Failure reason: Fail to send out Call Home HTTP message. C9500

[FABIO BETTINI]

Hi All,

From logging on C9500-40X i see this:

Jan 27 10:49:48.020: %CRYPTO_ENGINE-5-KEY_DELETED: A key named SLA-KeyPair has been removed from key storage
Jan 27 10:49:48.400: %CRYPTO_ENGINE-5-KEY_ADDITION: A key named SLA-KeyPair has been generated or imported by crypto-engine
Jan 27 10:49:48.433: %PKI-4-NOCONFIGAUTOSAVE: Configuration was modified. Issue "write memory" to save new IOS PKI configuration
Jan 27 10:49:50.632: %PKI-4-TRUSTPOOL_DOWNLOAD_FAILURE: Trustpool Download failed
Jan 27 10:50:32.804: %CALL_HOME-5-SL_MESSAGE_FAILED: Fail to send out Smart Licensing message to: https://tools.cisco.com/its/service/oddce/services/DDCEService (ERR 205 : Request Aborted)
Jan 27 10:50:32.804: %SMART_LIC-3-AGENT_REG_FAILED: Smart Agent for Licensing Registration with the Cisco Smart Software Manager (CSSM) failed: Fail to send out Call Home HTTP message.
Jan 27 10:50:32.804: %SMART_LIC-3-COMM_FAILED: Communications failure with the Cisco Smart Software Manager (CSSM) : Fail to send out Call Home HTTP message.

C9500#sh license status
Smart Licensing is ENABLED

Utility:
Status: DISABLED

Data Privacy:
Sending Hostname: yes
Callhome hostname privacy: DISABLED
Smart Licensing hostname privacy: DISABLED
Version privacy: DISABLED

Transport:
Type: Callhome

Registration:
Status: REGISTERING - REGISTRATION IN PROGRESS
Export-Controlled Functionality: NOT ALLOWED
Initial Registration: FAILED on Jan 27 10:58:08 2022 CET
Failure reason: Fail to send out Call Home HTTP message.       
Next Registration Attempt: Jan 27 12:00:44 2022 CET

License Authorization:
Status: EVAL EXPIRED on Oct 26 20:04:16 2020 CET

Export Authorization Key:
Features Authorized:
<none>

But if i try to ping cisco.com and tools.com all work fine

C9500#ping tools.com
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 188.114.97.22, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 11/11/12 ms
C9500#ping cisco.com
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 72.163.4.185, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 139/194/415 ms

Can you help me to understand to fix this issue?

regards

[balaji.bandi]

what is the version of code , post call home configuration along with ping

#ping tools.cisco.com

# telnet tools.cisco.com 443

have not seen this error before ?  - Do you have any other device in the network register smart License ?

(ERR 205 : Request Aborted)

some troublesheet tips :

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-9500-series-switches/214484-cisco-smart-licensing-troubleshooting.html

[FABIO BETTINI]

Hi BB,

thank you for your support. Below you can see the answer of your questions:

#IOS VERSION

Model    SW Version     SW          Image              Mode
------ ----- ----- ---------- ----------      ----
* 1 50    C9500-40X    16.12.1   CAT9K_IOSXE  BUNDLE

#CONFIG CALL HOME

call-home
contact-email-addr <--email omitted for privacy-->
profile "CiscoTAC-1"
active
destination transport-method http
no destination transport-method email

C9500#ping tools.cisco.com
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 72.163.4.38, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 140/141/142 ms

9500-T-RM#telnet tools.cisco.com 443
Trying 2001:420:1101:5::A, 443 ...
% Destination unreachable; gateway or host down

I have never seen this error before.

In the past, the license was properly registered on the Cisco site.
Out of the blue, these events appeared in the device logs and the license seems to have expired:

9500-T-RM#sh license summary
Smart Licensing is ENABLED

Registration:
Status: REGISTERING - REGISTRATION IN PROGRESS
Export-Controlled Functionality: NOT ALLOWED
Next Registration Attempt: Jan 27 14:46:28 2022 CET

License Authorization:
Status: EVAL EXPIRED

License Usage:
License Entitlement tag Count Status
-----------------------------------------------------------------------------
(C9500-40X DNA Advantage) 2 EVAL EXPIRED
(C9500 Network Advantage) 2 EVAL EXPIRED

We have swtichs configured the same way, for example we have C9200 that working fine.

[balaji.bandi]

#CONFIG CALL HOME

call-home
contact-email-addr <--email omitted for privacy-->
profile "CiscoTAC-1"
active
destination transport-method http
no destination transport-method email

This looks good for me, Hope device not have different routes.

may be some suggestions :

call-home
source-interface XXXXXXXXXXX ( XXXX where use this interface to send information out to register - mean that has internet access)

still issue  : enable debug :

4. Enable debugs

Enable the following debugs to collect additional information about Smart Licensing process (note that after enabing debugs, you need to try to register license once again via CLi mentioned in point 4.1):

#debug call-home smart-licensing [all | trace | error]
#debug ip http client [all | api | cache | error | main | msg | socket]

[FABIO BETTINI · Accepted solution]

Hi BB,

After specifying the source interface for the call-home service, the switch successfully registered the smart license.

C9500#sh lice status
Smart Licensing is ENABLED

Utility:
Status: DISABLED

Data Privacy:
Sending Hostname: yes
Callhome hostname privacy: DISABLED
Smart Licensing hostname privacy: DISABLED
Version privacy: DISABLED

Transport:
Type: Callhome

Registration:
Status: REGISTERED
Smart Account: *********
Virtual Account: DEFAULT
Export-Controlled Functionality: ALLOWED
Initial Registration: SUCCEEDED on Jan 27 17:20:11 2022 CET
Last Renewal Attempt: None
Next Renewal Attempt: Jul 26 17:20:10 2022 CET
Registration Expires: Jan 27 17:15:08 2023 CET

License Authorization:
Status: AUTHORIZED on Jan 27 17:20:16 2022 CET
Last Communication Attempt: SUCCEEDED on Jan 27 17:20:16 2022 CET
Next Communication Attempt: Feb 26 17:20:16 2022 CET
Communication Deadline: Apr 27 17:15:15 2022 CET

Export Authorization Key:
Features Authorized:
<none>

Thank you!

[balaji.bandi · Accepted solution]

After specifying the source interface for the call-home service, the switch successfully registered the smart license.

Thank you for the feedback and glad suggeston helped, we mark as resolved now.

[Heriberto Diaz]

Hi

What section did you specific the source interface? Because I have the same issue with ISR4431.

Thanks and regards.

[balaji.bandi]

check config syntax 

1. ip http client source-interface interface-type interface-number

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-9/configuration_guide/sys_mgmt/b_169_sys_mgmt_9300_cg/configuring_smart_licensing.html

[Heriberto Diaz]

Hi

OK, I validated the command is applied

ip http client source-interface GigabitEthernet0/0/1

Do you know if is mandatory to have a contract support to register the ISR4431? Because the syntaxis to call-home has been validated with other devices and the only different is the contract support.

Thanks and regards.

[balaji.bandi]

For License, you should be able to register if you purchased a license.