Not familiar with smartnet licensing, if you are referring to smart licensing and smartnet service then, Smart Licensing is just dynamic pooled licenses associated with your organizations’s account rather than it being applied to individual devices via manual PAK/RTU licenses, whereas SmartNET is your software/hardware maintenance including access to TAC services. To answer your question :
What is the procedure? : you Create an account on Cisco smart licensing portal and your partner from whom you will purchase will associate your licenses with your smart account when making the order. All your licenses will be posted on your portal. See https://video.cisco.com/detail/video/6332310260112
If firmware can be downloaded from cisco website, why do we need a smartnet license? It’s not true, you cannot download firmware unless you have right privilege, moreover you need active smartnet to get TAC support if needed.
Recently there is a cisco vulnerability that needs https disabled : the vulnerability you’re talking about impact public facing perimeter devices with HTTP services enabled internal devices should not be impacted.
-hope this helps-
