Field Notice: FN - 72270 - PAK Licenses Will Not Be Supported on ASR 920 and NCS 520 Routers with Cisco IOS XE Release 17.7.x and Later - Software Upgrade Recommended

Available Languages

Updated:February 28, 2022

Document ID:FN72270

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Revision History

Revision	Publish Date	Comments
1.0	21-Feb-22	Initial Release

Products Affected

Affected Product ID	Comments
ASR-920-10SZ-PD
ASR-920-12CZ-A
ASR-920-12CZ-A=
ASR-920-12SZ-A
ASR-920-12SZ-A=
ASR-920-12SZ-D
ASR-920-12SZ-D=
ASR-920-12SZ-IM
ASR-920U-12SZ-IM=
ASR-920U-12SZ-IM
ASR-920-12SZ-IM++
ASR-920-12SZ-IM-CC
ASR-920-24SZ-IM
ASR-920-24SZ-M
ASR-920-24SZ-M++
ASR-920-24TZ-M=
ASR-920-24TZ-M
ASR-920-4SZ-A=
ASR-920-4SZ-A
ASR-920-4SZ-D
ASR-920-8S4Z-PD
ASR-920-8S4Z-PD=
N520-20G4Z-A=
N520-20G4Z-A
N520-20G4Z-D=
N520-20G4Z-D
N520-4G4Z-A=
N520-4G4Z-A
N520-X-20G4Z-A=
N520-X-20G4Z-A
N520-X-20G4Z-D=
N520-X-20G4Z-D
N520-X-4G4Z-A
N520-X-4G4Z-D

Defect Information

Defect ID	Headline
CSCvy52804	UEA: Safenet Library Removal Phase1 - Implement No License Mode

Problem Description

Product Activation Key (PAK) licenses will not be supported with Cisco IOS^® XE Release 17.7.x and later on ASR 920 Series Aggregation Services Routers (ASR 920) and Network Convergence System (NCS) 520 routers.

Background

The PAK-based license support is discontinued on ASR 920 and NCS 520 routers. Cisco recommends to enable Smart Licensing mode on these routers, which provides a convenient, consistent, and secure way to purchase and manage Cisco licenses.

Problem Symptom

A router, subjected to a software upgrade to Cisco IOS XE Release 17.7.x or later, will boot in no-license mode if PAK-based licenses are used with earlier Cisco IOS XE releases.

Sample output:

Router#sh ver | i License
licensed under the GNU General Public License ("GPL") Version 2.0. The
documentation or "License Notice" file accompanying the IOS-XE software,
License Level: advancedmetroipaccess
License Type: No License Mode
Router#

Workaround/Solution

Solution

There are two options available.

Option 1 (Cisco Recommended)

Enable Smart Licensing on routers with Cisco IOS XE Release 17.6.1 or earlier, and then perform a software upgrade to Cisco IOS XE Release 17.7.x or later.

Option 2

Upgrade the router to Cisco IOS XE Release 17.7.1 and then enable Smart Licensing mode. You will need to reload the router.

Workaround

The routers can be enabled with no-license mode, which temporarily enables the operation for a limited timeframe with Cisco IOS XE Release 17.7.x and later.

Complete these steps in order to activate Smart Licensing on the router:

In order to create a Smart Account, go to Smart Accounts and click Create account. Follow the instructions to create an account.
Once the Smart Account is created, log in to Cisco Software Central and access Smart Software Manager.
Click the Inventory tab.
From the Virtual Account drop-down list, choose virtual account.
Click the General tab.
Click New Token.
Enter the token description. Specify the number of days the token must be active.
Check the Allow export-controlled functionality on the products registered with this token check box.
Click Create Token.
Click Copy.

Registration of the Device Using the Token

Enter this command in order to complete the smart license configuration:

<device>#license smart register idtoken <token from CSSM portal>

On successful registration, the device displays the "Registered" status and receives an identity certificate. This certificate is saved on the router and will be automatically used for all future communication with Cisco.

Note: For an ASR device with redundancy enabled, you must enter the write memory command after successful registration. This ensures that the registration is valid even if you perform switchover or reload operations.

In order to enable the required technology package licenses, enter the license boot level <technologypackage> command from the global config mode.

Configure Smart Licensing on the Router

The process includes these steps:

Obtain the IP address for configuration which can access the Cisco Licensing Cloud servers.
Configure the Smart Call Home receiver HTTP address for Call-home message delivery.
Obtain the email, phone, and street address information for the Call Home contact for configuration, so that the receiver determines the origin of received messages.
Configure the IP route and verify the IP connectivity from the router to email servers or destination Smart Call Home receiver.

Step 1. Configure the IP address on the Mgmt-interface which accesses the backend servers.
Sample output:

Configure terminal
Router (config)#interface gi0
IP address 10.x.x.x 255.255.0.0

Step 2. Configure the Domain Name System (DNS) server IP address.
Sample output:

Router (config)#ip domain lookup source-interface GigabitEthernet0
Router (config)#ip http client source-interface GigabitEthernet0
Router (config)#ip name-server 72.163.128.140
Router (config)#ip name-server 171.70.168.183
Router (config)#ip name-server vrf Mgmt-intf 171.70.168.183
Router (config)#ip name-server vrf Mgmt-intf 72.163.128.140

Step 3. Configure the email server and destination Smart Call Home receiver HTTP address.
Sample output:

Router (config)#Call-home Router (config)#vrf Mgmt-intf Router(cfg-call-home)#contact-email-addr <addr> Router(cfg-call-home)#mail-server 72.163.197.20 priority 1 Router(cfg-call-home)#mail-server 173.36.12.72 priority 2 Router(cfg-call-home)#profile ciscoTAC-1 Router (cfg-call-home-profile)#destination transport-method http Router (cfg-call-home-profile)#destination address http http://elo-elm5.cisco.com:8080/ddce/services/DDCEService

Step 4. Configure the IP routes.
Sample output:

Router(config)#ip route vrf Mgmt-intf 0.0.0.0 0.0.0.0 10.78.100.1
Router(config)#ip route vrf Mgmt-intf 10.105.33.0 255.255.255.0 10.78.100.1

Note: Once Smart Licensing mode is enabled, all CLIs related to the traditional licensing mode are disabled.

Enable and Register Smart Licensing

Step 1. Enter this command.

license smart enable

Sample output:

Device(config)#license smart enable

All ports go to the admin down state when the no smart license enable command is entered. We recommend for you to complete this task in order to bring up the ports:

Default (license free) ports - Reload the router.
Licensed ports - Enter the no shutdown command on the router followed by a reload.

Note: If Smart Licensing is disabled, all the licenses might be deactivated and the target device might be inaccessible. Ensure the backup access method is available for the console or management port.

Step 2. Enter this command in order to enable technological licenses. Reboot the router after license configuration.

license boot level { advancedmetroipaccess | metroaccess | metroipaccess }

Sample output:

Device(config)#license boot level metroipaccess

Step 3. Enter this command in order to enable different feature level licenses.

license feature { atm | gnss | ipsec | port | ptp | upoe }

Sample output:

Device(config)#license feature atm

Step 4. Enter this command in order to register the device.

license smart register idtoken token_ID

Sample output:

Device#license smart register idtoken NmE1Yzg0OWMtYmJ4

license smart register: Registration process is
in progress.Please check the syslog for the
registration status and result

On successful registration, the device will receive an identity certificate. This certificate is saved on your device and automatically used for all future communications with Cisco. Every 30 days, Smart Licensing will automatically renew the registration information with Cisco.

Verify Smart Licensing Configuration

After you enable Smart Licensing, show commands can be used to verify the default Smart Licensing configuration.

Step 1. Enter this command in order to display the compliance status of Smart Licensing.

show license status

See this table for the possible statuses and descriptions:

Status	Description
Enabled	Indicates that Smart Licensing is enabled.
Waiting	Indicates the initial state after your device has made a license entitlement request. The device establishes communication with Cisco and successfully registers itself with the Cisco license manager.
Authorized	Indicates that your device is able to communicate with the Cisco license manager, and is authorized to initiate requests for license entitlements.
Out-Of-Compliance	Indicates that one or more of your licenses are out-of-compliance. You must buy additional licenses.
Eval Period	Indicates that Smart Licensing is consuming the evaluation period. You must register the device with the Cisco Licensing manager, else your license expires.
Grace Period	Indicates that connectivity to the Cisco license manager is lost. You must try restore connectivity to renew the authorization period.
Disabled	Indicates that Smart Licensing is disabled.
Invalid	Indicates that Cisco does not recognize the entitlement tag as it is not in the database.

Sample output:

Device#show license status

Smart Licensing is ENABLED

Registration:
  Status: REGISTERED
  Smart Account: BU Production Test
  Virtual Account:Device
  Export-Controlled Functionality: Allowed
  Initial Registration: SUCCEEDED on Dec 17 02:31:11 2015 UTC
  Last Renewal Attempt: None
  Next Renewal Attempt: Jun 14 02:31:10 2016 UTC
  Registration Expires: Dec 16 02:25:58 2016 UTC

License Authorization:
  Status: AUTHORIZED on Feb 01 05:08:29 2016 UTC
  Last Communication Attempt: FAILED on Feb 01 05:08:29 2016 UTC
    Failure reason: Fail to send out Call Home HTTP message.
  Next Communication Attempt: Feb 02 04:09:56 2016 UTC
  Communication Deadline: Mar 16 03:00:33 2016 UTC

Step 2. Enter this command in order to display all entitlements in use. Additionally, the output shows associated licensing certificates, compliance status, Unique Device Identifier (UDI), and other details.

Device#show license all

Step 3. Enter this command in order to display the output of the license commands.

show license tech support

Sample output:

Device#show license tech support

Smart Licensing Status
======================

Smart Licensing is ENABLED

Registration:
  Status: REGISTERED
  Smart Account: BU Production Test
  Virtual Account:Device
  Export-Controlled Functionality: Allowed
  Initial Registration: SUCCEEDED on Dec 17 02:31:11 2015 UTC
  Last Renewal Attempt: None
  Next Renewal Attempt: Jun 14 02:31:11 2016 UTC
  Registration Expires: Dec 16 02:25:59 2016 UTC

License Authorization:
  Status: AUTHORIZED on Feb 01 05:08:29 2016 UTC
  Last Communication Attempt: FAILED on Feb 01 05:08:29 2016 UTC
    Failure reason: Fail to send out Call Home HTTP message.
  Next Communication Attempt: Feb 02 04:09:57 2016 UTC
  Communication Deadline: Mar 16 03:00:34 2016 UTC

Evaluation Period:
  Evaluation Mode: Not In Use
  Evaluation Period Remaining: 89 days, 23 hours, 20 minutes, 20 seconds

Step 4. Enter this command in order to display the license usage information.

Device#show license usage

Sample output:

Device#show license usage
License Authorization:
  Status: AUTHORIZED on Feb 01 05:08:29 2016 UTC

Device METRO IP ACCESS (metroipaccess):
  Description: Device METRO IP ACCESS
  Count: 1
  Version: 1.0
  Status: AUTHORIZED

Device 1588 (1588):
  Description: Device 1588
  Count: 1
  Version: 1.0
  Status: AUTHORIZED

Device ATM (atm):
  Description: Device ATM
  Count: 1
  Version: 1.0
  Status: AUTHORIZED

Device UPOE (upoe):
  Description: Device UPOE
  Count: 1
  Version: 1.0
  Status: AUTHORIZED

Device GNSS (gnss):
  Description: Device GNSS
  Count: 1
  Version: 1.0
  Status: AUTHORIZED

Device 6-1GE PORT LICENSE (1GEupgradelicense):
  Description: Device 6-1GE PORT LICENSE
  Count: 2
  Version: 1.0
  Status: AUTHORIZED

Device 2-10G PORT LICENSE (10GEupgradelicense):
  Description: Device 2-10G PORT LICENSE
  Count: 2
  Version: 1.0
  Status: AUTHORIZED

Step 5: Enter this command in order to display the summary of active licenses.

Device#show license summary

Sample output:

Device#show license summary

Smart Licensing is ENABLED

Registration:
  Status: REGISTERED
  Smart Account: BU Production Test
  Virtual Account: Device
  Export-Controlled Functionality: Allowed
  Last Renewal Attempt: None
  Next Renewal Attempt: Jun 14 02:31:11 2016 UTC

License Authorization:
  Status: AUTHORIZED
  Last Communication Attempt: FAILED
  Next Communication Attempt: Feb 02 04:09:57 2016 UTC

License Usage:
  License                 Entitlement tag               Count Status
  -----------------------------------------------------------------------------
  Device METRO IP ACCESS (metroipaccess)                   1 AUTHORIZED
  Device 1588             (1588)                           1 AUTHORIZED
  Device ATM             (atm)                             1 AUTHORIZED
  Device UPOE             (upoe)                           1 AUTHORIZED
  Device GNSS             (gnss)                           1 AUTHORIZED
  Device 6-1GE PORT L... (1GEupgradelicense)               2 AUTHORIZED
  Device 2-10G PORT L... (10GEupgradelicense)              2 AUTHORIZED

Note: Restrictions for Smart Licensing - In Cisco IOS XE Release 17.3.1 and later, bulk port license is not requested explicitly from the Smart Licensing server by Cisco IOS XE software. Instead, equivalent Port Upgrade Licenses are consumed.

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

Receive Email Notification For New Field Notices

My Notifications—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.

Was this Document Helpful?

Feedback

Contact Cisco

Open a Support Case
(Requires a Cisco Service Contract)

This Document Applies to These Products

Network Convergence System 520