Smart Licensing Using Policy (SLUP) is the licensing framework for Cisco Catalyst 9800 Series Wireless Controllers and Cisco Embedded Wireless Controllers (EWC-AP) on Catalyst 9100 Access Points. Instead of enforcing licenses via authorization codes before use, SLUP operates on a compliance reporting model. It records consumption locally and requires periodic reporting to the Cisco Smart Software Manager (CSSM).

This guide provides step-by-step instructions to configure Smart Licensing on Catalyst 9800 platforms based on your network environment, verify the deployment, and troubleshoot common issues.

1. Supported Platforms & License Types

Supported Platforms:
– Cisco Catalyst 9800-40, 9800-80, 9800-L
– Cisco Catalyst 9800-CL (Private/Public Cloud)
– Cisco Embedded Wireless Controller (EWC-AP)

License Levels:
Wireless licenses are unenforced and do not require authorization before use. The principal license families are:
– AIR Network Essentials / Advantage: Base network entitlement (Perpetual).
– AIR DNA Essentials / Advantage: DNA add-on capabilities (Subscription).

To set your license level (requires a reload to take effect):

WLC(config)# license air level air-network-advantage addon air-dna-advantage

2. Prerequisites

Before configuring Smart Licensing, ensure the following requirements are met:
1. Smart Account & Virtual Account: You must have an active Cisco Smart Account with the purchased licenses deposited into the correct Virtual Account.
2. System Time: The controller’s clock must be accurate for cryptographic certificate validation. Ensure NTP is configured.
3. ID Token: If connecting directly to CSSM, generate a registration token from your Cisco Smart Software Manager portal.
4. Network Reachability: If connecting directly, the controller must be able to resolve Cisco domains and reach CSSM over TCP port 443.

3. Configuration Scenarios

Select the reporting topology that best fits your network’s security policies.

Scenario A: Direct Connection to CSSM (Recommended)

This is the most common deployment where the Catalyst 9800 communicates directly with the Cisco cloud over the internet.

Step 1: Configure Network Prerequisites (DNS and Source Interface)
The controller must be able to resolve smartreceiver.cisco.com.

! Configure DNS resolution
WLC(config)# ip domain lookup
WLC(config)# ip name-server 8.8.8.8 8.8.4.4

! Specify the source interface for licensing traffic (e.g., VLAN 10)
WLC(config)# ip http client source-interface Vlan10

Step 2: Configure Smart Transport
Set the transport mode to “smart” (default) to communicate with CSSM.

WLC(config)# license smart transport smart
WLC(config)# license smart url default

(Optional) If using an HTTP proxy to reach the internet:

WLC(config)# ip http client proxy-server <proxy-ip> proxy-port <port>

Step 3: Establish Trust (Import ID Token)
Obtain the ID Token from your CSSM portal and apply it to the controller to establish a trusted connection.

! Execute in privileged EXEC mode
WLC# license smart trust idtoken <YOUR_ID_TOKEN> local force

Scenario B: Connection via CSLU (Centralized On-Premises)

The Cisco Smart License Utility (CSLU) is a Windows/Linux-based intermediary. Use this if your security policy prohibits controllers from accessing the internet directly.

Step 1: Set Transport to CSLU

WLC(config)# license smart transport cslu

Step 2: Define the CSLU URL
If your CSLU server IP is 192.168.100.50:

WLC(config)# license smart url cslu http://192.168.100.50:8182/cslu/v1/pi

Note: In this mode, the controller will automatically push usage reports to the CSLU server, which then synchronizes with CSSM.

Scenario C: Air-Gapped / Offline Deployment

For highly secure, isolated networks with absolutely no external connectivity, you must use the offline manual file transfer method.

Step 1: Disable Transport

WLC(config)# license smart transport off

Step 2: Generate RUM (Resource Utilization Measurement) Report
Save the usage data to a text file on the bootflash:

WLC# license smart save usage all file bootflash:all_rum.txt

Step 3: Export and Import
1. Copy all_rum.txt off the controller via TFTP/SFTP to your workstation.
2. Upload the file manually to the CSSM portal.
3. Download the Acknowledgment (ACK) file from CSSM.
4. Upload the ACK file back to the controller’s bootflash and apply it:

WLC# license smart import bootflash:ack_file.txt

4. Verification

After configuration, verify the license status and communication health.

Check Overall License Status:

WLC# show license status
  • Expected Output for Direct CSSM: Look for Trust Code Installed: <Date> and Last ACK received: <Date>.

Check License Usage:

WLC# show license summary
  • Ensure your licenses (e.g., air-network-advantage) show as IN USE.

Verify RUM Report Status:

WLC# show license rum feature all

5. Troubleshooting

If you encounter issues during configuration, use the following scenarios and commands to isolate the problem.

Issue: Trust Code Installation Fails

Symptoms: Running the license smart trust idtoken command results in a crypto or SSL error.
Root Cause: The controller’s system time is incorrect, causing the CSSM HTTPS certificate validation to fail.
Resolution: Verify the clock using show clock. Configure an NTP server to sync the time accurately.

WLC(config)# ntp server <ntp-server-ip>

Issue: RUM Reports stuck in “PENDING” or “UNACK”

Symptoms: show license status indicates that reports are failing to send.
Root Cause: Network connectivity issues, DNS failure, or firewall blocking port 443.
Resolution:
1. Verify DNS: ping smartreceiver.cisco.com
2. Verify routing: Ensure the configured ip http client source-interface has a valid route to the internet.
3. Check detailed infrastructure logs for HTTP errors (e.g., Timeout, 404, 403):

WLC# show license history message
WLC# show platform software sl-infra all

9800-CL Specific Warning: Access Point Join Limit

If you are deploying a virtual Catalyst 9800-CL, you must complete a successful RUM report and receive an ACK from CSSM at least once. If the first ACK is not received, the controller will eventually limit the maximum number of joined Access Points to 50. Monitor the acknowledgment window using:

WLC# show license air entities summary

Ensure the “License Ack expected within” timer does not expire before resolving network connectivity to CSSM.