Unable to disable smartlicensing on Ironport ESA - rollbackconfig

[bvj197222]

I was playing around with a new installation of ESA, and I enabled smart licensing. However, there was no way of turning it off after enabling it. We haven't converted our licenses yet, so I needed to switch back to classic licensing after playing around w the config. One of the newer genious-features of ESA is the command 'rollbackconfig'. I entered it and did a rollback to config prior to changing the licensing, and Voila - everything was back to normal.

The best part about rollbackconfig is that u don't have to manually save the config first. Ironport automatically saves the last committed 10 configurations.

mail.example.com> rollbackconfig
Previous Commits:
Committed On User Description
---------------------------------------------------------------------------------
1. Fri May 23 06:53:43 2014 admin new user
2. Fri May 23 06:50:57 2014 admin rollback
3. Fri May 23 05:47:26 2014 admin
4. Fri May 23 05:45:51 2014 admin edit user
Enter the number of the config to revert to.
[]> 2
Are you sure you want to roll back the configuration? [N]> y
Reverted to Fri May 23 06:50:57 2014 admin rollback
Do you want to commit this configuration now? [N]> y
Committed the changes successfully

[Mathew Huynh]

Hey Bvj,

I apologise for the inconvenience faced with the feature; we're aware of the requirement and we have filed an enhancement request to bring an option to allow a roll back to the classic licensing method.

At this stage, you are correct - the only way to go back is to rollback the config or resetconfig/reload (which is a bit too destructive).

For virtual ESAs we're recommending to not use smart licenses yet as there has been some concerns due to the lack of option to change it back gracefully to classic VLN license method.

Thank you for sharing your experience and workaround to our wider community though - it's greatly appreciated.

Regards,
Mathew

[nunomla]

Hi, I also activate the SmatLicense and know I can't disable, I tried to rollback but th SmartLicense is still active. Can you help?

[marc.luescherFRE · Accepted solution]

You need to open a case with TAC, there is no way to rollback without their help.

[nunomla]

Thanks for your fast response

[wlanwizkid]

When I contacted TAC they said it could not be done, and WOW has TAC support gone downhill at least in that experience.
Here is how I was able to do it.
(Proceed at your own risk)
This can be destructive if you do not properly prepare.
Download config file with encrypted passwords
Have some way to access the management IP via https://192.168.42.42 after reload.
In my environment I just dual homed a VM onto the management network and set 192.168.42.1/24 as the IP.

Establish SSH access to the device.
Login as the admin user.
Issue command: suspend
Issue command: diagnostic
Issue command: reload

Are you sure you want to continue? [N]> y
Are you *really* sure you want to continue? [N]> y
Do you want to wipe also? [N]> n
Wait
Access management interface via https://192.168.42.42
U: admin
P: ironport
Complete first time setup to reset your management IP and admin password.
Login to device with admin and the new password you set via the new management IP.
Load your config backup and you should be back to your original config with feature keys enabled.