Cisco ISE 3.1 - Alarms: Smart Licensing Authorization Renewal Failure

[milos_p]

Hi guys,

I am running two node deployment with fresh ISE 3.1 patch3 installation.

I am getting every few days alarm like this:

Alarms: Smart Licensing Authorization Renewal Failure, with description when I open the alarm "Smart Licensing Authorization Renewal Failure: Details=Communication send error."

I have checked firewall, there is no block from ISE servers and communication is allowed in the exact timestamp of the alarm (I can see in the firewall logs).

Also I see in Licensing page, in "Last Authorization" column that there was successful authorization few hours after the alarm timestamp.

Anyone else experiencing similar behavior? Is it a bug and is there some workaround?

It's not affecting production in any way, just I am getting alarms approx. every second day for this matter.

Thanks a lot in advance!

Regards,

Milos

[Marcelo Morais]

Hi @milos_p ,

 I'm able to do this:

but if I click the link, then I am redirected to the other bug.

Regards

[Arne Bier]

I am using an on-prem CSSM that is air-gapped. Not that many devices talking Smart to it. Not sure why anything would be getting overloaded. It makes very little sense. Thee boxes have GigE interfaces, loads of RAM and CPU and the ability to perform retries - how overloaded does a system have to be?  The CSSM CPU and MEM stats are super low when checking in the GUI.

Java bloat.

[Marcelo Morais]

Hi @Arne Bier ,

 understood ... any Maximum Resource Limit Reached at Operations > Reports > Reports > Audit > Operations Audit?

Note: please take a look at: CSCwb29140 Threads getting exhuast post moving to latest patches were nss rpm is updated(Only 3.0p5&2.7p7,3.1P1., there is a Hot Patch for that.

Regards

[milos_p]

Hi Arne,

Great, thanks a lot, keep us posted here what TAC said.

[milos_p]

Hi guys,

Just to give you an update from my side.

After many days of not having warning, it appeared again, so it was just a strange coincidence of not showing and me putting IP bypass for so many days.

[JackieBehr]

I recently upgraded our ISE from 3.0 to 3.1 patch 4 and am still getting these errors ~once a day and we do not decrypt SSL traffic for the subnets our ISE nodes use.

Alarm Name :
Smart Licensing Authorization Renewal Failure

Details :
Smart Licensing Authorization Renewal Failure: Details=Server error occurred: LS_LICENGINE_FAIL_TO_CONNECT.

Description :
Renewal of Authorization with Cisco Smart Software Manager failed.

[Arne Bier]

yes it's tragic. I don't know the answer, other than to say that as long as ISE keeps working, ignore those errors (if you have done everything correctly). It's annoying for sure.

I have only ever seen an ISE system that has never had this error - and that is a clean ISE 3.1 install (patch 3) and the customer has an on-prem CSSM.  That ISE deployment has been running without any Smart licensing errors since day 1. I hope it stays that way.

I have also seen this error come and go on ISE 3.0 with on-prem CSSM servers. I tried everything to get rid of it (reboot CSSM server) and also to delete the Smart config in ISE and start again.