Catalyst 9000 Smart Licensing Troubleshooting: SLP and CSSM

Smart Licensing Using Policy (SLP) is deliberately non-blocking: most Catalyst 9000 licenses are unenforced, and the device keeps working while you fix the reporting path. That design is a trap for operations teams, because a device can run for months with a broken trust relationship and only surface it during an audit or an export-controlled feature change. This runbook maps the syslog messages you will actually see to the commands that resolve them.

Start with the state, not the alarm

Switch# show license status
Switch# show license all
Switch# show license udi
Switch# show license tech support
Switch# show license history message

In show license all, check three fields: the transport type (smart, cslu, or off), the URL (https://smartreceiver.cisco.com/licservice/license for smart transport on 17.3.2 and later), and the timestamps for Last report push and Last ACK received. In show license tech support, the Failure Reason: field is the single most useful line in the whole troubleshooting exercise.

The four failure signatures

1. %SMART_LIC-3-COMM_FAILED — cannot reach CSSM

Troubleshoot in this order: DNS resolution of smartreceiver.cisco.com (for pre-17.3.2, tools.cisco.com), routing to the internet or to the proxy, the HTTPS client source interface (show ip http client), and the proxy configuration (license smart proxy address / license smart proxy port). If communication must happen in a specific VRF, bind the source interface explicitly.

show license status | include Transport|URL|Proxy
ping smartreceiver.cisco.com
show ip http client
debug ip http client
debug ssl openssl states
debug ssl openssl errors

2. Trust establishment fails

Generate an ID token in the Smart Software Manager virtual account and install it with forced overwrite when a factory or stale token exists:

Switch(config)# license smart transport smart
Switch(config)# license smart url default
Switch# license smart trust idtoken <TOKEN> all force
Switch# show license status | include Trust

3. Timestamp / signature mismatch

This is a clock problem, not a licensing problem. If the device clock is wrong, signed messages are rejected and requests never appear in the CSSM view. Configure NTP, then re-check that the Clock sync-ed with NTP field reads True in the tech-support output before retrying.

Switch(config)# ntp server 10.10.10.1
Switch# show ntp status
Switch# show license tech support | include "Clock sync-ed"

4. UDI mismatch / not enough authorization

Authentication code (SLAC) failures on stacked or HA systems are almost always UDI mismatches: every UDI listed in the file must match every UDI in the stack or HA pair. Compare show license udi on all members with the file before installing, and remember that the active device can install codes for standbys and members.

Forcing convergence and resetting

Switch# license smart sync all
Switch# license smart save usage all file flash:all_rum.txt
Switch# license smart factory reset      ! removes all licensing info, requires reload

Air-gapped sites use license smart save usage to produce a RUM report file for upload on an internet-connected workstation; the ACK that comes back is installed on the device. Product-initiated communication is throttled to one report per day, which is why license smart sync exists — use it when you need the ACK now. Reserve license smart factory reset for cases where the trust code itself is corrupt: it wipes all licensing state including the policy and forces a reload.

Related reading: IOS-XE install mode upgrades, IOS NTP configuration and Catalyst 9300 StackWise versus StackWise Virtual.

原文链接：https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst_9000/b_smart-licensing-using-policy-cat9k-switches/cat9k-troubleshooting-smart-licensing-using-policy.html