Care and Feeding of Smart Licensing

Transcription

1

2 Care and Feeding of Smart Licensing James Ng, Technical Marketing Engineer, Engineering Licensing Office, CCIE #1981 Donnie Savage, Engineering, Architect Engineering Licensing Office

3 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot# 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public

4 Agenda Get Ready! Smart Licensing Overview Smart Licensing Communications Get Set! Product Licensing Work Flow Product Licensing States Go! Deploying Smart License Enabled Products Conclusion Reference only slide Agenda In this session, you will learn about deploying Cisco products using Cisco s latest product licensing vision. Come learn the foundational concepts you need to need to as you deploy and configure Smart Software Licensing for Cisco products. Together, we will go over the various scenarios you might deploy Smart License enabled products in connected and mediated networks. For mediated (disconnected) networks, we will present an overview of the Cisco Smart Software satellite, and how product configuration differs when used. By moving to an ISO Software Asset Management (SAM) solution, Cisco Smart Software Licensing simplifies the deployment of Cisco products focusing on usage (what and how many) and not enforcement. With Cisco Smart Software Licensing say goodbye to Product Activation Keys (PAKs) and License files! It is recommended that the student is familiar with Smart Licensing before taking this session. BRKARC-2010 (Smart Accounts and Smart Licensing) ckbtn=true

5 Get Ready! Overview: Smart Licensing and Smart Accounts Smart Licensing Communications

6 Acronym Decoder CSR Certificate Signing Request CSSM or SSM Cisco Smart Software Manager LCS License Crypto-Module Support OOC Out of Compliance PI Product Instances PIDs Product IDs PLR Permanent License Reservation SA Smart Account SCH Smart Call-Home SKU Stock Keeping Units UUID Universally Unique Identifier VA Virtual Accounts 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 6

7 Cisco Software Central software.cisco.com Network Plug and Play Manage Downloads and Upgrade Products Software License Tools Ordering and EULA Tools Smart Account Management 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

8 What is Cisco Smart Licensing? Cisco Smart Licensing is a new way of thinking about licensing at Cisco that is being applied to all products Instead of DRM or Node Locked licensing its a Software Inventory Management System Provides Customers, Cisco, and Selected Partners with information about Software Ownership and Software Utilization Commerce (CCW) Ownership Smart Account Usage Hello, I am Device-East5, I belong to [big-u.edu] and I am using 1x License Cisco Product I Have Purchased 5 additional Advanced Licenses for [big-u.edu] Hello, Device-East5 from [big-u.edu], you are In-Compliance BigU.edu I Own: 10 I am Using: Cisco and/or its affiliates. All rights reserved. Cisco Public 8

9 What is Cisco Smart Licensing Smart Account? Customer Smart Account Partner Holding Account Virtual Accounts Customer has the ability to manage software licenses in one account Managed by customer directly, designated VAR or authorized party Account Approvers Owner of account and enters/approves agreements with Cisco Account Administrators manages users access and privileges Administrator of account can view and make changes to licenses, review logs, track purchases, etc. Virtual Accounts Temporary account where smart enabled products are stored Partner or reseller store these products until customer identified Partner/reseller will have visibility into what products customer wants in Smart Account The Partner/Reseller will deposit an order into a customer account when account is identified *Licenses can t be used while in Holding Smart Accounts* 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 10

10 Smart Account Overview Big University [big-u.edu] A Smart Account is a single place where Customers can obtain visibility to their software and entitlements. Licenses Devices Users Information associated with a Smart Account include User roles Licenses Devices Agreements the customer has with Cisco. Agreements User Roles These assets can be further divided into Virtual accounts that might represents departments, cost centers or locations within the company Cisco and/or its affiliates. All rights reserved. Cisco Public 11

11 Smart Accounts Virtual Accounts Assets are represented as company owned allowing effortless sharing across your enterprise Big University [big-u.edu] Physics Licenses Users Chemistry Devices Medical Agreements User Roles Create virtual accounts according to your needs (example; reflecting your company, or partners) Transfer devices and licenses across virtual accounts easily 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 12

12 Smart Accounts Virtual Accounts You can create virtual accounts that reflect your organization s departments then associate licenses and devices with those departments. Big University [big-u.edu] Smart Account Virtual Accounts Physics Core Router 1 Core Router 2 Enable 8 Lic 1 Enable 1 Feat 5 Physics VA Licenses Warning and Notifications None License Quantity Use Surplus Lic Chemistry ISR-east-1 ISR-east-2 Enable 50 Lic 1 Enable 100 Lic 2 Enable 1 Feat 3 Enable 20 Lic 1 Enable 100 Lic 2 Enable 1 Feat 3 Lic Feat Medical ISR-east-3 Enable 20 Lic 1 Enable 100 Lic 2 Enable 1 Feat Cisco and/or its affiliates. All rights reserved. Cisco Public 13

13 Smart Products Communicating with Cisco

14 Products, Agents and a Backend Router SL Router Switch Firewall Unified Communications Software SL Switch Firewall Unified Communications Router Switch Firewall Unified Communications SL SL SL SL SL SL SL Cisco Smart Software Manager satellite (Optional) cisco.com Cisco Smart Software Manager Products Smart Licensing Agent Authorized Backend 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 15

15 Cisco Authorized Backend Cisco.com (Direct Connection) Cisco Products communicate by default (out of the box with Smart Software Manager Simplest method SSM satellite (On Premise) Cisco Products communicate with SSM satellite the same way they do with Smart Software Manager Connected and Disconnected modes supported Information is exchanged in Text (YAML formatted) Cisco Smart Software Manager Cisco Smart Software Manager satellite CentOS 7 (Hardened) 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 16

16 Methods for communicating with Cisco Backend Options Direct Cloud Access Cisco product sends usage information directly over the internet. No additional components are needed Access Through An HTTPS Proxy Cisco product sends usage information over the internet via a Proxy Server. Smart Call Home Transport Gateway (Free VM Download) or off-the-shelf Proxy (such as Apache). Access Through An On-Premise License Management Cisco products send usage information to a locally installed satellite. Periodically, exchange information with Cisco to keep satellite sync. This synchronization can occur automatically in connected environments or manually in disconnected environments Full Offline Access - Permanent License Reservation Use copy/paste information between product and Cisco.com to manually check in and out licenses. Functionally equivalent to current node locking, but with Smart License tracking Cisco Product HTTPs Transport Gateway or HTTPs Proxy Cisco Product HTTPs Smart Software Cisco Product Manager satellite Request License Copy/Paste License Response Cisco Product Cisco.com Cisco.com Cisco.com Cisco.com Your Cisco Software Usage Your Cisco Software Usage Your Cisco Software Usage Your Cisco Software Usage Available Today 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 18

17 Smart Product Telemetry & Visibility The Cisco Smart License requires the following minimal exchange of information during install/provisioning time. Information Collected Required? Cisco Smart Software Manager Trusted Unique Identifier (SUDI/SUVI/ID) Licenses Consumed Organization Identifier (ID Token) Hostname AAA ID of User Making Change Feature Tags Other Smart Call Home Information Yes Yes Yes No No No No HTTPS -or- On Premises satellite/proxy Offline Cisco Checks: Licenses Device IDs Business Rules Then Authorizes Use By default more information is exchanged, but this is configurable 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 19

18 Smart Product Telemetry & Visibility Industry Standard HTTPS (SSLv3*/TLS) Protects User s Privacy! HTTP over TLS used for Transport encryption Telemetry sent to Cisco is User Configurable Smart Call Home Information is optional Smart License Information is minimal Auditable Telemetry sent by SSM satellite You have the right to inspect the data gathered License Information is in Text (YAML formatted) * Newer products only use TLS 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 21

19 Get Set! Understanding: Product Licensing Work Flow Product Licensing States

20 Understanding Product Licensing Work Flow

21 Smart Licensing User Workflow Device/Product started SL State= Un-configured Device/Product Registration Have more licenses than being used In-Compliance Customer enters SL Enable or SL is Default Customer gets a Registration ID Token from CSSM Enter SL Register command/gui with ID Token Platform uses feature & reports usage to CSSM SL State= Un-identified Customer Smart Account identified SL State= Registered Out-of Compliance Using more licenses than entitled to 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 25

22 Enable Smart Software Licensing Smart-Device>en Smart-Device#config t Enter configuration commands, one per line. End with CNTL/Z. Smart-Device(config)# license smart enable Smart-Device(config)# *Oct 15 09:38:59.300: %SMART_LIC-6-AGENT_ENABLED: Smart Agent for Licensing is enabled *Oct 15 09:38:59.301: %SMART_LIC-6-HA_ROLE_CHANGED: Smart Agent HA role changed to Active. *Oct 15 09:39:00.302: %PKI-4-NOCONFIGAUTOSAVE: Configuration was modified. Issue "write memory" to save new IOS PKI configuration *Oct 15 09:39:00.302: %CALL_HOME-6-CALL_HOME_ENABLED: Call-home is enabled by Smart Agent for Licensing. *Oct 15 09:39:00.302: %SMART_LIC-5-COMM_RESTORED: Communications with Cisco licensing cloud restored Smart-Device(config)# Notes: This command is used on platforms that support BOTH Classic and Smart Software Licensing. Reload may be required to switch licensing mode. Smart Call Home is automatically enabled when Smart Software Licensing is enabled. Device responds with message when successful Cisco and/or its affiliates. All rights reserved. Cisco Public 26

23 What is Cisco Smart Licensing ID Tokens Used to securely Register products to a Smart Account and Virtual Account ID Tokens are organizational identifier used to establish identity when registering a Product An ID Token: Can be used once or reused multiple times Can be created and revoked at any time Expires after a period of time (default is 30 days; Minimum of 1 day and a maximum of 365 days) An ID Tokens is NOT: Product specific Licenses or keys or PAKs one-time use Stored on the Cisco Product Needed after the product is registered 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 27

24 Enable Smart Software Licensing Select: Inventory Click: New Token 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 28

25 Enable Smart Software Licensing Provide: ID Token Description Decide: Allow enablement of Export Controlled functionality (functionality varies by product) Note: Enabled by default if Export Control is allowed for this Smart Account 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 29

26 Register Product with Smart Account Paste the ID Token created in your Smart Account directly into the CLI csr1kv# license smart register idtoken <id token> license smart register: Registration process is in progress. Please check the syslog for the registration status and result 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 31

27 Smart Licensing Verification Verify licensing status csr1kv# show license status Tue Sep 29 07:34: PDT Smart Licensing is ENABLED Initial Registration: SUCCEEDED on Mon Sep :55:46 PDT Last Renewal Attempt: None Registration Expires: Sun Dec :49:40 PDT License Authorization: Status: AUTHORIZED on Mon Sep :56:10 PDT Last Communication Attempt: SUCCEEDED on Mon Sep :56:10 PDT Next Communication Attempt: Wed Oct :56:10 PDT Communication Deadline: Sun Dec :49:16 PDT csr1kv# 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 37

28 Show License All (ASAv) asa971# show license all Smart Licensing Status ====================== Smart Licensing is ENABLED Registration: Status: REGISTERED Smart Account: CISCO LIVE Virtual Account: JLN-Sat Export-Controlled Functionality: Allowed Initial Registration: SUCCEEDED on Feb 08 21:24: UTC Last Renewal Attempt: None Next Renewal Attempt: Mar 10 18:57: UTC Registration Expires: May 09 14:04: UTC License Authorization: Status: OUT OF COMPLIANCE on Feb 08 21:24: UTC Last Communication Attempt: SUCCESS on Feb 08 21:24: UTC Next Communication Attempt: Feb 09 09:24: UTC Communication Deadline: May 09 14:04: UTC License Usage ============== ASAv30 Standard - 2G (ASAv-STD-2G): Description: ASAv30 Standard - 2G Count: 1 Version: 1.0 Status: OUT OF COMPLIANCE Product Information =================== UDI: PID:ASAv,SN:9AJP2PTBH1L Agent Version ============= Smart Agent for Licensing: 1.6.4_rel/ Cisco and/or its affiliates. All rights reserved. Cisco Public 38

29 Understanding Product Licensing States

30 Smart License Product States Registered state Product has been associated with a valid Smart Account Authorized state Product is using an entitlement, and the Virtual Account does not have a negative balance Out of Compliance state Product is using an entitlement, but the Virtual Account has a negative balance Authorization expired state Product has not communicated with Cisco within a maximum of 90 days Note: Platforms may differ with timeouts, check with specific platform for details Remains in state until Product communicates with Cisco Authorization Expired Un- Registered Register Product Registered State Consume License Authorized State Failed Remains in state while Smart Account is OOC Out Of Compliance State 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 40

31 Smart License Product States Registered Initial registration 1. A Registration Message is sent when Product is registered via CLI with a valid ID Token. 2. Cisco will reply with a Cryptograph ID certificate that, by default, is valid for one year. If there is a failure sending the message the retry, interval will be as follows: Every 15 minutes for 4 hours. Then every hour until successful, or Smart License is disabled via CLI Un- Registered Register Product Registered State Consume License Failed Authorization Expired Authorized State Out Of Compliance State 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 41

32 Smart License Product States Licenses One a product has been successfully registered, it can be configured to use an licenses via CLI A Entitlement Message is sent when Product is configured to use licenses via CLI The Entitlement Response message will 1. Indicate if the Virtual Account is in or out of compliance 2. Provide the length of time the request is valid, and the renewal interval. By default the Licenses usage is valid for 90 days, and renewed every 30 days Authorization Expired Un- Registered Register Product Registered State Consume License Authorized State Failed Out Of Compliance State 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 42

33 Entitlement Authorization Request or Renewal If there is a communications failure sending the renewal, the retry interval will be as follows: If the agent is in the authorized state Retry every 23 hours If agent is in the Out of Compliance (OOC) state Retry every 15 minutes for two hours Then once every 4 hours. If agent is in the authorization expired state Retry once every hour. If there is NO communications within 90 days, License usage is released and available for use by other products Authorization Expired Un- Registered Register Product Registered State Consume License Authorized State Failed Out Of Compliance State 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 43

34 Registration ID Certificate Renewal By default the Cryptograph ID certificate Valid duration (one Year) and renewal period is sent in with the Registration Response message. The Cryptograph ID certificate Renewal will be sent every six months If there is a communications failure sending the message, the retry interval will be as follows: One per hour until success Or until Cryptograph ID certificate expires. If there is NO communications within 1 year Device become unregistered Device must be re-registered Use any remaining evaluation time Authorization Expired Un- Registered Register Product Registered State Consume License Authorized State Failed Out Of Compliance State 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 44

35 Go! Deploying: Smart License Enabled Products

36 Configure Smart Licensing for Direct Cloud Access Method 1

37 Smart Call Home High Level Smart Call Home (SCH) Server is located in a secure Cisco Data Centre Smart License (SL) messages reach SCH Server, they are sent to the Cisco SSM portal SL uses only the Call Home Client (Packet Delivery) Information is exchange using HTTPS (TLS/SSL encryption of data) Product Smart Smart Agent Call Home Client HTTPS Decision is made by the configuration of the SCH configured contact Smart License Smart Call Home Server Cisco Smart Software Manager Cisco Smart Call Home 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 48

38 Smart Call Home Cisco Example Configs Service Active Enable call-home service Contact- -addr < -address> Contact address is mandatory for sending SCH notifications. If it is configured as the address configured in Cisco Smart License Portal will be used Profile CiscoTAC-1 Call-home profile CiscoTAC-1 is configured to send Smart licensing message by default Active Enables profile to be used destination address http Configure HTTP destination address with service URL destination transport-method http Change transport method to HTTP (this includes HTTPS) Cisco and/or its affiliates. All rights reserved. Cisco Public 49

39 Smart Call Home Smart Licensing Only Smart License does not require ALL of Smart Call Home Smart Call Home reporting CAN be disabled Smart License only uses the Call Home Client (Packet Delivery) When Smart Call Home reporting on the Product is not used, contact- -addr must be configured as This is NOT an address it just looks like one Inventory is not sent Configuration information is not sent Environmental conditions is not sent Diagnostics to include syslog events is not sent 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 50

40 Smart Call Home Default CSR1000v Configuration service call-home call-home! If contact address in call-home is configured as the address configured in Cisco Smart License Portal will be used as contact address to send SCH notifications. contact- -addr rate-limit 20 alert-group-config snapshot data-privacy level normal syslog-throttling profile "CiscoTAC-1" active no anonymous-reporting-only reporting smart-call-home-data reporting smart-licensing-data destination preferred-msg-format xml destination message-size-limit destination transport-method http no destination transport-method destination address destination address http Automatically added on Smart License enablement. Do not change! Here is where you limit data sharing: data-privacy {level {normal high} hostname} reporting no-call-home-data Only hostname can be sent. Not all products support call home data sharing. Automatically added on Smart License enablement. Do not change! Note: No SCH sent by default. Authorized Backend Target 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 51

41 Proxy / Gateway Method 2

42 Transport Gateway or Proxy Is Not Required When Devices can send messages directly to cisco.com using HTTPS Encryption capabilities of all managed devices meet the customer's security requirements Devices can send messages directly to SSM satellite Is Required When Managed devices do not have direct access to cisco.com A HTTP proxy server is required to reach cisco.com Store and Forwarding of SCH messages Is Desirable When Needs to inspect traffic on the LAN while securely communicating over the Internet Needs all outbound traffic to be sourced from a single device 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 53

43 Deploying Transport Gateway Configuration Example Change HTTP destination address of CiscoTAC-1 profile to TG service URL. asr9k#conf t asr9k(config)#call-home asr9k(config-call-home)#profile CiscoTAC-1 asr9k(config-call-home-profile)#no destination address http asr9k(config-call-home-profile)#destination address http asr9k(config-call-home-profile)#commit asr9k(config-call-home-profile)#end asr9k# asr9k#show running-config call-home call-home profile CiscoTAC-1 destination address http NOTE: The default destination to cisco must be removed when configuring when using with proxy, TG, or satellite 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 54

44 Configure Smart Licensing for SSM satellite Method 3&4

45 Cisco Smart Software Manager Satellite Secure on-premise management of license consumption provided free of charge. Ideal for Customers whose Products are unable to reach Cisco.com directly Cisco Software Manager satellite (SSM satellite) Contains a subset of Smart Software Manager (SSM) portal, and works similar to SSM for management of installed products. Cisco devices and software products are registered with and report license consumption directly via SSM satellite Near real-time license usage information based on synchronization schedules with Smart Account Provided at no additional cost 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 56

46 Cisco Smart Software Manager satellite Secured HTTPS access to SSM satellite UI: User login to SSM satellite supports HTTPS transport only (Optional) Download Cisco Licensing Root CA Certificate for browser from: Automatic HTTPS communication from product instances to SSM satellite: Products communicating with SSM satellite via HTTPS do not need self-signed certificate Older Products (agent version prior to 1.5) using a 3-Tier certificate must wait 10 business days for Cert to be available Newer Products (agent version 1.5 and higher) can registered with no delay using a 4- Tier certificate. Agent version can be seen with show license all 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 59

47 Show License All (ASAv) asa971# show license all Smart Licensing Status ====================== Smart Licensing is ENABLED Registration: Status: REGISTERED Smart Account: CISCO LIVE Virtual Account: JLN-Sat Export-Controlled Functionality: Allowed Initial Registration: SUCCEEDED on Feb 08 21:24: UTC Last Renewal Attempt: None Next Renewal Attempt: Mar 10 18:57: UTC Registration Expires: May 09 14:04: UTC License Authorization: Status: OUT OF COMPLIANCE on Feb 08 21:24: UTC Last Communication Attempt: SUCCESS on Feb 08 21:24: UTC Next Communication Attempt: Feb 09 09:24: UTC Communication Deadline: May 09 14:04: UTC License Usage ============== ASAv30 Standard - 2G (ASAv-STD-2G): Description: ASAv30 Standard - 2G Count: 1 Version: 1.0 Status: OUT OF COMPLIANCE Product Information =================== UDI: PID:ASAv,SN:9AJP2PTBH1L Agent Version ============= Smart Agent for Licensing: 1.6.4_rel/ Cisco and/or its affiliates. All rights reserved. Cisco Public 60

48 Cisco Smart Software Manager Satellite At registration there are 2 files exchanged between SSM satellite and Cisco Registration file (SSM satellite Cisco) Authorization file (Cisco SSM satellite) During normal operation, there are 2 different files exchanged between SSM satellite and Cisco Sync Request file (SSM satellite Cisco) Sync Response file (Cisco SSM satellite) Auditable data sent by SSM satellite Information is in Text (YAML formatted) You have the ability to inspect the data gathered! 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 62

49 Smart Call Home Satellite Example Configs Service Active Enable call-home service Contact- -addr < -address> Contact address is mandatory for sending SCH notifications. If it is configured as the address configured in Cisco Smart License Portal will be used Profile CiscoTAC-1 Call-home profile CiscoTAC-1 is configured to send Smart licensing message by default Active Enables profile to be used destination address http Configure HTTP destination address with service URL destination transport-method http Change transport method to HTTP (this includes HTTPS) 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 69

50 SSM Satellite Synchronization SSM satellite should synchronize with Cisco every 30 days Automatic if Network Attached By manual file transfers in disconnected Mode SSM satellite must synchronize with Cisco within 89 days. After 89 days without synchronization; MUST be reinstalled using a NEW instance of SSM satellite All product instances are removed All ID Tokens are expired Products will not be able to communicate with SSM satellite Products will need to be re-registered 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 70

51 CSSM satellite HA Deployment Configurations Active Standby Zabbix Tomcat satellite MariaDB DRDB Pacemaker Corosync Zabbix Tomcat satellite MariaDB DRDB Pacemaker Corosync Internet DNS Server XProxy Firewall (NAT) IPv4 (or IPv6) Management Network CSR1kv CSR1kv CSR1kv CSR1kv CSR1kv CSR1kv CSR1kv CSR1kv CSR1kv CSR1kv 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 72

52 High Availably Deployment Procedures Install Active satellite and register as normal Install Standby satellite but do not register (JUST configure the IP address) Go to active satellite, click High Availability tab Enter IP address of standby Enter VIP (Virtual IP address address) used to access satellite Once configured, satellite Connects to standby automatically Configures standby Replicates the database to standby (may take some time) There is an indication that standby is ready Cisco and/or its affiliates. All rights reserved. Cisco Public 73

53 CSSM satellite HA Active Passive DB Pacemaker Active satellite Zabbix Pacemaker is an open source cluster resource manager which coordinates resources and services in a HA cluster. In essence, Corosync enables servers to communicate as a cluster, while Pacemaker provides the ability to control how the cluster behaves. DB satellite Pacemaker Standby Zabbix vswitch VMware ESXi VIP Address Service Address Satellite Services Tomcat MariaDB Zabbix DRBD Sync Tomcat MariaDB Zabbix DRBD DRBD Master Standby vswitch VMware ESXi Resource Monitor Cluster Manager Pacemaker Corosync 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 74

54 CSSM satellite HA Active Passive Active Standby Zabbix Tomcat satellite MariaDB DRDB Pacemaker Corosync Corosync - Messaging layer which enables servers to communicate as a cluster, Pacemaker is an open source cluster resource manager (CRM) Tomcat is an open source Java Servlet Container MariaDB is an open source Relational Database Management System (RDBMS) DRBD software is a distributed replicated storage system for the Linux platform. Zabbix is an open source monitoring solution designed to monitor and track the status of various services Zabbix Tomcat satellite MariaDB DRDB Pacemaker Corosync 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 75

55 CSSM satellite HA Resource Monitoring VIP Address Service Address Satellite Services Tomcat MariaDB Zabbix DRBD Sync Tomcat MariaDB Zabbix DRBD DRBD Master Standby Tomcat Corosync Pacemaker Zabbix Resource Monitor Pacemaker DRBD MariaDB Cluster Manager Corosync * Cisco and/or its affiliates. All rights reserved. Cisco Public 76

56 CSSM satellite HA Data Replication File system File system VIP Address Service Address DRBD (module) DRBD (module) Satellite Services Tomcat MariaDB Zabbix DRBD Tomcat MariaDB Zabbix DRBD Sync DRBD Master Standby TCP NIC driver Block Driver Block Driver TCP NIC driver Resource Monitor Cluster Manager Pacemaker Corosync Replicated Volume 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 77

57 CSSM satellite HA Setup 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 79

58 Permanent License Reservation Method 5

59 Universal Permanent License Reservation Manually exchange short ASCII strings with the CSSM Two way data exchange via ASCII strings Product Request (UDI/vUDI, etc.) entered into CSSM (~ 32 characters*) CSSM performs a validity check CSSM returns an authorization locked to UDI/vUDI (34 characters) Entitles unlimited license consumption on product CSSM 2 1 Get UDI/vUDI Request Type UDI/vUDI Request 4 Type Auth String Get Auth String 3 Length will vary by product 31 for new version of ASAv 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 81

60 Specific Permanent License Reservation Manually exchange information (copy and paste) with the CSSM Two way data exchange via ASCII strings Product Request (UDI/vUDI, etc.) entered into CSSM (~ 32 characters*) Requested licenses and quantities chosen in CSSM CSSM performs a validity check CSSM returns an authorization locked to UDI/vUDI (34 characters) CSSM Entitles unlimited license consumption on product 1 Get UDI/vUDI Request 2 Type or Paste Request String 3 Choose Licenses 5 Paste Auth String 4 Copy Auth String * Length will vary by product 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 83

61 Determining the best Method to Use Method 1 & 2 Device has Direct Network Access Simplest to Deploy and Use Method 3 & 4 Device has Intermediate Network Access One line change to Product Configuration Method 5 Device has No Network Access Similar to PAK Files Cisco Product HTTPs Transport Gateway or HTTPs Proxy Cisco Product HTTPs Smart Software Cisco Product Manager satellite Request License Copy/Paste License Response Cisco Product Cisco.com Cisco.com Cisco.com Cisco.com Your Cisco Software Usage Your Cisco Software Usage Your Cisco Software Usage Your Cisco Software Usage 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 85

62 Conclusion

63 Conclusion Get Ready! Create your company s Smart Account TODAY! Check out your Smart Accounts at Get Set! Review 5 Methods to meet your deployment needs Upgrade to product versions with 4-Tier Smart License support Go! Mediated deployment methods using Smart Software Manager satellite Completely Offline mode using PLR 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 87

64 Q & A

65 For More Information Cisco SSM Satellite Cisco Smart Licensing ( Cisco Smart Software Manager ( Cisco Smart Accounts ( Cisco and/or its affiliates. All rights reserved. Cisco Public 89

66 For More Information Cisco Smart Call Home For more Information on Cisco Smart Call Home Smart Call Home Cisco Privacy and Security Compliance For more Information on Cisco Transport Gateway User Guide Troubleshooting Guide Cisco and/or its affiliates. All rights reserved. Cisco Public 90

67 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot# 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

68 Please complete your Online Session Evaluations after each session Complete 4 Session Evaluations & the Overall Conference Evaluation (available from Thursday) to receive your Cisco Live T-shirt All surveys can be completed via the Cisco Live Mobile App or the Communication Stations Complete Your Online Session Evaluation Don t forget: Cisco Live sessions will be available for viewing on-demand after the event at Cisco and/or its affiliates. All rights reserved. Cisco Public

69 Continue Your Education Demos in the Cisco campus Walk-in Self-Paced Labs Tech Circle Meet the Engineer 1:1 meetings Related sessions 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 93

70 Thank you

71