On Prem SSM does not register devices

[akrapf_007]

I have been struggling with getting my switches to properly register with my on prem SSM.  I have followed every guide I can find, as well as looking at solutions on this board, all with no results.  I have been able to use the SSM with my DNAC and ISE.

My test switch is a C9200CX (v17.13.1).  I have tried CSLU, SmartTransport, and SmartCallHome and they all fail.  The closest I got to making it work is using CSLU, however I get an error indicating it doesn't have the correct credentials (?)

I can't believe this is all that hard, so what am I missing?  I know everyone will ask what my config is, so let me just say that I have tried the configs marked as SOLUTION from this board and others that don't work.

The last one I used is:

crypto pki trustpoint SLA-TrustPoint
enrollment terminal
revocation-check none
ip http client source-interface (either interface name or vrf)
license smart transport cslu
license smart url cslu (CSLU url from on-prem)
exit
license smart trust idtoken(token) local
license smart sync all

[bgillies95]

Hi,

Did you ever get this working? We have a lot of devices for our customer which work with the On-Prem, however I cannot seem to get the Nexus devices working. So frustrating! I have a TAC case open, but it's the typical scenario going around in circles. CSLU seems to get us the closest, where the device will show up on the product instance page, however it doesn't seem to use the trust token and take the appropriate licences. It can't be a firewall issue since the switch and the on-prem exist within the same subnet. Additionally, other devices also register without issue.

[akrapf_007 · Accepted solution]

I did get this functioning (finally).  TAC didn't get me there after a few weeks of back and forth, but I discovered the issue which was seriously basic.  There was one line of config missing in my switches. What is needed is:

• aaa new-model
• aaa authorization exec default local
• netconf ssh
• netconf-yang
• license smart url <cslu URL from on prem SSM>

After this, you have to add the device policy in the SSM.  It should make the connection as long as you have the profile in your device set for the destination address of the cslu url.  

What was odd was that in some switches the aaa authorization exec default local was there by default, in others it was not. Since I hadn't used it before, I didn't know to look for it.