Field Notice: FN - 70490 - Virtual ESA/WSA/SMA Updates and Upgrades Will Fail After Smart License Migration if the XML File Expires - Workaround Provided

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Revision History

Revision	Publish Date	Comments
1.0	13-Jan-20	Initial Release

Products Affected

Affected OS Type	Affected Software Product	Affected Release	Affected Release Number	Comments
NON-IOS	AsyncOS for ESA	12	12.0.0, 12.1.0, 12.5.0
NON-IOS	AsyncOS for Content Security Management Appliance (SMA)	12	12.0.0, 12.0.1, 12.5.0
NON-IOS	AsyncOS for WSA	11	11.7.0, 11.7.1, 11.8.0, 11.8.0(refresh)

Defect Information

Defect ID	Headline
CSCvn51625	Virtual ESA/WSA/SMA Updates/Upgrades will fail after SL migration if XML <end_date> expires.

Problem Description

Smart License enabled virtual Cisco Content Security products might be unable to authenticate with the updates and upgrades server when the Smart Licenses or the traditional license (XML) file expires. As a result, the updates and upgrades will fail.

Background

Smart License enabled virtual Cisco Content Security products still rely on the certificate distributed in the traditional license (XML) file to receive updates and upgrades. The license file expires at the same time the Smart Licenses go Out of Compliance (OOC). Once the license (XML) file expires, the appliance will not be able to authenticate with the updates and upgrades server to receive the updates and upgrades.

Early alerts will be generated before the licenses go OOC. Administrators are expected to download and apply the renewed or temporary license (XML) file, after which the updates and upgrades will go smoothly.

This issue affects any AsyncOS version with Smart License support:

• AsyncOS for Web Security Appliance (WSA) Version 11.7.x and later
• AsyncOS for Email Security Appliance (ESA) Version 12.x and later
• AsyncOS for Security Management Appliance (SMA) Version 12.x and later

Problem Symptom

The Cisco Content Security products will not be able to retrieve updates for the engines. The image upgrades will fail with this error:

"Dynamic manifest fetch failure: Failed to authenticate with manifest server"

Workaround/Solution

Administrators are expected to raise a request to renew their licenses. Once they receive the new PAK file, they should download the renewed license (XML) file and then convert their licenses to Smart Licenses. The license file should be installed on the appliance, after which the updates and upgrades will go smoothly.

Alternately, contact the Cisco Systems Technical Assistance Center (TAC) in order to obtain a temporary license file from the Global Licensing team.

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

• Open a service request on Cisco.com
• By email
• By telephone

Receive Email Notification For New Field Notices

My Notifications—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.