a Member and Requesting SLAC Again, on page 23. Install SLAC on the standalone, configure the cryptographic functionality on the standalone device, and finally add the device to the existing stack. See Example: Requesting and Installing SLAC – Requesting SLAC on a Standalone Then Adding Member, on page 27. How to Configure Available Licenses This section provides information about how to configure available licenses. Configuring Base and Add-On Licenses After you order and purchase a base or add-on license, you must configure the license on the device before you can use it. This task sets a license level and requires a reload before the configured changes are effective. You can use this task to Change the current license. Add another license. For example, if you are currently using Network Advantage and you also want to use features available with the corresponding Digital Networking Architecture (DNA) Advantage license. Remove a license. Procedure | Command or Action| Purpose ---|---|--- Step 1| enable Example: Device> enable | Enables privileged EXEC mode. Enter your password, if prompted. Step 2| configure terminal Example: Device# configure terminal | Enters global configuration mode. Step 3| license boot level { network-advantage [ addon dna- advantage ] | network-essentials [ addon dna-essentials ] } Example: Device(config)# license boot level network-advantage add-on dna-advantage | Activates the configured license on the product instance. • network-advantage [ addon dna-advantage ]: Configures the Network Advantage license. Optionally, you can also configure the Digital Networking Architecture (DNA) Advantage license. • network-advantage [ addon dna-advantage ]: Configures the Network Essentials license. Optionally, you can also configure the Digital Networking Architecture (DNA) Essentials license. In the accompanying example, the DNA Advantage license will be activated on the product instance after reload. | Command or Action| Purpose ---|---|--- Step 4| exit Example: Device(config)# exit | Returns to the privileged EXEC mode. Step 5| copy running-config startup-config Example: Device# copy running-config startup-config | Saves changes in the configuration file. Step 6| show version Example: Device# show version Technology Package License Information: | Shows currently configured license information and the license that is applicable after reload. The “Technology-package Next reboot” column displays the change in the configured license that is effective after reload, only if you save the configuration change. In the accompanying example, the current license level is Network Advantage. Because the configuration change was saved, the “Technology-package Next reboot” column shows that the DNA Advantage license will be activated after reload. Technology-package Technology-package Current Type Next reboot —————————————————————— network-advantage Smart License network-advantage Subscription Smart License dna-advantage Step 7| reload Example: Device# reload | Reloads the device. Step 8| show version Example: Device# show version Technology Package License Information: | Shows currently configured license information and the license that is applicable after reload. Technology-package Technology-package Current Type Next reboot network-advantage Smart License network-advantage dna-advantage Subscription Smart License dna-advantage What to do next After you configure a license level, the change is effective after a reload. To know if reporting is required, you can wait for a system message or refer to the policy-using show commands. The system message, which indicates that reporting is required: %SMART_LIC-6-REPORTING_REQUIRED: A Usage report acknowledgment will be required in [dec] days. [dec] is the amount of time (in days) left to meet reporting requirements. If using show commands, refer to the output of the show license status privileged EXEC command and check the Next ACK deadline field. This means a RUM report must be sent and the ACK must be installed by this date. The method that you can use to send the RUM report, depends on the topology you have implemented. Refer to the workflow for the applicable topology in the How to Configure Smart Licensing Using Policy: Workflows by Topology section of the Smart Licensing Using Policy chapter in this guide. Installing SLAC for an HSECK9 Key This section shows you the various methods of installing SLAC for an HSECK9 key. Each method corresponds with a particular topology in the Smart Licensing Using Policy environment. For information about all the supported topologies, see the Supported Topologies section of the Smart Licensing Using Policy chapter in this guide. Note The only topology that you cannot implement if you want to use an HSECK9 key, is Connected to CSSM Through a Controller. The “controller” here is Cisco DNA Center. The Cisco DNA Center GUI does not provide an option to generate a SLAC for Cisco Catalyst switches that support HSECK9. **Installing SLAC: Connected Directly to CSSM ** This task shows you how to request and install SLAC when the device (product instance), is directly connected to CSSM. Before you begin Ensure that the device is one that supports HSECK9. See Supported Platforms and Releases, on page 2. Ensure you have the required number of HSECK9 keys in the applicable Smart Account and Virtual Account in CSSM. Ensure that you have completed Steps from 1 through 3 of the Connected Directly to CSSM topology. See Workflow for Topology: Connected Directly to CSSM. Procedure | Command or Action| Purpose ---|---|--- Step 1| enable Example: Device> enable | Enables privileged EXEC mode. Enter your password, if prompted. Step 2| license smart authorization request { add | replace } _featurename { all | local } Example: Device# license smart authorization request add hseck9 local | Requests a SLAC from CSSM or CSLU or SSM On-Prem. • Specify if you want to add to or replace an existing SLAC: • add : This adds the requested key to an existing SLAC. The new SLAC will contain all the keys of the existing SLAC, and the requested key. • replace : This replaces the existing SLAC. The new SLAC will contain only the requested key. All HSECK9 keys in the existing SLAC are returned. When you enter this keyword, the product instance checks if these existing keys are in-use. If they are, an error message is displayed, telling you to first disable the corresponding cryptographic feature. • _featurename : Enter the name of the export-controlled license for which you want to request an addition or a replacement of the SLAC. Enter “hseck9” to request and install SLAC for the HSECK9 key. • Specify the device by entering one of these options: • all : Gets the authorization code for all devices in a High Availability and stacking set-up. | Command or Action| Purpose ---|---|--- | | Note If you have added a device (where SLAC is not installed) to an existing stack where SLAC is already installed, use the replace and all options. This requests SLAC for all the devices in the stack. You cannot request SLAC for a particular member. Your only options are: either the active, or the entire stack. • local : Gets the authorization code for the active device in a High Availability and stacking set-up. This is the default option. Step 3| (Optional) license smart sync { all | local } Example: Device# license smart sync local | Triggers the product instance to synchronize with CSSM, or CSLU, or SSM On- Prem, to send and receive any pending data. This step is optional and applies only to scenarios where the product instance is connected to CSSM, or CSLU or SSM On-Prem, and where the product instance initiates communication. The corresponding topologies are: Connected Directly to CSSM , Connected to CSSM Through CSLU (product instance-initiated), and SSM On-Prem Deployment (product instance-initiated communication). Here, the command manually triggers synchronization and completes the SLAC installation process. Otherwise SLAC is applied to the product instance the next time the product instance contacts CSLU or SSM On-Prem. What to do next Required Tasks After Installing SLAC, on page 18 Installing SLAC: No Connectivity to CSSM and No CSLU This task shows you how to request and install SLAC in an air-gapped network, where a device (product instance) cannot communicate online, with anything outside its network. There are two parts to this task. The first part (in the first step) requires you to generate and download a SLAC file for each HSECK9 key, from CSSM – you will need a workstation that has connectivity to the Internet and the CSSM Web UI. Step 2 onwards are commands that you must configure to import a downloaded SLAC file into the product instance. Before you begin Ensure that the device is one that supports HSECK9. See Supported Platforms and Releases, on page 2. Ensure you have the required number of HSECK9 keys in the applicable Smart Account and Virtual Account in CSSM. Ensure that you have completed Step 1 of the No Connectivity to CSSM and No CSLU topology. See Workflow for Topology: No Connectivity to CSSM and No CSLU. Procedure | Command or Action| Purpose ---|---|--- Step 1| Generating and Downloading SLAC from CSSM to a File| This task is performed on the CSSM Web UI. Step 2| enable Example: Device> enable | Enables privileged EXEC mode. Enter your password, if prompted. Step 3| copy source filename bootflash: Example: Device# copy tftp://10.8.0.6/user01/example.txt bootflash: | (Optional) Copies the file from its source location or directory to the flash memory of the product instance. You can also import the file directly from a remote location and install it on the product instance (next step). • source : This is the source location of file. The source can be either local or remote. • bootflash: : This is the destination for boot flash memory. Step 4| license smart import _filepathfilename Example: Device# license smart import bootflash:example.txt | Imports and installs the file on the product instance. For _filepathfilename , specify the location, including the filename. After installation, a system message displays the type of file you installed. Note When installing SLAC for multiple product instances (as in a stacking set-up), ensure that you download a separate .txt SLAC file for each UDI. Import and install one file at a time. What to do next Required Tasks After Installing SLAC, on page 18 Installing SLAC: Connected to CSSM Through CSLU (Product Instance- Initiated) This task shows you how to request and install SLAC when the device (product instance) is connected to CSSM through CSLU and where the product instance initiates communication, that is, the product instance is configured to push the required information to CSLU. Before you begin Ensure that the device is one that supports HSECK9. See Supported Platforms and Releases, on page 2. Ensure you have the required number of HSECK9 keys in the applicable Smart Account and Virtual Account in CSSM. Ensure that you have completed Steps 1 through 3 of the Connected to CSSM Through CSLU (Product Instance-Initiated Communication) topology. See Workflow for Topology: Connected to CSSM Through CSLU → Tasks for Product Instance-Initiated Communication. Procedure | Command or Action| Purpose ---|---|--- Step 1| enable Example: Device> enable | Enables privileged EXEC mode. Enter your password, if prompted. Step 2| license smart authorization request { add | replace } _featurename { all | local } Example: Device# license smart authorization request add hseck9 local | Requests a SLAC from CSSM or CSLU or SSM On-Prem. • Specify if you want to add to or replace an existing SLAC: • add : This adds the requested key to an existing SLAC. The new SLAC will contain all the keys of the existing SLAC, and the requested key. • replace : This replaces the existing SLAC. The new SLAC will contain only the requested key. All HSECK9 keys in the existing SLAC are returned. When you enter this keyword, the product instance checks if these existing keys are in-use. If they are, an error message is displayed, telling you to first disable the corresponding cryptographic feature. | Command or Action| Purpose ---|---|--- | | • _featurename : Enter the name of the export-controlled license for which you want to request an addition or a replacement of the SLAC. Enter “hseck9” to request and install SLAC for the HSECK9 key. • Specify the device by entering one of these options: • all : Gets the authorization code for all devices in a High Availability and stacking set-up. Note If you have added a device (where SLAC is not installed) to an existing stack where SLAC is already installed, use the replace and all options. This requests SLAC for all the devices in the stack. You cannot request SLAC for a particular member. Your only options are: either the active, or the entire stack. • local : Gets the authorization code for the active device in a High Availability and stacking set-up. This is the default option. Step 3| (Optional) license smart sync { all | local } Example: Device# license smart sync local | Triggers the product instance to synchronize with CSSM, or CSLU, or SSM On- Prem, to send and receive any pending data. This step is optional and applies only to scenarios where the product instance is connected to CSSM, or CSLU or SSM On-Prem, and where the product instance initiates communication. The corresponding topologies are: Connected Directly to CSSM , Connected to CSSM Through CSLU (product instance-initiated), and SSM On-Prem Deployment (product instance-initiated communication). | Command or Action| Purpose ---|---|--- | | Here, the command manually triggers synchronization and completes the SLAC installation process. Otherwise SLAC is applied to the product instance the next time the product instance contacts CSLU or SSM On-Prem. What to do next Required Tasks After Installing SLAC, on page 18 **Installing SLAC: Connected to CSSM Through CSLU (CSLU-Initiated) ** This task shows you how to request and install SLAC when the device (product instance) is connected to CSSM through CSLU and where CSLU initiates communication, that is, CSLU is configured to pull the required information from the product instance. This task requires you to configure certain commands on the product instance, certain tasks in the CSSM Web UI, and certain tasks in the CSLU interface. Before you begin Ensure that the device is one that supports HSECK9. See Supported Platforms and Releases, on page 2. Ensure you have the required number of HSECK9 keys in the applicable Smart Account and Virtual Account in CSSM. Ensure that you have completed Steps 1 through 3 of the Connected to CSSM Through CSLU (Product Instance-Initiated Communication) topology. See Workflow for Topology: Connected to CSSM Through CSLU → Tasks for CSLU-Initiated Communication. Procedure | Command or Action| Purpose ---|---|--- Step 1| enable Example: Device> enable | Enables privileged EXEC mode. Enter your password, if prompted. Step 2| license smart authorization request { add | replace } _featurename { all | local } Example: Device# license smart authorization request add hseck9 local | Requests a SLAC from CSSM or CSLU or SSM On-Prem. • Specify if you want to add to or replace an existing SLAC: • add : This adds the requested key to an existing SLAC. The new SLAC will contain all the keys of the existing SLAC, and the requested key. | Command or Action| Purpose ---|---|--- | | • replace : This replaces the existing SLAC. The new SLAC will contain only the requested key. All HSECK9 keys in the existing SLAC are returned. When you enter this keyword, the product instance checks if these existing keys are in-use. If they are, an error message is displayed, telling you to first disable the corresponding cryptographic feature. • _featurename : Enter the name of the export-controlled license for which you want to request an addition or a replacement of the SLAC. Enter “hseck9” to request and install SLAC for the HSECK9 key. • Specify the device by entering one of these options: • all : Gets the authorization code for all devices in a High Availability and stacking set-up. Note If you have added a device (where SLAC is not installed) to an existing stack where SLAC is already installed, use the replace and all options. This requests SLAC for all the devices in the stack. You cannot request SLAC for a particular member. Your only options are: either the active, or the entire stack. • local : Gets the authorization code for the active device in a High Availability and stacking set-up. This is the default option. Step 3| Requesting SLAC for One or More Product Instance (CSLU Interface)| This task is performed on the CSLU interface. | Command or Action| Purpose ---|---|--- Step 4| Generating and Downloading SLAC from CSSM to a File| This task is performed on the CSSM Web UI. Step 5| Import from CSSM (CSLU Interface)| This task is performed on the CSLU interface. After you have completed it, the uploaded codes are applied to the product instances the next time CSLU runs an update. What to do next Required Tasks After Installing SLAC, on page 18 Installing SLAC: SSM On-Prem Deployment (Product Instance-Initiated) This task shows you how to request and install SLAC when the device (product instance) is connected to SSM On-Prem and where the product instance initiates communication, that is, the product instance is configured to push the required information to SSM On-Prem. Here you first create a request file in SSM On-Prem, upload the request in the CSSM Web UI, generate SLAC, import the SLAC into the SSM On-Prem server. Finally configure the commands on the product instance to request and install SLAC. Before you begin Ensure that the device is one that supports HSECK9. See Supported Platforms and Releases, on page 2. Ensure you have the required number of HSECK9 keys in the applicable Smart Account and Virtual Account in CSSM. Ensure that you have completed Steps 1 through 3 c. of the SSM On-Prem Deployment (Product Instance-Initiated) topology. See Workflow for Topology: SSM On-Prem Deployment → Tasks for Product Instance-Initiated Communication. Procedure | Command or Action| Purpose ---|---|--- Step 1| Submitting an Authorization Code Request (SSM On-Prem UI)| This task is performed on the SSM On-Prem UI. Step 2| Generating and Downloading SLAC from CSSM to a File| This task is performed on the CSSM Web UI. Step 3| enable Example: Device> enable | Enables privileged EXEC mode. Enter your password, if prompted. Step 4| license smart authorization request { add | replace } _featurename { all | local } Example: | Requests a SLAC from CSSM or CSLU or SSM On-Prem. | Command or Action| Purpose ---|---|--- | Device# license smart authorization request add hseck9 local| • Specify if you want to add to or replace an existing SLAC: | • add : This adds the requested key to an existing SLAC. The new SLAC will contain all the keys of the existing SLAC, and the requested key. | • replace : This replaces the existing SLAC. The new SLAC will contain only the requested key. All HSECK9 keys in the existing SLAC are returned. When you enter this keyword, the product instance checks if these existing keys are in-use. If they are, an error message is displayed, telling you to first disable the corresponding cryptographic feature. | • _featurename : Enter the name of the export-controlled license for which you want to request an addition or a replacement of the SLAC. Enter “hseck9” to request and install SLAC for the HSECK9 key. | • Specify the device by entering one of these options: | • all : Gets the authorization code for all devices in a High Availability and stacking set-up. | Note If you have added a device (where SLAC is not installed) to an existing stack where SLAC is already installed, use the replace and all options. This requests SLAC for all the devices in the stack. You cannot request SLAC for a particular member. Your only options are: either the active, or the entire stack. | Command or Action| Purpose ---|---|--- | | • local : Gets the authorization code for the active device in a High Availability and stacking set-up. This is the default option. Step 5| (Optional) license smart sync { all | local } Example: Device# license smart sync local | Triggers the product instance to synchronize with CSSM, or CSLU, or SSM On- Prem, to send and receive any pending data. This step is optional and applies only to scenarios where the product instance is connected to CSSM, or CSLU or SSM On-Prem, and where the product instance initiates communication. The corresponding topologies are: Connected Directly to CSSM , Connected to CSSM Through CSLU (product instance-initiated), and SSM On-Prem Deployment (product instance-initiated communication). Here, the command manually triggers synchronization and completes the SLAC installation process. Otherwise SLAC is applied to the product instance the next time the product instance contacts CSLU or SSM On-Prem. What to do next Required Tasks After Installing SLAC, on page 18 Installing SLAC: SSM On-Prem Deployment (SSM On-Prem-Initiated) This task shows you how to request and install SLAC when the device (product instance), is connected to SSM On-Prem and where SSM On-Prem initiates communication, that is, SSM On-Prem is configured to pull the required information from the product instance. Here you create a request file in SSM On-Prem, upload the request in the CSSM Web UI, generate SLAC, import it into the SSM On-Prem server. Finally, synchronize SSM On-Prem with the product instance. Before you begin Ensure that the device is one that supports HSECK9. See Supported Platforms and Releases, on page 2. Ensure you have the required number of HSECK9 keys in the applicable Smart Account and Virtual Account in CSSM. Ensure that you have completed Steps 1 through 3 a. of the SSM On-Prem Deployment (Product Instance-Initiated) topology. See Workflow for Topology: SSM On-Prem Deployment → Tasks for SSM On-Prem Instance-Initiated Communication. Procedure | Command or Action| Purpose ---|---|--- Step 1| Submitting an Authorization Code Request (SSM On-Prem UI).| This task is performed in the SSM On-Prem UI. Step 2| In the SSM On-Prem UI, navigate to Reports Synchronisation pull schedule with the devices > Synchronise now with the device. | This step is optional. If you don’t synchronize immediately after importing the codes, the uploaded codes are applied to the product instances the next time SSM On-Prem runs an update. What to do next Required Tasks After Installing SLAC, on page 18 Required Tasks After Installing SLAC This task shows you the activities that you must complete after installing SLAC. The information here applies to all methods of installing SLAC. Procedure Step 1 Verify SLAC installation and HSECK9 key usage. Check that the authorization status in the output of the show license authorization privileged EXEC command displays: Status: SMART AUTHORIZATION INSTALLED on . This means SLAC is installed. If you have installed more than one SLAC (in a High Availability or stacking set-up), ensure that all connected devices display the above status. Check that the usage status and count in the output of the show license summary privileged EXEC command displays: NOT IN USE and 0. This means that the HSECK9 key is available but is not in-use yet. The following system messages are displayed after SLAC installation: Error Message %SMART_LIC-6-AUTHORIZATION_INSTALL_SUCCESS: A new licensing authorization code was successfully installed on: [chars]. [chars] is the UDI where the SLAC was installed. %SMART_LIC-6-EXPORT_CONTROLLED: Usage of export controlled features is allowed for feature hseck9. Step 2 Configure the cryptographic feature. The following IPsec configuration is for example purposes only. For information about configuring the feature, see the Configuring IPsec chapter of the Security Configuration Guide, Cisco IOS XE (Catalyst 9300 Switches). Example: Device# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Device(config)# int tu10 Device(config-if)# tunnel mode ipsec ipv4 Device(config-if)# end Step 3 Again check HSECK9 key usage. After you configure the cryptographic feature, the usage status and count in the output of the show license summary privileged EXEC command changes to: IN USE and 1. Note The system counts only one HSECK9 key as IN USE at a given point in time. Even if you have installed SLAC on more than one device in a stacking step-up, the usage count in the output of the show license summary command displays only 1. This is because only oneHSECK9 key is used at a given point in time – the one on the active. The HSECK9 key on the standby is used when a switchover occurs. When the standby becomes the new active, usage count remains 1, because it is still only one key that is being used. Step 4 Check if reporting is required. The method that you can use to send the RUM report, depends on the topology you have implemented. Refer to the workflow for the applicable topology in the How to Configure Smart Licensing Using Policy: Workflows by Topology section of the Smart Licensing Using Policy chapter in this guide. To know if reporting is required, you can wait for a system message or refer to the policy using show commands. The system message, which indicates that reporting is required: %SMART_LIC-6-REPORTING_REQUIRED: A Usage report acknowledgement will be required in [dec] days. [dec] is the amount of time (in days) left to meet reporting requirements. If using show commands, refer to the output of the show license status privileged EXEC command. Check the Next ACK deadline field. You must send the RUM report and ensure that the ACK is installed by this date. Returning a SLAC This task shows you how to return a SLAC and return the HSECK9 key to your license pool in CSSM. You can use this task with all topologies. You may want to return a SLAC and HSECK9 key under these circumstances: You no longer want to use the cryptographic feature, which requires an HSECK9 key. You want to return the device for Return Material Authorization (RMA), or decommission it permanently. When you return a device to Cisco, you have to configure the licence smart factory reset privileged EXEC command, which removes all licensing information (except the licenses in-use) from the product instance, including any authorization codes, RUM reports and so on. Before you perform a factory reset, return the SLAC code. We also recommend that you send a RUM report to CSSM before removing licensing information from the product instance. Before you begin Disable or unconfigure the cryptographic feature for which you used the HSECK9 key and ensure that the usage status for the HSECK9 key is NOT IN USE. Procedure | Command or Action| Purpose ---|---|--- Step 1| enable Example: Device> enable | Enables privileged EXEC mode. Enter your password, if prompted. Step 2| show license summary Example: Device# show license summary License Usage: | (Optional) Displays license usage summary. This step applies only if you are returning a SLAC. | Command or Action| Purpose ---|---|--- | License Entitlement Tag Count Status ————————————————————- network-advantage (C9300-24 Network Advan…) 1 IN USE dna-advantage (C9300-24 DNA Advantage) 1 IN USE network-advantage (C9300-48 Network Advan…) 2 IN USE dna-advantage (C9300-48 DNA Advantage) 2 IN USE C9K HSEC (Cat9K HSEC) 1 IN USE | If the status of the HSECK9 key is displayed as IN USE even after the cryptographic feature is disabled, then perform the next step. This is the case in the accompanying example If the status of the HSECK9 key is displayed as NOT IN USE skip to Step 5. Step 3| platform hsec-license-release Example: Device# configure terminal Device(config)# platform hsec-license- release HSEC license is released Device(config)# exit | (Optional) Enters the global configuration mode, releases the HSECK9 license, and returns to privileged EXEC mode. If the cryptographic feature using the HSECK9 key has been disabled or unconfigured, and the it is still displayed as IN USE, this command forces the system to change the HSECK9 key status to NOT IN USE. Step 4| show license summary Example: Device# show license summary License Usage: License Entitlement Tag Count Status | Ensure that the status of the license or key that you want to return is NOT IN USE. If it is in-use, you must first disable the feature. network-advantage (C9300-24 Network Advan…) 1 IN USE dna-advantage (C9300-24 DNA Advantage) 1 IN USE network-advantage (C9300-48 Network Advan…) 2 IN USE dna-advantage (C9300-48 DNA Advantage) 2 IN USE C9K HSEC (Cat9K HSEC) 0 NOT IN USE Step 5| license smart authorization return { all | local } { offline [ path ] | online } Example: Device# license smart authorization return all online OR Device# license smart authorization return all offline Enter this return code in Cisco Smart | Returns an authorization code back to the license pool in CSSM. A return code is displayed after you enter this command. Specify the product instance: • all : Performs the action for all connected product instances in a High Availability or stacking set-up. • local : Performs the action for the active product instance. This is the default option. | Command or Action| Purpose ---|---|--- | Software Manager portal: UDI: PID:C9300X-24HX,SN:FOC2519L8R7 Return code: Cr9JHx-L1x5Rj-ftwzg1-h9QZAU-LE5DT1-babWeL-FABPt9- Wr1Dn7-Rp7 OR Device# license smart authorization return all offline bootflash:return-code.txt | Specify if you are connected to CSSM or not: • If connected to CSSM, or if you have implemented a topology where the product instance-initiates communication (CSLU or SSM On-Prem), enter online. The code is automatically returned to CSSM and a confirmation is returned and installed on the product instance. If you choose this option, the return code is automatically submitted to CSSM. | • If not connected to CSSM, or if you have implemented a topology with CSLU-initiated or SSM On-Prem initiated communication, enter offline [ _filepathfilename ]. If you enter only the offline keyword, copy the return code that is displayed on the CLI and enter it in CSSM. If you save the return code to a file, you can copy the code from the file and enter the same in CSSM. The file format can be any readable format (You will not be uploading this). For example: | Device# license smart authorization | return local offline | bootflash:return-code.txt | Complete this task to enter the return code in CSSM: Entering a SLAC Return Code in CSSM and Removing a Product Instance. Step 6| show license authorization| Displays licensing information. Check the License Authorizations header in the output. If the return process is completed correctly, the Last return code: field displays the return code. | Example: | Device# show license authorization | License Authorizations ====================== Overall status: Active: PID:C9300X-24HX,SN:FOC2519L8R7 | Status: NOT INSTALLED Last return code: Cr9JHx-L1x5Rj-ftwzg1-h9QZAU-LE5DT1- babWeL-FABPt9-Wr1Dn7-Rp7 Standby: PID:C9300X-48HXN,SN:FOC2524L39P Status: NOT INSTALLED Member: PID:C9300X-48HX,SN:FOC2516LC92 | Status: NOT INSTALLED Examples for Configuring Available Licenses **Example: Requesting and Installing SLAC – Adding a Member and Requesting SLAC Again ** This example shows you how to add a device to an existing stack where cryptographic functionality is being used. The overall sequence with this method is as follows: Add new member to the existing device → Request and install SLAC for the entire stack again. Displaying information about the existing stack The output of the show switch detail command shows that this is a two-member stack. The output of the show license authorisation command shows that SLAC is installed on the active (C9300X-24HX,SN:FOC2519L8R7) and the standby (PID:C9300X-48HXN,SN:FOC2524L39P). The output of the show license summary command shows that the cryptographic functionality has been configured (C9K HSEC – IN USE). The output of the show license all command (truncated output) shows that the Connected Directly to CSSM topology is implemented here. The Smart transport option is used for communication with CSSM. Adding a new member to the stack The syslogs show the sequence of events after the new member is added to the stack. Note the successful trust code installation on the newly added member (%SMART_LIC-6-TRUST_INSTALL_SUCCESS). The output of the show switch stack-ports and show switch detail commands show the status of switch 3, which is the newly added member. The output of the show license udi command shows the PIDs of all the connected devices in the stacking set-up including the new member, C9300X-48HX,SN:FOC2516LC92. The output of the show license authorisation command shows that SLAC is installed on the active (C9300X-24HX,SN:FOC2519L8R7) and the standby (PID:C9300X-48HXN,SN:FOC2524L39P), but not on the newly added member. Requesting SLAC for the entire stack again The method of requesting and installing SLAC here corresponds with the Connected Directly to CSSM topology. Follow the method that applies to the topology you implement. The system messages show that SLAC is installed on all the connected devices in the set-up – the active (SN:FOC2519L8R7), the standby (SN:FOC2524L39P), and the member (SN:FOC2516LC92). The output of the show license authorisation command displayes the updated timestamp and the new confirmation codes for SLAC installation. The confirmation codes for SN:FOC2519L8R7 and SN:FOC2524L39P (the existing devices in the stack), have changed from 72ad37d5 and 842584db to f6c6978d and 7ae69c8c, respectively. There is also confirmation code e3fd6642, on the new member, SN:FOC2516LC92. Example: Requesting and Installing SLAC – Requesting SLAC on a Standalone Then Adding Member This example shows you how to add a device to an existing stack where cryptographic functionality is being used. The overall sequence with this method is as follows: Install SLAC on the standalone → Configure the cryptographic functionality on the standalone → Add the device to the existing stack. Displaying information about the existing stack The output of the show switch detail command shows that this is a two-member stack. The output of the show license authorisation command shows that SLAC is installed on the active (C9300X-24HX,SN:FOC2519L8R7) and the standby (PID:C9300X-48HXN,SN:FOC2524L39P). The output of the show license summary command shows that the cryptographic functionality has been configured (C9K HSEC – IN USE). The output of the show license all command (truncated output) shows that the Connected Directly to CSSM topology is implemented here. The Smart transport option is used for communication with CSSM. Booting the third switch as a standalone The syslogs show the boot-up sequence. The output of the show switch detail command shows that this is a standalone set-up. Configuring the No Connectivity to CSSM and No CSLU topology on the standalone The example shows configuration that applied to the device used in the example. Configure the applicable commands depending on the topology you implement. The output of the show license authorisation command shows that SLAC is not installed on the standalone. Importing and installing SLAC Note: In this example, SLAC is generated in the CSSM Web UI and not shown here. For detailed steps, see Generating and Downloading SLAC from CSSM to a File The output of the show license authorisation command shows that SLAC is installed. Configuring the cryptographic feature The outputs of the show license summary commands show the status of the HSECK9 key before (NOT IN USE) and after (IN USE) configuration of the cryptographic feature. Adding the standalone switch to the existing stack The output of the show switch detail command shows that a new member has been added to the stack. The output of the show license all command shows that the SLAC on the new member is retained. Compare the “Status” and “Last Confirmation code” fields in the output here, with the output of the show license authorization command after SLAC installation on the standalone (above). The output of the show license summary shows that the cryptographic feature continues to be operational (the HSECK9 key is IN-USE). Feature History for Available Licenses This table provides release and related information for the features explained in this module. These features are available in all the releases subsequent to the one they were introduced in, unless noted otherwise. Release Feature Feature Information Cisco IOS XE Everest 16.5.1a Base and Add-On Licenses The software features available on Cisco Catalyst 9300 Series Switches fall under base or add-on license levels. See Base and Add-On Licenses, on page 1 and Configuring Base and Add-On Licenses, on page 5. Release Feature Feature Information Cisco IOS XE Bengaluru 17.6.2 Export Control Key for High Security (HSECK9) Introduces support for the HSECK9 key on the Cisco Catalyst 9300X Series Switches. The HSECK9 key is an export-controlled license, which authorizes the use of cryptographic features that are restricted by U.S. export control laws. If you want to use a restricted cryptographic feature, an HSECK9 key is required. See Export Control Key for High Security, on page 2 and Installing SLAC for an HSECK9 Key, on page 7. Use the Cisco Feature Navigator to find information about platform and software image support. To access Cisco Feature Navigator, go to https://cfnng.cisco.com/ http://www.cisco.com/go/cfn. Read User Manual Online (PDF format) Read User Manual Online (PDF format) >> Download This Manual (PDF format) Download this manual >>
