Smart Licensing fails on C9500 version 17.3.1r[FC2]

[alanvthomas1991@gmail.com]

I am trying to register a Cat 9500 switch with version 17.3.1 version on an On-Prem smart license server and it fails.

I get the following errors:

Nov 2 15:13:15.722: %SMART_LIC-3-COMM_FAILED: Communications failure with the Cisco Smart Software Manager (CSSM) : Received empty response from server

When I do a sh license status:

Utility:
Status: DISABLED

Smart Licensing Using Policy:
Status: ENABLED

Data Privacy:
Sending Hostname: yes
Callhome hostname privacy: DISABLED
Smart Licensing hostname privacy: DISABLED
Version privacy: DISABLED

Transport:
Type: Smart
URL: https://abc.xyz.com/SmartTransport
Proxy:
Not Configured

Policy:
Policy in use: Merged from multiple sources.
Reporting ACK required: yes (CISCO default)
Unenforced/Non-Export Perpetual Attributes:
First report requirement (days): 365 (CISCO default)
Reporting frequency (days): 0 (CISCO default)
Report on change (days): 90 (CISCO default)
Unenforced/Non-Export Subscription Attributes:
First report requirement (days): 90 (CISCO default)
Reporting frequency (days): 90 (CISCO default)
Report on change (days): 90 (CISCO default)
Enforced (Perpetual/Subscription) License Attributes:
First report requirement (days): 0 (CISCO default)
Reporting frequency (days): 0 (CISCO default)
Report on change (days): 0 (CISCO default)
Export (Perpetual/Subscription) License Attributes:
First report requirement (days): 0 (CISCO default)
Reporting frequency (days): 0 (CISCO default)
Report on change (days): 0 (CISCO default)

Miscellaneous:
Custom Id: <empty>

Usage Reporting:
Last ACK received: <none>
Next ACK deadline: Dec 12 11:31:18 2022 CDT
Reporting push interval: 30 days
Next ACK push check: <none>
Next report push: Sep 28 16:23:53 2022 CDT
Last report push: <none>
Last report file write: <none>

Trust Code Installed: <none>

I would like to know what i am missing.

I am able to ping the Smart license server from the switch.

Call-home profile is Active.

Anyone run across such an issue?

[balaji.bandi]

how is your config looks like - do you have any Firewall between device and CSSM, you able to ping how about other ports like 443?

also check source interface to use for http souce ?

https://www.balajibandi.com/?s=smart

check some troubleshoot tips :

https://www.cisco.com/c/en/us/td/docs/routers/sl_using_policy/b-sl-using-policy/troubleshooting.html

[alanvthomas1991@gmail.com]

No firewalls. 

When i do a debug this is what i see:

Nov 2 16:33:25.275: CALL-HOME-TRACE:
plfm: mon_set_var returns 3689

Nov 2 16:33:28.436: %SMART_LIC-3-COMM_FAILED: Communications failure with the Cisco Smart Software Manager (CSSM) : Received empty response from server
Nov 2 16:33:57.032: CALL-HOME-DETAIL: call_home_process_timer_event() is entered
Nov 2 16:33:57.032: CALL-HOME-DETAIL: Cleared rate limit counter
Nov 2 16:33:57.032: CALL-HOME-DETAIL: rate limit timer: httpc_enabled 1, status 0, sid 3
Nov 2 16:34:57.032: CALL-HOME-DETAIL: call_home_process_timer_event() is entered
Nov 2 16:34:57.032: CALL-HOME-DETAIL: Cleared rate limit counter
Nov 2 16:34:57.032: CALL-HOME-DETAIL: rate limit timer: httpc_enabled 1, status 0, sid 3

I can ping the server .

This is my call-home profile:

# sh call-home profile PQRST

Profile Name: PQRST
Profile status: ACTIVE
Profile mode: Full Reporting
Reporting Data: Smart Call Home, Smart Licensing
Preferred Message Format: xml
Message Size Limit: 3145728 Bytes
Transport Method: http
HTTP address: https://abc.xyz.com/Transportgateway/services/DeviceRequestHandler

Alert-group Severity
------------------------ ------------
N/A N/A

Syslog-Pattern Severity
------------------------ ------------
N/A N/A

[alanvthomas1991@gmail.com · Accepted solution]

So this how to do it, with the latest 17.x.x. version cisco uses policy, so i have used CSLU method of registration:

crypto pki trustpoint SLA-TrustPoint
enrollment terminal
revocation-check none
ip http client source-interface (either interface name or vrf)
license smart transport cslu
license smart url cslu (CSLU url from on-prem)
exit
license smart trust idtoken(token) local
license smart sync all

This worked with the C9500 and C9300 both in their 17.3.X version