To register a CSR1000v , ISR , ASR as an example  follow these steps for a CSR1000 it is the same for all. --conf t -- license smart enable   --end --- "show run | be call-home" shows the default configuration and per default call-home URL points to tools.cisco.com     to register your device to a Satellite you need to modify the URL and some other parameters.  --conf t -- call-home  -- profile CiscoTAC-1 " no no destination address http https://tools.cisco.com/its/service/oddce/services " "destination address http http://10.48.82.163/Transportgateway" OR "destination address http http://10.48.82.163/Transportgateway/services/DeviceRequestHandler" end If you are using VRF routing or sourcing the traffic form any other interface than global routing interface  you should configure source-interface , as well as add the vrf in call-home conf t call-home  vrf XYZ  source-interface  "vrf-interface or  <Looback0> etc " and add the command for http protocol  for source interface ip http client source-interface  <Loopback0 >  end To verify your configuration , DO " show run call-home detail "     If you are going to use HTTPS, you need to disable "crl"  as well as follow the steps in this article . https://community.cisco.com/t5/cisco-software-documents/how-to-register-your-device-using-https-to-satellite-smart/ta-p/3747976 Below showing the configuration needed to make sure http knows how to get to satellite. Also for HTTPS  showing how to disable "crl "   for CSR1000v is revocation-check none "      You can use "show call-home detail",  " show license all" and " show license tech-support" for verifying or troubleshooting.    ---For Cisco CUCM  to configure a Satellite you use the same format URL as above     http://Satellite-ip/Transportgateway OR     http://Satellite-ip/Transportgateway/services/DeviceRequestHandler For HTTPS see ..   https://community.cisco.com/t5/cisco-software-documents/how-to-register-your-device-using-https-to-satellite-smart/ta-p/3747976   --- For  APIC,  you also  add URL as above     http://Satellite-ip/Transportgateway OR     http://Satellite-ip/Transportgateway/services/DeviceRequestHandler For HTTPS see ..   https://community.cisco.com/t5/cisco-software-documents/how-to-register-your-device-using-https-to-satellite-smart/ta-p/3747976 Note: the URL shown in the picture below is wrong has port 8443 .  You only use port 8443 for administration portal of the Satellite. If you are going to configure a port number,  Please use 443 for https and 80 for http access.      image below is showing status , the successful registration of APIC      ... View more

When you add more than one NIC to the Satellite be aware that Satellite is acting as a linux end host.  As you may already know a host does not know how to route. When you add 2 network-interfaces you have to make sure you configure it just right or else connectivity to the Satellite will be lost.    As shown in the picture below,  the interface to outside world in this case Cisco.com.  You set the firewalld domain to "DMZ"  and default-gateway set .  Or you other choice is to have specific routes added to reach swapi.cisco.com:443 and cloudsso.cisco.com:443 as well as api.cisco.com:443  to add static route , you login to CLI and do  " sudo ip route add 173.37.144.211/32 via 10.200.1.1 dev ens160" as an example where 10.100.1.1 is the gateway out .  To add a specific static route that will survive a reboot  do this. sudo -s add a file called route-ens160 in /etc/sysconfig/network-scripts directory and add the following in to the body of the file .. "173.37.144.211/32 via 10.200.1.1 dev ens160", afteward do " service network restart  Or  enable Default-gateway, but you can only do this for one of the interfaces not both.  Interface ens160    Inside interface.. And for the second Interface (  ens192) you select a firewall role " PUBLIC" Add static route to reach your devices and allow access to admin-portal. As shown above we selected "Default-Gateway"  for interface ens160 .  So we should not enable default-gateway for interface ens192     to check the routing table on CLI ,   ssh to Satellite  sudo -s route  to see all the interface .. ip a     ... View more

Symptoms Satellite version 6.x uses some internal networks for docker communication. ip address range 172.17.0.0/16 and 172.16.0.0/24 .  If you have a conflict and using these networks on the same vlans as Satellite version 6.x is installed, you can change these address assignments to avoid duplicates and routing loops.   Diagnosis To see what addresses are used by Satellite version 6.x do , sudo -s ip a  and view interface addresses for docker0 and atantis0.  If you feel there is a routing problem due to duplicates network assignments please use the steps below to resolve   Solution [atlantis0] Edit the last few lines of /home/deployer/atlantis/docker-compose-up.yml to the following: networks:   default:     driver: bridge     driver_opts:        com.docker.network.bridge.name: atlantis0     enable_ipv6: true     ipam:       config:         - subnet: 192.168.200.0/24           gateway: 192.168.200.254         - subnet: fd00:dead:beef::/48   [docker0] Create the file /etc/docker/daemon.json with the following contents: {   "bip": "192.168.201.1/24" }   After the above procedures, restart the satellite.   ... View more

 If you try and synchronize using Network Synchronization and it fails in STEP 2 of 5 in versions 4.X or 5.X , but manual synchronization works. showing the steps in the picture below.. Check connectivity to api.ciso.com and cloudsso.cisco.com and swapi.cisco.com login to CLI using ssh  sudo -s curl -kv https://cloudsso.cisco.com curl -kv https://api.cisco.com curl -kv https://swapi.cisco.com If they are working and there is no failure try the same from docker in version 6.x  use the command below to connect to docker backend  docker exec -it atlantis_backend_1    curl -kv https://cloudsso.cisco.com curl -kv https://api.cisco.com curl -kv https://swapi.cisco.com  If still having issues, check DNS make sure it can resolve cloudsso.cisco.com  and or api.cisco.com    You  may need to disable IPV6 , steps are. login to CLI using "ssh" sudo -s vi or use nano to edit file called "sysctl.conf" Append below lines in /etc/sysctl.conf: vi or nano /etc/sysctl.conf net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 and save, afterward do. "sysctl -p" and “service newtork restart” try and log back to admin portal and try to synchronize again using Network-Synchroization   ... View more

Symptoms  Can not register your Cisco device to Satellite Smart-licensing-server using HTTPS.  Works when using HTTP.  Diagnosis  Change Call-home URL to use HTTP and see if that works.  If it does you can use the steps below to work around the SSL handshake issue when using HTTPS.  Change call-home URL to HTTP  conf t call-home profile "CiscoTAC-1" no  destination address http https:// <your Satellite-IP-Address> /Transportgateway/services/DeviceRequestHandler destination address http http://<your Satellite-IP-Address>/Transportgateway/services/DeviceRequestHandler end license smart register idtoken XXXXXXXX ,    where XXXXXXX is the actual token you get from your Satellite. Solution  If HTTP works as explained above, you can try these steps to fix your https  communication issue.  1- Browse to  https://Satellite-ip-address/Transportgateway  , and view Certificate details .  2--  As you can see below  you click on 1 and "View Certificate " and see  2 . In my case the CN , or cName is the same as the ip-address.  You need to match call-home URL to use the CN instead of Satellite ip-address . conf t call-home profile "CiscoTAC-1" destination address http https://<your Satellite-CN>/Transportgateway/services/DeviceRequestHandler end license smart register idtoken XXXXXXXX ,    where XXXXXXX is the actual token you get from your Satellite. Option-2:  You can make the cName or CN to either match the ip-address of the Satellite or an FQDN that is reachable  from your devices .  In my exa mple  below I match the CN to Satellite ip-address .  to do that change name taking steps 1, 2 shown below.  After you change the name to either ip-address or a valid FQDN  you go to the bottom and save .  Afterword do a full-synchronization.  This will change the CN to match ip-address or the FQDN.   Now you change your call-home URL to match this  https://satellite-CN/Transportgateway  NOTE: In addition to above you need to make sure under crypto "trustpoint" you changed revocation-check to " none".  By default most products have revocation-check set for "crl" .    Sample config from a csr1000v showing this configuration . ******************************* crypto pki trustpoint SLA-TrustPoint enrollment terminal revocation-check none  ************************* If the key-chain is missing , you can import the Cisco_Root-CA from http https://www.cisco.com/security/pki/certs/clrca.cer To import a Cert using CLI ,  steps are    Conf t crypto pki authenticate SLA-TrustPoint <Expect to see .....> Enter the base 64 encoded CA certificate. End with a blank line or the word "quit" on a line by itself <Cut and past the Ke-chain from the URL from above including BEGIN/END below ..> and end with "quit" and confirm with "YES"     NOTE:  If you use Satellite version 6.3 to change the cName ( CN )  you should modify the CN following these steps  --login to Satellite admin portal  https://satellite-ip:8443/admin  -- Security  and change the CN      So in my example I  selected CN == to Satellite ip-address so on the Routers and Switches I need to change the URL to  https://10.83.111.14/Transportgateway      ... View more