Smart Licensing Certificate - Expressway Issue (January 2023)

[MARTIN STREULE]

If you have issues with Expressways (connecting to site https://smartreceiver.cisco.com/licservice/license ), you are not alone and Cisco is already working on it.

Please open SRs anyway to raise awareness.

Apparently there was a Certification change on the 14th.

Impact:

New Expressway Series deployment / existing deployment where you need to register Expressway to Smart Licensing: NOT POSSIBLE to register to Smart Licensing

Existing Expressway Series already registered to Smart Licensing: a tremendous amount of error logs entries SmartAgentNotifyAuthRenewFailure and SmartAgentNotifyCommFailure

[mamoss]

Have you heard any update from Cisco yet? I think this is affecting more than just Expressways, but we are investigating extent at the moment.

[MARTIN STREULE]

Hi @mamoss , more than Expressways?

[MARTIN STREULE]

I guess it would be good if more cases are opened to raise awareness. 

[mamoss]

Not certain yet, but seeing other smart licensing issues in systems such as ISE, switches. Could be unrelated. Also found this link which is around the same date, although seems to reference the similar certificate alerts that came up last year https://www.cisco.com/c/en/us/support/docs/field-notices/725/fn72543.html?emailclick=CNSemail 

[Z OBrien]

Cisco has posted this bug in relation to this issue: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwe09378

The work around is to use a satellite server for now. Forcing their customers to spin up a new server to correct this is not an ideal solution so hopefully a real fix is available soon.

[MARTIN STREULE]

Just heard that apparenty some certs are hard-coded in the Expressway and an upgrade will be required. 🤯🤬

[darren.rogers]

Yes I also  have a TAC case open and am aware of the expressway cloud licensing  BUG/issue. My Cisco Account Team is very nonchalant about the situation saying there is no-real impact because you have a 90 day check in grace period...  It seems Cisco cannot get there act together with regards to certificates ..very disappointing and frustrating . One unhappy camper here !!!

I have also heard that an expressway update/upgrade will be required to resolve this issue..thanks Cisco...not !

[A_]

Have no issues with X14.2.2 in direct mode. I have "IdenTrust Commercial Root CA 1" in my Trusted CA store, though.

[darren.rogers]

is direct mode the same as having an on prem licensing server ? I am running 14.2.2 and am  experiencing the described licensing issue

[Z OBrien]

It is not. Direct is connecting directly to the Cisco hosted Smart Licensing servers. On-prem uses a satellite server.

[MARTIN STREULE]

In the bug notes 14.2.2 is mentioned as affected.
Check the logs for "SmartAgentNotifyAuthRenewFailure" and "SmartAgentNotifyCommFailure".
The device looks registered in the GUI.
The Trusted CA store is ignored, it's hardcoded...

[Z OBrien]

So far I've personally seen the issue impacting X14.2.1 and X14.2.2. After working with TAC, it looks like there is a planned upgrade release on February 15th for X14.2.5 that includes a fix for this issue. As I also have an expressway that has a timer that ends before that release date, I was also informed of a X14.0.11 patch that should be out the first week of February that also includes the fix.

[darren.rogers]

any one have any new intel on ETA for a fix, BUG URL says FIXED , but no fixed software posted ....

[mamoss]

TAC advised us they are working on the new versions, and they are due for release in next week couple of weeks.