Smart Licensing Overview and Best Practices for Cisco Email and Web Security (ESA, WSA, SMA)
Introduction
This document describes the activation process, definitions, and troubleshooting of the Smart Licensing Service on ESA/SMA/WSA.
Prerequisites
Components Used
The information in this document is based on these software and hardware versions:
- Email Security Appliance (ESA) AsyncOS Version 12.0 and newer.
- Security Management Appliance (SMA) AsyncOS Version 12.0 and newer.
- Web Security Appliance (WSA) AsyncOS Version 11.7 and newer
Note: Enabling the Smart License Feature on the ESA/SMA/WSA is Permanent and does not permit the option to revert an appliance back to Classic License Mode.
Background Information
Smart Licensing Provides the ability to:
- Manage all of your product licensing from a central location
- Normalizes the process between Physical a Virtual ESA/SMA/WSA, using 1 method to apply and manage licenses
- Easily apply a license to your ESA/SMA/WSA
- Receive Alerts related to license expiration
- Hardware model ESA/SMA/WSA, out of the box, have a 90 day Evaluation Period for all services
Summary of the Smart License Global Topic from Cisco
Even though the core purpose of this article is to configure the Smart Licensing Services on the ESA/SMA/WSA, we have included links below to provide general direction to educate on the topic.
Registering the ESA/SMA/WSA host with smart licensing first requires the owner of the appliance to possess a Smart Account.
- Smart Accounts are issued one per domain.
- The administrator of the Smart Account can create sub-level Virtual Accounts allowing segregation of resources.
- Virtual Accounts may be used to restrict access to different Cisco Product Licenses based on customer needs.
- Customers access the Cisco Smart Software Manager (CSSM) to manage licenses and download TOKENS
Description of the CSSM tool and the tabs.
A basic illustration of the CSSM Tabs
General Tab
- The location to generate the token (the token is time-based and may be used to register multiple ESA/SMA/WSA
- Ensure the proper “Virtual Account:” has been selected as a customer may have multiple virtual accounts
- New Token, will open a template to complete and results in a “Token,” line entry in the table
- Actions can be executed repeatedly as needed and will display options to; Copy, Download, Revoke the token
Licenses Tab
- The location to review and confirm the presence and availability of licenses
- The License column lists the names of the services or bundles purchased
- The Purchased column lists the presence of usable keys
- The Alerts column displays important messages regarding a specific license
Product Instances Tab
- Displays the individual appliance names, models, last communication, and Alerts
Generate a Token from CSSM
- Launch the CSSM webpage
o Cisco Smart Software Manager (CSSM)( https://software.cisco.com/#module/SmartLicensing)
- Top of page, select Inventory
o Once loaded, select the appropriate “Virtual Account:” from the top left portion of the page
o A large organization may have multiple virtual accounts assigned to a single smart account, requiring a selection of the appropriate virtual account related to the ESA/SMA/WSA licenses
o Tabs: General, Licenses, Product Instances, Event Log
- Generate a Token from CSSM
o Select the “General,” tab
o Just below the heading, “Product Instance Registration Tokens,” select the button, “New Token”
o A window will appear to complete the “Description,” and “Expire After,” values
o Create a Token
o Returning to the General Tab, select the “Actions,” drop-down tab to copy or download the token
Enable the Smart License feature on the ESA/SMA/WSA
- Web UI activation
- Browse to System Administration > Smart Software Licensing
- Select Enable Smart Software Licensing
- Options are listed providing the choices to request feature keys:
o Option 1: Use a token to register and request needed features
o Option 2: Register without a token and have a 90 day Evaluation Period
- Select OK
- Commit Changes
- CLI activation:
- Execute command license_smart > Enable > Y
- Option 1 and Option 2 will be listed the same as the above UI description
- Select OK
- Commit
Register the ESA/SMA/WSA to a Smart Account using the Token.
- Navigate to System Administration > Smart Software Licensing
- Select the “Register” button to open the pop-up registration page
- Paste the copied token in the space provided below step 4
- Select “Register” to complete the steps (The pop-up window will close)
- Refresh the “Smart Software Licensing” page after 30 seconds to view the new status
- Once completed the “Registration Status” field will present the word “Registered” along with the registration expiration dates
