Cisco Smart License Conversion Trick

It’s been a while since Cisco has announced Smart License to replace Traditional PAK-based licensing. Overall, this new system brings loads of benefits, such as ability to track license utilization, see all managed instances by hostname, transfer licenses and product instances between virtual accounts (i.e. sub-domains) and many other features. However, it also brings some challenges and surprises that everyone must be aware of.

First of all, keep in mind that eventually everything will be Smart License managed. Cisco made this licensing mandatory for Catalyst switching platforms starting from Fuji 16.9.1, as per below

Starting from Cisco IOS XE Fuji 16.9.1 the Right-To-Use (RTU) licensing mode is deprecated, and the associated license right-to-use command is no longer available on the CLI.

Release Notes for Cisco Catalyst 3850 Series Switches, Cisco IOS XE Fuji 16.9.x

When you upgrade, switches will silently activate EVALUATION mode, which will be valid for the next 90 days, but then, if you do not configure Smart Licensing you automatically go into non-compliance state. It won’t affect basic switch functions, but will definitely affect anything DNA-based (e.g. Assurance). So, keep this in mind and plan carefully.

I was confused initially as all our Catalyst 3850 switches have been purchased using Cisco One license, well before Smart License become mandatory. In fact, we haven’t even had any PAK codes, it was all RTU based. So, one might be guessing how to remain compliant?

Apparently, there’s a very handy command that performs the conversion of RTU license into Smart License. It is the following

license smart conversion start

Make sure you enable Smart License before you perform the conversion. I assume you’ve already setup Smart License Account, there will only show a minimum required config:

Switch(config)#call-home
Switch(cfg-call-home)#source-interface <source-interface>
Switch(cfg-call-home)#vrf <source-vrf>
Switch(cfg-call-home)#exit
Switch(config)#ip http client <source-interface>
Switch(config)#ip name-server <dns1> <dns2>
Switch(config)#ip domain lookup
Switch(config)#exit
Switch#license smart register idtoken <smart-license-token>

Keep in mind, <smart-license-token> will have to be generated via Smart License portal to make sure device is added to correct Virtual Account (VA). Once device is registered, execute RTU to Smart License conversion as shown above, then check your license again and it must be compliant:

Smart Licensing is ENABLED

Utility:
  Status: DISABLED

Data Privacy:
  Sending Hostname: yes
    Callhome hostname privacy: DISABLED
    Smart Licensing hostname privacy: DISABLED
  Version privacy: DISABLED

Transport:
  Type: Callhome

Registration:
  Status: REGISTERED
  Smart Account: <YOUR SMART ACCOUNT>
  Virtual Account: <VIRTUAL-ACCOUNT>
  Export-Controlled Functionality: ALLOWED
  Initial Registration: SUCCEEDED on Oct 28 23:12:38 2019 UTC
  Last Renewal Attempt: None
  Next Renewal Attempt: Apr 25 23:12:37 2020 UTC
  Registration Expires: Oct 27 23:06:33 2020 UTC

License Authorization:
  Status: AUTHORIZED on Oct 29 09:33:34 2019 UTC
  Last Communication Attempt: SUCCEEDED on Oct 29 09:33:34 2019 UTC
  Next Communication Attempt: Nov 28 09:33:33 2019 UTC
  Communication Deadline: Jan 27 09:28:32 2020 UTC

License Conversion:
  Automatic Conversion Enabled: False
  Status: Successful on Oct 29 09:33:31 2019 UTC

Export Authorization Key:
  Features Authorized:
    <none>

As you can see, license is AUTHORIZED (i.e. COMPLIANT state). Go check your Smart License portal and you will notice new licenses in a pool assigned to added devices.

RTU-based licenses converted into Smart License

C3850_48_Ipserv represent converted RTU licenses for Catalyst 3850 switches running IP Services RTU at the moment of conversion.

I hope this was helpful.

This entry was posted in News on by .

About Tim Dmitrenko

I am network engineer, experienced in designing, project delivery and operational support of Enterprise networks. I am a father of two, big fan of hiking, skiing, Belgium beer and warm weather (ironically I live in UK).

8 thoughts on “Cisco Smart License Conversion Trick

  1. Saeed Yo

    Hey Tim!
    Great tutorial, I did what you said, the switch is Registered but it stuck in Out of Compliance mode, I issued license smart conversion start command but nothing happend 🙁

    Reply
    1. Tim Dmitrenko Post author

      Hi Saeed! Have you checked that your switch has connectivity to the Internet, such as can resolve DNS, has route to Internet and there’s no proxy that performs SSL inspection in between? Proxies that do SSL decryption/encryption will break the flow as switch won’t trust this connection

      Reply
  2. Saeed Yo

    Hey Tim! Thanks for your reply.
    I have to say that i use Cisco Satellite solution for smart licensing procedure, all things run okay, the satellite appliance works well and its connectivity to the internet is fine and it can ping tools.cisco.com.
    As i issued conversion start command, satellite workspace console is showing “Conversion pending for UDI_PID_…”and do nothing more! it seems to be stuck here now! 🙄

    Reply
  3. Babak Khorshid

    Hi Saeed,

    If connectivity is ok then make sure you have enough license in your repository.
    check the Balance section , in use and purchased.
    If you have for example +1 in balance but your switch stack consist of 3 switches you’ll get the “Out of C… ” error.

    In case this is correct then follow this order:
    Smart register
    smart conversion
    smart de-register
    smart register force .

    hope that helps.

    Babak

    Reply
    1. Tim Dmitrenko Post author

      Thanks Babak. I have never worked with Smart License Satellite, but as far as I can remember it can be deployed in two modes. In its simplest form it can act as a Proxy – so it just proxies all requests to Smart License portal. In second mode it is assumed there’s no Internet connection between Satellite and Internet. In this case Smart License DB has to be synchronized manually. In this case I don’t think this conversion will work at all as it requires realtime connectivity to Smart License portal. However, I am not an expert in Satellite deployments and cannot provide trusted feedback 🙂

      Reply
  4. Karlsen

    Hi Tim,
    Thanks for posting this technical post. Was very helpful on understanding smart licensing.

    Just upgraded 3850 switches, where IP Services RTU was enabled to Fuji-16.9.5 and this caused the RTU licenses on chassis to be deprecated and fell into evaluation mode. Do you think downgrading the switch stack to the latest Everest release would bring back IP Services RTU license key? Unfortunately, we’re not ready to move forward to the smart licensing yet so..

    Reply
  5. Corey Taub

    We upgrades 4351 with cube licensing and did not realize the out of compliance till the 90 day expiration.
    We got temp licenses in smart licensing but I am told that there is no way to take get the licensing applied without a cost (Even though we had everything functioning) Our choice is go back to pre 16.9.1 re-add the PAK’s and stay there or start paying for smart licenses. Any input is appreciated if someone knows better.

    Reply
    1. Tim Dmitrenko Post author

      Hi Corey!

      I’ve just upgraded my lab Cisco ISR 4351 from 16.9 (traditional license only) to 16.12 (smart license only) and converted its license exactly as described in this article.
      It worked ok, I can see all three perpetual licenses in my smart account and device is in compliance:


      License Authorization:
      Status: AUTHORIZED on Jul 18 09:58:45 2021 BST
      Last Communication Attempt: SUCCEEDED on Jul 18 09:58:45 2021 BST
      Next Communication Attempt: Aug 17 09:58:45 2021 BST
      Communication Deadline: Oct 16 09:53:44 2021 BST

      License Conversion:
      Automatic Conversion Enabled: False
      Status: Already converted on Jul 18 09:58:38 2021 BST

      I can see three new licenses in Smart Account:

      • ISR_4351_Application
      • ISR_4351_Hsec
      • ISR_4351_Security
      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.