事象：
ASAvや、Firepower1000/2100/3100シリーズ製品で、On-Prem (Cisco SSM On-Prem) ライセンスサーバー経由にてSmart Licenseを利用する環境の場合、下記の通り、スマートライセンスの登録が失敗してしまう場合があります。
Firepower# show license all
Smart Licensing Status
======================
Smart Licensing is ENABLED
Registration:
Status: REGISTERING - REGISTRATION IN PROGRESS
Export-Controlled Functionality: NOT ALLOWED
Initial Registration: FAILED on Apr 13 2023 15:28:25 JST
Failure reason: Communication message send error
Next Registration Attempt: Apr 13 2023 16:32:29 JST
...
ASAのSyslogからも下記のように確認することが可能となります。
%ASA-3-717009: Certificate validation failed. serial number: 01, subject name: CN=Cisco Licensing Root CA,O=Cisco.
%ASA-3-717027: Certificate chain failed validation. Generic validation failure occurred.
...
%ASA-3-444303: %SMART_LIC-3-COMM_FAILED:Communications failure with the Cisco Smart Software Manager (CSSM) : Communication message send error
発生原因：
こちらについては、ASA製品にOn-Premサーバー証明書を認証可能なRoot CAがなく発生しております。
対策：
下記のいずれかの対処にて事象の改善が期待できます。
1. 下記の手順にてOn-premサーバとの通信方式をhttpsからhttp通信へ変更：
Firepower(config)# call-home
Firepower(cfg-call-home)# profile License
Firepower(cfg-call-home)# destination address http http://<On-premサーバーIPアドレス>/Transportgateway/services/DeviceRequestHandler
2. On-premのルート証明書をASAにインポート：
Firepower# config t
Firepower(config)# cryp ca trustpoint SSMSatelliteRootCA
Firepower(config-ca-trustpoint)# enrollment terminal
Firepower(config-ca-trustpoint)# crl configure
Firepower(config-ca-crl)# cryp ca authenticate SSMSatelliteRootCA
Enter the base 64 encoded CA certificate.
End with the word "quit" on a line by itself
-----BEGIN CERTIFICATE-----
MIIDITCCAgmgAwIBAgIBATANBgkqhkiG9w0BAQsFADAyMQ4wDAYDVQQKEwVDaXNj
bzEgMB4GA1UEAxMXQ2lzY28gTGljZW5zaW5nIFJvb3QgQ0EwHhcNMTMwNTMwMTk0
ODQ3WhcNMzgwNTMwMTk0ODQ3WjAyMQ4wDAYDVQQKEwVDaXNjbzEgMB4GA1UEAxMX
Q2lzY28gTGljZW5zaW5nIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQCmvL2WEx4F9xRepyws1obmFyIuofHv9k3LtMeYISqhR8ZV2NeUcTgN
hxFEHhqvBxqcrmOIijjlIBw5TXhGLvI5xln3FbmMCllbu1y9DP6+o3AKi/fY8lbu
SqToDdtv0clgsf0Y/8aclm+miVeiYX3nEE/cX+opVqxzkKPrK1Q2rchHosXatVPr
aamlNVjp8+PAvSPPWL1xiGjmlJEg8yDnlI5x1647zITxBoTHS8jgD1ObpCtCxou3
x0eQlrTLLWLqL1Bdx7BipGgR2VvoJQ/EXV1fuI8n0ZHFXw12YfmkzT2ZIyeouwO9
Tm1waXy634vfX0NolRNeRN/Hxs8E3X/RAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIB
BjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRJ3IVLPTHlGz5qF2Bq8zM9O0xz
6DANBgkqhkiG9w0BAQsFAAOCAQEAUH8k05MqZoYCXZ/oOK5cbU32sEljHHgkDakF
YE7c3v9P7St3/EYOzWNv291EaB46VnOrkJPTsWyePYvZiYe/5Ay9nhrsoMIhibtc
j6hWhs2YtkZVdbFGjfxmqEZ6PfRNVlcAat8PDc+DUBU8BP98Ieh4rBG6nNJVqSMs
fKe35sGvdPYVLpm3sfz5u+lz3n9b3euGxx47SRdlMItfsNoGuSr+f0lOip4HuFc3
86WL4RpIoinDfB5pOfCGeIDdzRbWus7K7rx8+YQoeHs1ICzcYORharYjzb0jDjr7
QYYWqUCT4ElNEKt1J+hvc5MuNbWIYv2uAnUVb3GbsvDWl99/KA==
-----END CERTIFICATE-----
quit
INFO: Certificate has the following attributes:
Fingerprint: 1468dc18 250bdfcf 769c29df e1f7e5a8
Do you accept this certificate? [yes/no]: yes
WARNING: CA certificates can be used to validate VPN connections,
by default. Please adjust the validation-usage of this
trustpoint to limit the validation scope, if necessary.
Trustpoint CA certificate accepted.----------------------->証明書のインポートが完了
Firepower(config)# show cryp ca certificates----------------------->当コマンドにてインポート状況を確認することが可能です。
CA Certificate
Status: Available
Certificate Serial Number: 01
Certificate Usage: General Purpose
Public Key Type: RSA (2048 bits)
Signature Algorithm: SHA256 with RSA Encryption
Issuer Name:
cn=Cisco Licensing Root CA
o=Cisco
Subject Name:
cn=Cisco Licensing Root CA
o=Cisco
Validity Date:
start date: 04:48:47 JST May 31 2013
end date: 04:48:47 JST May 31 2038
Storage: config
Associated Trustpoints: SSMSatelliteRootCA
上記のいずれの方法で対応完了後、下記のコマンドにて再度ライセンスの登録を行えば、事象の改善が期待できます。
Firepower(config)# license smart register idtoken [token ID]
尚、FPR4100/9300シリーズ製品の場合は、現時点では当事象の発生の報告はございませんが、FXOS側にて証明書を管理しておりますため、下記の手順にて証明書をインポートすることが可能となります。
FPR4k /security # enter trustpoint CiscoLicRoot
FPR4k /security/trustpoint* # set certchain
Enter lines one at a time. Enter ENDOFBUF to finish. Press ^C to abort.
Trustpoint Certificate Chain:
>-----BEGIN CERTIFICATE-----
MIIDITCCAgmgAwIBAgIBATANBgkqhkiG9w0BAQsFADAyMQ4wDAYDVQQKEwVDaXNj
bzE>gMB4GA1UEAxMXQ2lzY28gTGljZW5zaW5nIFJvb3QgQ0EwHhcNMTMwNTMwMTk0
O>DQ3WhcNMzgwNTMwMTk0ODQ3WjAyMQ4wDAYDVQQKEwVDaXNjbzEgMB4GA1UEAxMX
Q2lzY2>8gTGljZW5zaW5nIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
gg>EKAoIBAQCmvL2WEx4F9xRepyws1obmFyIuofHv9k3LtMeYISqhR8ZV2NeUcTgN
>hxFEHhqvBxqcrmOIijjlIBw5TXhGLvI5xln3FbmMCllbu1y9DP6+o3AKi/fY8lbu
SqT>oDdtv0clgsf0Y/8aclm+miVeiYX3nEE/cX+opVqxzkKPrK1Q2rchHosXatVPr
>aamlNVjp8+PAvSPPWL1xiGjmlJEg8yDnlI5x1647zITxBoTHS8jgD1ObpCtCxou3
x0eQlrTLLWLqL1B>dx7BipGgR2VvoJQ/EXV1fuI8n0ZHFXw12YfmkzT2ZIyeouwO9
Tm1>waXy634vfX0NolRNeRN/Hxs8E3X/RAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIB
BjAPB>gNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRJ3IVLPTHlGz5qF2Bq8zM9O0xz
6>DANBgkqhkiG9w0BAQsFAAOCAQEAUH8k05MqZoYCXZ/oOK5cbU32sEljHHgkDakF
YE7c3v9P7St3>/EYOzWNv291EaB46VnOrkJPTsWyePYvZiYe/5Ay9nhrsoMIhibtc
j>6hWhs2YtkZVdbFGjfxmqEZ6PfRNVlcAat8PDc+DUBU8BP98Ieh4rBG6nNJVqSMs
fKe35sGvdPYVLpm3sfz5u+>lz3n9b3euGxx47SRdlMItfsNoGuSr+f0lOip4HuFc3
8>6WL4RpIoinDfB5pOfCGeIDdzRbWus7K7rx8+YQoeHs1ICzcYORharYjzb0jDjr7
>QYYWqUCT4ElNEKt1J+hvc5MuNbWIYv2uAnUVb3GbsvDWl99/KA==
-----END CERTIFICATE-----
>ENDOFBUF
FPR4k /security/trustpoint* # commit-buffer
FPR4k /security/trustpoint # exit
FPR4k /security # show trustpoint----------------------->当コマンドにてインポート状況を確認することが可能です。
...
Trustpoint Name: CiscoLicRoot
Trustpoint certificate chain:
-----BEGIN CERTIFICATE-----
MIIDITCCAgmgAwIBAgIBATANBgkqhkiG9w0BAQsFADAyMQ4wDAYDVQQKEwVDaXNj
bzEgMB4GA1UEAxMXQ2lzY28gTGljZW5zaW5nIFJvb3QgQ0EwHhcNMTMwNTMwMTk0
ODQ3WhcNMzgwNTMwMTk0ODQ3WjAyMQ4wDAYDVQQKEwVDaXNjbzEgMB4GA1UEAxMX
Q2lzY28gTGljZW5zaW5nIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQCmvL2WEx4F9xRepyws1obmFyIuofHv9k3LtMeYISqhR8ZV2NeUcTgN
hxFEHhqvBxqcrmOIijjlIBw5TXhGLvI5xln3FbmMCllbu1y9DP6+o3AKi/fY8lbu
SqToDdtv0clgsf0Y/8aclm+miVeiYX3nEE/cX+opVqxzkKPrK1Q2rchHosXatVPr
aamlNVjp8+PAvSPPWL1xiGjmlJEg8yDnlI5x1647zITxBoTHS8jgD1ObpCtCxou3
x0eQlrTLLWLqL1Bdx7BipGgR2VvoJQ/EXV1fuI8n0ZHFXw12YfmkzT2ZIyeouwO9
Tm1waXy634vfX0NolRNeRN/Hxs8E3X/RAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIB
BjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRJ3IVLPTHlGz5qF2Bq8zM9O0xz
6DANBgkqhkiG9w0BAQsFAAOCAQEAUH8k05MqZoYCXZ/oOK5cbU32sEljHHgkDakF
YE7c3v9P7St3/EYOzWNv291EaB46VnOrkJPTsWyePYvZiYe/5Ay9nhrsoMIhibtc
j6hWhs2YtkZVdbFGjfxmqEZ6PfRNVlcAat8PDc+DUBU8BP98Ieh4rBG6nNJVqSMs
fKe35sGvdPYVLpm3sfz5u+lz3n9b3euGxx47SRdlMItfsNoGuSr+f0lOip4HuFc3
86WL4RpIoinDfB5pOfCGeIDdzRbWus7K7rx8+YQoeHs1ICzcYORharYjzb0jDjr7
QYYWqUCT4ElNEKt1J+hvc5MuNbWIYv2uAnUVb3GbsvDWl99/KA==
-----END CERTIFICATE-----
...
改善しない場合に必要な情報：
仮に上記対応でも事象が改善しない場合は、下記の情報を取得頂きTACまでお問合せください。
show license all
show tech-support license
show ntp status
show clock
more disk0:/smart-log/agentlog
show tech
show logging (informationalレベル）
参考情報：
Ascertain ASA Smart Licensing Failures Due to Certificate Issues
ASAv/FPR1000/FPR2100: スマートライセンス認証とトラブルシューティング
