Home › Cisco Smart Software Manager satellite FAQ

Cisco Smart Software Manager satellite FAQ

File info: application/pdf · 22 pages · 594.56KB

Cisco Smart Software Manager On-Prem

For Zone 0, you can use the Manual Registration/Synchronization to avoid the ... at: https://anypoint.mulesoft.com/apiplatform/apx/#/portals/ ...

300000 product · 2020-05-17 — A. Cisco Smart Software Manager On-Prem license server is a component of Cisco Smart. Licensing. It works in conjunction with Cisco Smart ...

Full PDF Document

If the inline viewer fails, it will open the original document in compatibility mode automatically. You can also open the file directly.

Extracted Text

Frequently Asked Questions
Cisco Smart Software Manager On-Prem
(updated May 2020)

Table of contents
Cisco Smart License Overview....................................................................................................... 3 SSM On-Prem Overview ................................................................................................................ 4 SSM On-Prem � Deployment ......................................................................................................... 5
SSM On-Prem � System Requirements ...................................................................................... 5 SSM On-Prem � Scale ................................................................................................................ 6 SSM On-Prem � Communications.............................................................................................. 7 SSM On-Prem � Certificates ...................................................................................................... 7 SSM On-Prem Management � On-Prem Shell ............................................................................... 9 SSM On-Prem �High Availability.............................................................................................. 9 SSM On-Prem � Backup and Restore......................................................................................... 9 SSM On-Prem � Software Upgrade/Patching........................................................................... 10 SSM On-Prem Admin Workspace................................................................................................ 11 SSM On-Prem � Settings .......................................................................................................... 11 SSM On-Prem � Accounts........................................................................................................ 11
SSM On-Prem � Registration ............................................................................................... 11 SSM On-Prem � Accounts Synchronization......................................................................... 12 SSM On-Prem Admin� API Tool Kit Widget .......................................................................... 13 SSM On-Prem Admin� Networking......................................................................................... 14 SSM On-Prem � Proxy Support............................................................................................ 14 SSM On-Prem � Support Center Widget.............................................................................. 14 SSM On-Prem � Security Widget......................................................................................... 14 SSM On-Prem Admin � User Management ............................................................................. 14 SSM On-Prem � User Widget............................................................................................... 14 SSM On-Prem � User Authorization .................................................................................... 15 SSM On-Prem � Access Management Widget ..................................................................... 15 SSM On-Prem License Workspace .............................................................................................. 16 SSM On-Prem Synchronization................................................................................................ 16 SSM On-Prem Operation � License and Product Management ............................................... 17

Cisco Public

May 2020

Frequently Asked Questions
Cisco Smart Enabled Products...................................................................................................... 17 Cisco Smart Enabled Products - Communications ................................................................... 18 Cisco Smart Enabled Products - Data Privacy.......................................................................... 20 Cisco Smart Enabled Products - Registration ........................................................................... 20 Cisco Smart Enabled Products - Compliance ........................................................................... 21 Cisco Smart Enabled Products - Upgrades ............................................................................... 21

Cisco Public

May 2020

Frequently Asked Questions

Cisco Smart License Overview

What is a Cisco Smart Account?

Smart Accounts are customer-managed data repositories that provide full visibility and

access control to Cisco software licenses, entitlements and product instances across the

company. Smart Accounts simplify the storage, management, and movement of Cisco

software licenses and entitlements.

What is a Cisco Virtual Account?

Assets within a Smart Account can be grouped into sub-accounts call Virtual Accounts

which represent a collection of licenses and product instances. You can create Virtual

Accounts in Smart Software Manager to organize licenses into logical entities.

How do I setup my Smart Account?

To create a Cisco Smart Account.

� Go to Cisco Software Central at https://software.cisco.com.

� Select "Request a Smart Account."

� Enter your information.

Where can I find more information on Smart License?

Additional information about Cisco Smart License can be found by visiting the Cisco Smart

Licensing and Smart Accounts webpage.

Is there any information more specific Smart Licensing and Smart Accounts for

Partners, Distributors?

Additional information about Cisco Smart License/Smart Accounts for Partners,

Distributors can be find can be found by visiting the Smart Licensing and Smart Accounts

FAQ for Partners, Distributors and Customers webpage.

Cisco Public

May 2020

Frequently Asked Questions

SSM On-Prem Overview

What is Cisco� Smart Software Manager On-Prem license server?

Cisco Smart Software Manager On-Prem license server is a component of Cisco Smart

Licensing. It works in conjunction with Cisco Smart Software Manager to intelligently

manage customer product licenses, providing near-real-time visibility and reporting of

Cisco licenses that customers purchase and consume. For security-sensitive customers

who do not want to manage their installed base with Smart Software Manager residing

on Cisco.com, they can choose to install the Smart Software Manager On-Prem license

server on premises. Devices or software products self-register and report license

consumption to the Smart Software Manager On-Prem license server as though it were a

replicate of the Smart Software Manager, but with tighter security, because the database

is on the customer network. The On-Prem license server version of Smart Licensing

contains a subset of Smart Software Manager functionality and must communicate with

the latter periodically to operate.

How is the Smart Software Manager On-Prem license server different from the CSSM

satellite?

CSSM satellite was designed for small lab environments, and as a result is lacking many of

the features needed by Enterprise and Service Provider Customers. Additional key

security features needed by government entities are also missing. The Smart Software

Manager On-Prem license server IS NOT a simple re-branding of CSSM satellite but is a

new completely re-architected product designed from ground up to specifically addresses

these markets. meet these needs.

Do I need the On-Prem license server in addition to Smart Software Manager?

If your devices and products communicate directly with Smart Software Manager on

Cisco.com, you do not need the On-Prem license server software.

What do I do if my Cisco Products either can't, or are prevented by policy, to

communicate with Cisco Smart Software Manager?

For customers who have strict security requirements and do not want their products to

communicate with the central licensing database (on Smart Software Manager) over a

direct Internet connection, Smart Software Manager On-Prem license server provides a

highly secure, local, single source of truth of license consumption. The On-Prem license

server can be connected to Smart Software Manager and can have on-demand or

scheduled synchronizations, or it can be completely disconnected from Smart Software

Manager and periodically align its database with a file upload and download for a

complete view of license entitlement and usage.

What does Smart Software Manager On-Prem license server cost?

The software is available free of charge and can be downloaded from the Cisco Download

Software webpage.

Cisco Public

May 2020

Frequently Asked Questions

How do I get support for the Smart Software Manager On-Prem license server?

Yes, SSM On-Prem is supported though the Cisco TAC team and the Global License Office

(GLO).

Where can I download Smart Software Manager On-Prem license server?

The Smart Software Manager On-Prem license server is available at no charge to

customers and can be downloaded from the Cisco Download Software webpage.

SSM On-Prem � Deployment

Can a single Smart Account have more than one independent SSM On-Prem license

server?

Yes, a Single Smart Account can have an SSM On-Prem register with multiple Local

Accounts � each Local Account would be associated with a unique Virtual Account within

the Smart Account

Can a single SSM On-Prem license server have more than one Smart Account lined to it?

Yes, an SSM On-Prem license server can be linked to any number of independent Smart

Account � each Local Account would be associated with a unique Virtual Account within

each Smart Account

We are using the "Purdue Reference Model for Process Control" deployment model.

Can SSM On-Prem license server support this?

Yes, you can deploy multiple SSM On-Prem license servers, each within the different

zones. For Zone 0, you can use the Manual Registration/Synchronization to avoid the

need for electronic communications with Cisco SSM Cloud.

SSM On-Prem � System Requirements

Can I deploy SSM On-Prem be deployed on physical servers?

Yes, the ISO can be burned to a CD or ISO and booted using MBR.

Do you offer hardware server (UCS) which can be orderable from CCW?

No, this is not an offered option.

Can I deploy SSM On-Prem be deployed on using virtual servers?

Yes, you can use software virtualization package such as VMware, VirtualBox, etc

Can I deploy SSM On-Prem using cloud platform like services?

Cisco Public

May 2020

Frequently Asked Questions

We have tested SSM On-Prem with Amazon AWS so there should be no issues, We have

not tested with Microsoft Azure, but expect it should work.

What is the difference the Standard and STIG security profile during installation?

Mostly these are the same, with the notable exception that STIG will limit the SHELL to

the On-Prem Secure Console, and if your using hardware based deployments, the USB

ports will be limited post installation.

If STIG security profile limits SHELL to the On-Prem console, does this limit trouble

shooting, etc. when there are problems?

While it might limit some user bases troubleshooting, it does not prevent Cisco from

being able to support the On-Prem license Server.

Let's bottom line this � should I use STIG security profile?

Yes, and if you're a Government, Military, or Banking organization, your likely going to

have security policies that require it.

Do most customers deployment use hardware or virtual?

While we support both methods, most customer deploy using thieir virtual orchestration

environment.

SSM On-Prem � Scale

What are the current scales limits on the SSM On-Prem license server?

This is one of those `it depends' answers. For the answer, lets define a `product' as:

One Cisco product using any quantity of a single license type.

As of Version 8-202004, the SSM On-Prem license server can support 300,000 `products'

and a maximum of 25000 `products' in any one single Local Account (Cisco Virtual

Account).

Multiple Local Accounts can be registered with your Cisco Smart Account to achieve the

300,000 product total.

Can you give me example of what you mean by `products'?

Sure, here are a couple examples;

Product CSR1Kv Wireless Lan Controller N9K

License Platform throughput 10,000 AP licenses Advantage, NDB, and Security

Types 1 1 3

# `products' 1 1 3

We are expecting the size of our network to grow over time. Should we just follow the

guidelines for resources . Will this meet our scale needs in the future?

Cisco Public

May 2020

Frequently Asked Questions

Recommended settings (4vCPU, 200G Disk, 8Gig Ram) are good to 100,000 total

products, with 25000 products per Local Account. Adding more memory and compute

(vCPU) can be added later if you see observe performance related issues.

Small

Medium

Large

Maximum

Products

4000

50,000

100,000

300,000

Hard Disk 200 Gig

200 Gig

Memory

8 Gigabyte 8 Gigabyte 16 Gigabyte 16 Gigabyte

vCPU

2 vCPU

4 vCPU

6 vCPU

8 vCPU

SSM On-Prem � Communications

What Ports does SSM On-Prem license server use?

SSM On-Prem uses the following ports

Port

Protocol

Uses

8443

HTTPS

User Browser Access

HTTP

Products communication based on `destination url' configured

443

HTTPS

on product.

5432

SSL

High Availability between primary and standby service nodes.

I need to add firewall rules to allow the SSM On-Prem license server to pass traffic to

Cisco. What URLs are used?

SSM On-Prem uses two base URLS to communicate with cisco:

URL

IPv4

IPv6

Uses

https://cloudsso.cisco.com Regional Regional

Creating a Local Account

https://swapi.cisco.com

146.112.5 2a04:e4c7:fffe::4 Registration and

9.25

Synchronization

SSM On-Prem � Certificates

Is there any pre-installed list of CA on SSM on-prem, like Entrust, GoDaddy, etc ?

Yes, On-Prem license server has the ca-bundle provided as part of CentOS.

Cisco Public

May 2020

Frequently Asked Questions

For proxy authentication, what protocol On-Prem supports other than basic, how about

NTLM / Negotiate?

Only basic, NTLMv2 is on the backlog to track customer request, but not planed.

What is the content of the certificates enrolled by On-Prem license server?

All Certificates needed by the On-Prem license server are obtained during the initial

registration process and updated on subsequent synchronization.

How long are the certificates valid?

Cisco creates the certificates with a lifetime of 365 days, and on each synchronization,

the lifetime of the certificate is reset (extended) to 365 days.

What happens with the enrolled certificates of network devices when the On-Prem

license server needs yearly renewal?

The IDCERT is automatically updated when the product renews its registration with On-

Prem license server.

What happens if a network device is not accessible at the moment of certificate

refresh?

the product next checks in, it will receive the updated IDCERT certificate. Three is no

impact unless the product exceeds the lifetime of the IDCERT, in which the product will

return to the "unregistered" state, and will have to be re-registered..

Are the certificates revoked at replacement?

No.

Does the server provide revocation list (CRL or OCSP) for the enrolled certificates?

No.

Does the server (CA) revoke a certificate when the network device is decommissioned?

The IDCERT used by the product is only valid for that product and the specific On-Prem

license server that created it. If the product is un-registered, both the product and the

On-Prem license server will remove the IDCERT from its trust store, there by rendering it

useless.

Do I need to add the certificate used by the Cisco Smart Licensing?

Cisco Products that support smartlicensing already have this Cert installed.

Where can I download the Cisco Smart Licensing Root CA?

http://www.cisco.com/security/pki/certs/clrca.cer

Cisco Public

May 2020

Frequently Asked Questions

SSM On-Prem Management � On-Prem Shell

What is the SSM On-Prem Secure Shell?

A number of key functions related to managing the On-Prem license servers is handled

vis the host OS. Specific features include Backup/Restore, Upgrade, HA, etc.

Is there any way to have the SSM On-Prem Secure Shell use external auth like LDAP or

TACACS?

No, only one user is supported from the host OS shell (admin)..

Is there a way to delete/disable/change the host OH shell username, or add more

users?

No, the On-Prem license server is not a general purpose server. Major functionality

depends on shell access and is tied to the `admin' username. Modifying this user will

result in the server failing to function properly.

SSM On-Prem �High Availability

Does SSM On-Prem license server support High Availability?

Yes, High Availability is supported thought a 2 node Active/Standby configuration.

What do most customers do in terms of resiliency Primary/standby? Active/active?

SSM On-Prem only offers Active/Standby High Availability. Both service nodes must be

on the same subnet as the virtual IP.

How many IPs do I need to stand up SSM ON-Prem HA?

You need 3, one IP for each service node and one IP for the Virtual IP (VIP).

Of the three IPs, which one(s) do I use?

You should only use the VIP for both the User interface and for product registration. In

fact, the services on the Standby node are held in a down state, with only SSH available.

Is Disaster Recovery(DR) � that is, a second duplicate On-Prem license servers deployed

into a separate datacenter supported?

No, but if you use FQDN for your device destination URL, in the event of a site loss, you

can deploy a new On-Prem license sever in a second site, restore using a backup file, then

update your DNS server to point to the new server,

SSM On-Prem � Backup and Restore

What is typically done for backing up the Cisco SSM??

Cisco Public

May 2020

Frequently Asked Questions

Backup is available. (See the On-Prem Shell documentation). This is not automatic and

does require it to be done manually though the shell commands. VM snapshotting is also

supported.

How do most customers backup the SSM On-Prem license server?

It varies. Many organizations that work with VMs have an in place snapshot process, and

use their existing snap-shot procedures. Most customers use the On-Prem Shell to back

up the On-Prem license server.

How do I backup the SSM On-Prem license server?

The backup process is performed via SSH login and using the SSM On-Prem Secure Shell.

SSM On-Prem � Software Upgrade/Patching

How is software patching handled with the SSM On-Prem license server?

Upgrade patches are providing anytime a new build is posted on the Cisco Software

download page. The upgrade process is performed via SSH login and using the SSM On-

Prem Secure Shell.

If the SSM On-Prem license server falls far enough behind, does it stop working?

Any version of the On-Prem can be patched to the latest available version. Each quarter

we release security, bug fixes, and new feature. While we encourage you to stay up to

date, there is no restriction on how long you run on a given version.

How Often is a new version of the SSM On-Prem released?

We release a new build each quarter. The new build will contain security fixes, bug fixes,

and optionally new features.

I have found a Common Vulnerability and Exposures (CVE) I am concerned about; can I

get a patch for it?

Critical and High CVE are addressed in each quarterly build.

I don't want to wait for the next build, I have bash access and can download the RPM

from the internet. Can I patch it myself?

No, this is not supported. The SSM On-Prem application has some hard dependencies on

specific versions of RMS. Updating can result in the server being rendered non-

operational. Additionally, self-patching or modify the SSM On-Prem server will void the

supportability of the software. In short, because you can does not mean you should..

Cisco Public

May 2020

Frequently Asked Questions

SSM On-Prem Admin Workspace

SSM On-Prem � Settings
No questions

SSM On-Prem � Accounts

Taking into account the size of our network and the variety of products used, what is

the best approach for setting up accounts?

Generally speaking, the number of Local Accounts you create (each linked to a unique

virtual account at cisco) will be set based on

� Number of devices � max per local account is 25,000

� Number of independent network teams requiring unique access rights.

The fewer accounts the better? Accounts per "domain" like Access, Voice, Backbone,

Data Center, etc.? What is best for back end reporting, importing, general admin

tasks?

Unless you have a small network management team, or your teams specialize around

technologies by type might not work. Instead I recommend you consider how many

independent teams that need different levels of access. Then create Local Accounts

based on their need.

SSM On-Prem � Registration

How I can Register the Smart Software Manager On-Prem license server?

This registration is different from the product instances that need to register with the On-

Prem license server to report license consumption.

What happens during registration?

The registration between the On-Prem license server and Smart Software Manager is

performed using encrypted Hyper Text Transfer Protocol (HTTPS). The process is

triggered by the On-Prem server sending a Registration Request to Cisco Smart Software

Manager cloud license server, Cisco validates the Request and responds with a

Registration Response file contains license data and =needed cryptographic keys used for

future communication.

What is a Local Account and how is it different from my Cisco Smart Account?

When you register, you create a link from SSM On-Prem to Cisco Smart Software

Manager Virtual Account. License you deposit will show up in in the SSM On-Prem in

what is referred to as a "Local Account". As you can register to multiple Cisco Virtual

Account, and Virtual Account is linked to a unique Local Account.

Cisco Public

May 2020

Frequently Asked Questions

So, my Local Account is my Cisco Virtual Account?

As it relates to license and product usage, it can be thought of in that fashion. But keep

in mind the Local Account has some extra features, such as the ability to create one more

layer of subaccounts (called Local Virtual Accounts).

What is a Local Virtual Account?

Within a Local Account, SSM On-Prem offers another layer in the account Hierarchy. At

Cisco, you have a Smart Account where you can create multiple Virtual Accounts to group

products and license. When a Virtual Account is linked to On-Prem, you can create more

layer of sub-accounts. That is SA -> (VA === LA) -> LVA.

Can I seen and manage the Local Virtual Accents in my Cisco Smart Account?

No, for privacy reasons, the Local Virtual Account information is not shared with Cisco,

instead all of the license and product usage is aggregated and sent as totals. This allows

for government and other security concerns a way to deploy equipment without sharing

the associations with Cisco.

How long do you have to wait for the On-Prem license server registration to Smart

Software Manager to complete?

Previously, it took 48 hours to complete the On-Prem license server registration to Smart

Software Manager because the Cisco certificate had to be manually signed. With the

latest On-Prem license server release, we have removed this restriction, and the

registration now completes within a few seconds of the submission. However, this

support is only for 4-tier (upgraded Smart Agents) products; 3-tier products still have to

wait 48-hours after the On-Prem license server registration to CSSM in order to register

with On-Prem license server.

We have an isolated test lab that where we need to kick the tires of the SSM On-Prem

license server. What's the best way, given that the lab (by design) cannot reach the

Internet?

SSM On-Prem supports a Manual registration and synchronization method which does

not require the On-Prem server to have network connection to cisco. Its handled by a file

transfer method.

SSM On-Prem � Accounts Synchronization

Synchronization is not working because of an SSL intercept issue. Can we add our own

certificates to the Cisco SSM trusted certificate store?

This is on the roadmap.

What is the difference between Standard and Full synchronization?

A full synchronization is used when Cisco detects a clock shift, or in the event the

Cisco Public

May 2020

Frequently Asked Questions

customer sees different license and usage on the On-prem server and Cisco. Full synchronization will result in a a complete list of products, license, and use data being exchanged.

What's the advantage of restoring from backup (as opposed to just fresh rebuild

from .iso then full synchronization?

A backup contains knowledge of a products certificates used to validate the product. If

you deploy a new instance of On-Prem, this information would be lost, requiring you to

re-register all products associated with the On-Prem license server.

When I registered the SSM On-Prem to the Cisco Virtual Account, I used a different

name for the SSM On-Prem Local Account name, and I would like to change it to match.

If I rename the Cisco Virtual Account name to match the SSM On-Prem Local Account,

will it synchronize?

SSM On-Prem accounts are linked to the Cisco Virtual Account though its internal id

number � not its name. So changing the Cisco Virtual Account name will not impact the

synchronization..

SSM On-Prem Admin� API Tool Kit Widget

Are there API available for use with SSM On-Prem?

Yes, the latest list of APIs and documentation is covered in the SSM On-Prem User guide.

Does Cisco have similar APIs for working with CSSM?

Yes, the latest list of APIs and documentation for Cisco cloud license server can be found

at: https://anypoint.mulesoft.com/apiplatform/apx/#/portals/organizations/1c92147b-

332d-4f44-8c0e-ad3997b5e06d/apis/5418104/versions/.

How other customers are using APIs to streamline things and making things more

efficient?

SSM On-Prem APIs are generally being used by customers to facilitate orchestration of

products.

Can I use the SSM On-Prem APIs to monitor the system? For example, it is common for

an enterprise to have a capability to regularly poll a web GUI, which the SSM On-Prem

has, to check it's still responding and if it fails a few times in a row to send an email to

OPS team.

At this time, there are no APIs for checking the full health of the system. For basic

availability, an option might be to enable the API Toolkit and periodically call the "get

token" api and ensuring it returns a token. For verification of system usage however,

your only option is to log into the Admin Workspace and manually check.

Cisco Public

May 2020

Frequently Asked Questions

SSM On-Prem Admin� Networking

SSM On-Prem � Proxy Support

When configuring the proxy, can we confirm we don't need to enter HTTP or HTTPS,

and just the FQDN and the port ?

Yes, you need to specify http or https to signal the designed connection type.

What type of connection to the proxy does SSM-On-Prem does ? HTTP GET or HTTP

CONNECT?

HTTP CONNECT is for HTTP and HTTPS.

Does On-Prem validate the certificate of the proxy server it is connecting to?

Yes, certificate must indicate that the proxy server is the server to which you meant to

connect, or the connection fails. Simply put, it means it has to have the same name in the

certificate as is in the URL.

SSM On-Prem � Support Center Widget
No questions

SSM On-Prem � Security Widget
No questions

SSM On-Prem Admin � User Management

SSM On-Prem � User Widget

How are users authenticated with the SSM On-Prem license server?

There are two authentication methods available for use on On-Prem; Local and optionally

a federated identity service. The Local authentication is always available and takes

president of any other Authentication system configured.

That federated identity services are supported by SSM On-Prem license server?

LDAP, Active Directory, and Active Directory f=Federated Service

Can LDAP Groups be used?

Yes, LDAP Groups are available. At this time, only the first 1000 groups can be used.

Are the user accounts on the SSM On-Prem license server the same as users' CCO

accounts or are they tied to the CCO ids in some fashion?

No, the users on the SSM On-Prem license server is not linked to your CCO.

Cisco Public

May 2020

Frequently Asked Questions

Will users be synced between CSSM On-Prem and CSSM Cloud?

No, for privacy and GDPR reasons, user information is NOT sent to Cisco.

Will my account admin be different when logged into CSSM Cloud versus the local

CSSM On-Prem with LDAP integration?

Any user logging into the On-Prem license server will see a subset of the information in

your Smart Account � specifically the license and products shared between the On-Prem

licenser server and the Cisco Virtual Account(s) its linked to. There is no requirement for

System Users to have a CCOid, or access to you Smart Account. Only the System Admin

or System Operator that performs Local Account registration and/or synchronization

needs a CCOid with Access to the Smart Account.

SSM On-Prem � User Authorization

What Roles are available for license and product management on the SSM On-Prem

license Server?

There are four license roles for the SSM On-Prem license server; Smart Account

administrator, Smart Account user, Virtual Account administrator, Virtual Account user).

These Roles can be set on a per System User to control which Local Accounts and/or

Local Virtual Accounts they will have access to.

What Roles are available for management of the SSM On-Prem license Server?

Users must be assigned a Role before they can access the On-Prem license server. The

Role Based Access Control(RBAC) they are assigned determines what permissions they

have for admiration and/or use of the license.

How is User Authorization handled? Is that performed by CSSM? Based on the user

access roles???

SSM On-Prem license server has 2 privileged roles � the System Administrator and the

System Operator.

� System Administrator - Full access to the server and all configurations � System Operator - Full access to the server, but no ability to change server
configuration

SSM On-Prem � Access Management Widget

How do we use multiple LDAP groups? For example, what if I want an LDAP group for

Admins and another LDAP group for regular users?

License Roles (Local Account Admin/User, Local Virtual Account Admin/User) are

supported, and can be assigned independently to different LDAP groups.

Cisco Public

May 2020

Frequently Asked Questions

What about the Privileged roles (System Admin/Operator)?

Privileged roles (System Admin/Operator) are not currently supported.

How do I get LDAP users to automatically map into roles??

Automatic mapping is not supported.

Do LDAP groups map to Cisco Virtual Accounts, or to roles on managing the Cisco SSM

server itself or both, and how you distinguish between them. How do I get LDAP users

to automatically map into roles??

User Roles at Cisco are not linked or exchanged with your On-Prem license server. These

are managed independently.

SSM On-Prem License Workspace

After deploying the software, is the SSM On-Prem server ready to be used?

Not just yet. After installing the On-Prem license server software, which is downloadable

from Cisco.com, you need to configure and register it with the Smart Software Manager

to enable secure communication for future synchronization of the licensing information.

This is accomplished by logging into the Admin Workspace, and creating an account using

the Account Widget.

SSM On-Prem Synchronization

How does the On-Prem license server stay synchronized with Smart Software Manager?

The On-Prem license server contains the latest license consumption, as reported by the

products or platforms. The Smart Software Manager database has the latest license

entitlement because customers make Cisco product purchases from Cisco Commerce,

and this information is populated in Smart Software Manager. To get the latest license

consumption and entitlement information, the On-Prem license server is recommended

to be synchronized with Smart Software Manager at least every 30 days.

What happens if the On-Prem license server Local account does not synchronize with

Smart Software Manager?

Any Smart Software Manager On-Prem license server Local account that has not

synchronized with Smart Software Manager for more than 31 days receives an overdue

alert (on day 32 to 364). The On-Prem license server continues to function (accepting

product registrations, responding to authorization renewals, synchronizing with Cisco).

After 365 days of non-synchronization, its signing certificate is expired and is removed

from Cisco Smart Software Manager. The only way for the On-Prem license server

account to recover is to remove it both from CSSM and On-Prem license server

Administration portal, re-register a new account to Smart Software Manager, and re-

Cisco Public

May 2020

Frequently Asked Questions

SSM On-Prem Operation � License and Product Management

How can customers see license usage is when they deploy the SSM On-Prem license

server?

While the cloud-based Smart Software Manager and the customer's Cisco Smart Account

remain the global source of truth for the overall licensing state, customers can view local

information through the Smart Software Manager On-Prem license server directly. It

might not have the latest entitlement information from Smart Software Manager,

depending on the latest synchronization schedule. But it uses the same user interface as

Smart Software Manager, and the customer can use it to understand local software

usage and local license compliance.

How can customers know in real time what license usage is when they deploy the SSM

On-Prem license server?

While the cloud-based Smart Software Manager and the customer's Cisco Smart Account

remain the global source of truth for the overall licensing state, customers can view local

information through the Smart Software Manager On-Prem license server directly. It

might not have the latest entitlement information from Smart Software Manager,

depending on the latest synchronization schedule. But it uses the same user interface as

Smart Software Manager, and the customer can use it to understand local software

usage and local license compliance.

Cisco Smart Enabled Products

What is the Traditional vs Hybrid vs Smart Products?

Traditional products do not support Smart License experience and will continue to use its

existing license method (RTU, PAK, etc). The Hybrid can be enabled to use Smart License

though a configuration command.

How do I know if my Cisco Product is Smart License enabled?

Check with your Cisco partner, Cisco Account team, look for your Cisco Product details at

Smart Enabled Product Families webpage.

I have Hybrid product and I want to use Smart License; do I have to buy a new license??

No, you can use the Device Lead Conversion process to convert the traditional license.

Where can I find more information on the Device Lead Conversion?

Check your product documentation � as an example:

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/smart-

Cisco Public

May 2020

Frequently Asked Questions

licensing/qsg/b_Smart_Licensing_QuickStart/b_Smart_Licensing_QuickStart_chapter_01 1.html.

Cisco Smart Enabled Products - Communications

How do Cisco Products report license usage to cisco?

Cisco Products send usage information using HTTPS using either the Smart Call Home

server, or the Smart Transport server. Smart Transport will be the future, but Smart Call

Home offers some features not currently present in Smart Transport, and Smart

Transport is not yet available on all products.

What information is exchanged when I register a Cisco product with Cisco or the Cisco

On-Prem license server?

When a token is entered at the exec command on the device, the device will send the

token sting to the On-Prem license server. The server will search to the existence of the

token, and if found, validate the token is not expired, revoked, or deleted. If the token

exists, and is valid, then the server will create an IDCERT (X509 cert) and send the the

device. the device will validate the IDCERT is signed by an authorized Cisco license server

and, if so, use the IDCERT for communications with the On-Prem license server.

What is the difference between Smart Call Home and Call Home??

The difference between Smart Call Home and Call Home can be confusing. We refer to

the entire solution generally as Smart Call Home, where the feature in the product is

called Call Home, and the backend servers are referred to as Smart Call Home.

Is there any difference between how Cisco Products communicate with the On-Prem

license server compared to Smart Software Manager?

Products register and report license consumption exactly the same way, regardless of

whether they are communicating with the On-Prem license server for Smart Software

Manager. The only change needed for product configurations is to configure the target IP

address to the On-Prem license server instead of Smart Software Manager.

What is Smart Transport?

Cisco Smart Transport is a new method for sending product license usage to cisco. Smart

Transport was introduced as some customers (military) havie a policy against Smart Call

Home, to the point they will not allow the configs to be present. This meant we had to

have a new method to get Smart License messages to Cisco that did not use the Smart

Call Home config, or the Smart Call Home transport.

Cisco Public

May 2020

Frequently Asked Questions

What is the difference between Smart Call Home and Smart Transport?

The primary difference is in the transport encoding and API gate way in use;

API Gateway

Access Points Protocol

Smart Call Home tools.cisoc.ocm

Reginal

HTTP/HTTPS (soap)

Smart Transport

smartreceiver.cisco.co USA m

HTTPS (json)

Additionally, there are a few Product specific features that vary;

Product

Data

VRF support

Support

Privacy

Smart Call

All (enabled by Yes

Yes

Home

default)

Smart

Some

Yes

Transport

Proxy support yes
yes

Do most customers use Smart Call Home or Smart Transport?

For most customers, staying with Smart Call Home is the choice due to the larger product

support, management vrf support, simplified firewall impact, and standardization of

configuration.

Do you have a list of products that support Smart Transport?

Not yet, this has been requested this from the Smart Agent team, and when available will

beaded to the Product Features page

(https://www.cisco.com/c/en/us/products/software/smart-accounts/smart-licensing-

feature-roadmap-comparison-table.html).

Can someone connect to my Cisco devices using Smart Call Home or Smart Transport?

No. All of the communication is one way and is always initiated from the device and sent

to the backend at Cisco.

Is the communication between the devices, or product, encrypted?

Yes, Products can use either HTTP or HTTPS to send license usage to cisco. Whether HTTP

(clear text) or HTTPS (encrypted) is used, is based on the `designation url' configured.

Cisco Public

May 2020

Frequently Asked Questions

Cisco Smart Enabled Products - Data Privacy

Can I control what information is sent to Cisco (example hostname)?

Cisco does not need this information for licensing, it's there for to assist you managing

your product license usage. Most products offer a data-privacy configuration that scrubs

data, such as IP addresses, from the license usage to protect the privacy of customers.

I prefer to see the device host name and not the serial number, but my corporate

polices does not allow it to be sent to Cisco. What are my options?

The easiest would be to use SSM On-Prem, allow the products to send the hostname, IP,

etc, but configure the On-Prem server to not relay it to Cisco. In this way, you get the

best of both worlds.

Cisco Smart Enabled Products - Registration

Do I need to register my Cisco Product before I use it?

Yes. The Cisco Product must be register with the before it can report license

consumption. This registration identifies the Smart Account and Virtual Account though

the user of a `Token' that this product instance belongs in and establishes a highly secure

HTTPS communication channel between them.

Do I need a unique Token for each Cisco Product I register?

No. A Token is unique to the Virtual Account where its created. Tokens are not Product,

or Product Family specific. One token can be used as many times as you desired, and on

as many different products as desired. .

What happens if the Token expires or revoked?

The token is not stored on the Cisco Product, instead its used at the "exec level" and is

transmitted as part of the registration process. Once the registration is complete, the

token is not used by the product .

Are there Cisco devices that do not have to be registered separately? For example, does

each wireless access point have a separate license or just the WLCs?

Products such as Access points do not register to Cisco or On-Prem directly, instead the

controller, in this case WLC, registers and then reports the count of licensee (access

points) in use.

What is the difference between registering with Cisco's Cloud license server an the On-

Prem license server?

Cisco product come pre-configured to report directly to Cisco. If your using the On-Prem

license server, then you need to change the `destination url'. As example CSR config

would be;

Cisco Public

May 2020

Frequently Asked Questions

conf t call-home profile CiscoTAC-1
no destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address http https://<ip>:443/Transportgateway/services/DeviceRequestHandler

In production setting do most customers configure PI with SSM On-Prem IP addr or

FQDN?

Most of the configs I have seen use PI addresses, however for dual stack (ipv4/IPv6) and

for disaster planning, Customers have to use FQDN.

Any other product configuration needed to register the product with SSM On-Prem?

Yes, you also need to disable revocation-check for the SLA-TrustPoint. As example CSR

config would be;

conf t crypto pki trustpoint SLA-TrustPoint enrollment terminal revocation-check none

Cisco Smart Enabled Products - Compliance

What happens if my product not registered or out of compliance

Smart License does not recommend enforcement of any kind, instead just report in or

out of compliance based on the availability of license. What the product does at the

point its notified of a lack of license is product specific and has to be answered by the

Product Manager. You may also want to review your specific Cisco Product details at

Smart Enabled Product Families webpage.

Cisco Smart Enabled Products - Upgrades

I have devices that currently are using Traditional (PAK, RTU, etc) licenses. How are

these licenses transitioned to Smart Accounts?

When you upgrade the product to Smart Licensing capable version, you will be able to

convert your Tradition license to a Smart License. You fist need to register the product;

you need to use the "Device Lead Conversion" process � on IOS its "license smart

conversion start". This will result in a "like for like" license being deposited in the Virtual

Account

Once I have converted the RTU licenses to a Smart License, is the RTP destroyed, Is

there a way to go back?

Cisco Public

May 2020

Frequently Asked Questions

If you downgrade the software on your Product to a version that does not support Smart

License, the product will use the Traditional License which was previously in use. The

product will retain knowledge of the Conversion, such that at a later date if you upgrade

to a Smart Only version, your product will not need to go through the DLC process again.

Cisco Public

May 2020