How Enforcement Works: Smart Licensing Using Policy

Every Catalyst 8200/8300 running IOS XE 17.3.2 or later licenses under Smart Licensing Using Policy (SLP), the model that governs how these routers boot, what they enforce, and when they must talk to Cisco. Understanding SLP is the difference between treating licensing as a procurement afterthought and designing it as an operational control — because on Gen 2 edge routers, the one thing SLP actually enforces up front is the HSECK9 crypto throughput gate.

SLP vs. Legacy Smart Licensing

SLP (also written SLUP) became the default on Catalyst 8000, ISR 1000/4000, and ASR 1000 platforms starting with IOS XE Amsterdam 17.3.2. It is a deliberate inversion of the day-0 friction that defined traditional Smart Licensing.

Legacy Smart Licensing required per-device registration to CSSM using a registration token, mandatory evaluation mode until licensing was established, ongoing ~30-day cloud reporting, and effectively continuous reachability to CSSM via Call Home/Smart transport. SLP removes all of that for the common case:

• No registration token. There is no per-product software registration step.
• No evaluation mode. The device boots directly with feature capabilities enabled. Compliance is managed after the fact through reporting, not through up-front authorization.
• No mandatory continuous connectivity. SLP establishes a trust relationship once, then supports fully offline operation. The exception is post-paid utility (MSLA) licenses, which must report and install an ACK every 30 days.

The architectural shift: legacy SL authorized each license request as a pre-use activity. SLP uses policy-based reporting — the device uses licenses immediately and RUM reports serve as proof of usage submitted to CSSM per a policy. This is honor-based compliance for everything except export-controlled licenses.

CSSM, Smart Accounts, and Virtual Accounts

Cisco Smart Software Manager (CSSM), at software.cisco.com, is the cloud portal where entitlements live. It is where you manage accounts, hold license inventory, generate ID tokens, generate SLAC for export-controlled licenses, and receive and acknowledge RUM reports.

The account hierarchy matters for procurement governance:

• Smart Account — the customer's single top-level account in CSSM.
• Virtual Account — sub-divisions (by organization, region, or function) that hold purchased entitlements and to which product instances and their usage are attributed.

A product instance is the router itself. Its usage draws against entitlements in whatever Virtual Account it reports to, so Virtual Account design directly determines how license consumption is tracked and charged back.

Honor-Based Enforcement and the Three License Types

SLP defines three enforcement categories. Knowing which bucket a license falls into tells you exactly how much friction it imposes.

The overwhelming majority of Catalyst 8200/8300 licenses — DNA/network tiers and throughput up to 250 Mbps — are honor-based. The device uses them and reports usage; nothing blocks boot or feature enablement. The one license that SLP actually enforces up front on these platforms is HSECK9, covered below.

RUM Reports and Trust Codes

Compliance under SLP is tracked through Resource Utilization Measurement (RUM) reports: timestamped records of license usage and all usage changes that the product instance generates and signs.

• RUM report — captures usage; the device's policy determines whether it must be sent, by when, and whether an acknowledgment is required.
• RUM ACK — CSSM's signed response confirming receipt. When policy requires it, the ACK is installed back on the device to close the reporting loop.
• Trust code — a UDI-tied public key that lets the device sign RUM reports and communicate securely with CSSM. A factory-installed trust code may exist but cannot be used for CSSM communication; a usable trust code comes from CSSM. From IOS XE Cupertino 17.7.1a, the RUM report automatically embeds a trust code request if none exists, and the returned ACK installs it, overwriting the factory code.

The policy itself sets four attributes: whether an ACK is required, the first-report deadline (days), reporting frequency (days), and the report-on-change deadline (days). From 17.9.1a, reporting is throttled to at most one report per day.

Figure 2.1: RUM Report and ACK Message Flow

sequenceDiagram
    participant Router as Router (product instance)
    participant CSLU
    participant CSSM
    Router->>Router: Record usage, sign RUM report
    Router->>CSLU: Send signed RUM report (+ trust code request)
    CSLU->>CSSM: Forward RUM report
    CSSM->>CSSM: Validate usage, generate ACK
    CSSM-->>CSLU: Signed RUM ACK (carries trust code)
    CSLU-->>Router: Deliver RUM ACK
    Router->>Router: Install ACK and trust code

! establish trust directly with CSSM using an ID token generated in the portal
license smart trust idtoken <token> local

! inspect full licensing state, policy, usage, and trust status
show license all
show license status
show license usage

HSECK9 and Export-Control Enforcement

HSECK9 is the High Security license, export-controlled under U.S. trade law and available only in non-embargoed countries. It authorizes full cryptographic functionality and throughput above 250 Mbps. One HSECK9 is required per chassis UDI.

On Catalyst 8200/8300 the 250 Mbps line is the hard enforcement boundary:

• Throughput up to and including 250 Mbps (tiers T0/T1) needs no HSECK9.
• Throughput greater than 250 Mbps requires HSECK9 plus an installed SLAC.
• Without HSECK9, crypto is throttled to 250 Mbps per direction and tunnel count is capped (documented up to 1000 tunnels).

Note the tier interaction introduced in 17.7.1a: T1 bundles HSECK9 in the order; T2 and above require a separate HSECK9 plus SLAC installation. The Catalyst 8500/8500L are exempt from the throughput/tunnel limitation — there HSECK9 is compliance-only.

A Smart Licensing Authorization Code (SLAC) must be installed before configuring throughput above 250 Mbps. On C8200/C8300 the post-SLAC sequence is explicit: enable the feature, set throughput, then reload.

! connected: request SLAC from CSSM (directly or via CSLU/SSM On-Prem/controller)
license smart authorization request add hseck9 local

! after SLAC is installed, enable the export-controlled crypto feature
license feature hseck9

! set throughput by numeric value or tier, then reload to apply
platform hardware throughput crypto T2
show platform hardware throughput crypto

Reporting Topologies, Including Offline / Air-Gapped

SLP supports multiple reporting topologies. The choice is driven by connectivity posture and whether a controller already manages the fleet.

Two behaviors are worth flagging for architects. With vManage, reporting is fixed at 24-hour intervals and the device does not store usage or generate its own RUM reports — but HSECK9 SLAC still must be requested and installed via CLI on the device. With DNA Center, RUM reports are pulled via NETCONF and an ad-hoc report must run at least once before scheduled reporting begins.

For genuinely air-gapped networks, SLP is fully supported without ever connecting the router to Cisco: RUM reports and SLAC requests are exported as signed files, carried to CSSM out of band, and the ACK/authorization file imported back (Topologies 4 and 5). From 17.7.1a this includes generating a SLAC request file on the device itself, uploading it to CSSM, and installing the returned authorization — no manual data entry in CSSM required.

Figure 2.2: Choosing a Reporting Topology

flowchart TD
    A["Is the fleet already under a controller?"] -->|Yes| B["Through a controller (vManage / DNA Center)"]
    A -->|No| C["Does the device reach CSSM directly?"]
    C -->|Yes| D["Direct to CSSM (Smart transport / Call Home)"]
    C -->|No| E["Use a local aggregator?"]
    E -->|"CSLU (connected)"| F["Through CSLU to CSSM"]
    E -->|"CSLU (air-gapped)"| G["CSLU disconnected (signed XML files)"]
    E -->|SSM On-Prem| H["SSM On-Prem (push/pull) to CSSM"]
    E -->|No intermediary| I["Offline SLAC/RUM files, manual upload"]

! air-gapped RUM export/import cycle (Topology 5)
license smart save usage all file bootflash:rum-report.xml
! ...upload rum-report.xml to CSSM, download the ACK...
license smart import bootflash:ack.xml

! offline SLAC request for HSECK9 (17.7.1a+)
license smart authorization request add hseck9 local
license smart authorization request save bootflash:slac-request.xml
! ...upload to CSSM, download authorization file, then...
license smart import bootflash:slac-auth.xml

Figure 2.3: The 250 Mbps Export-Control Gate

flowchart TD
    A["Configure crypto throughput"] --> B{"Throughput greater than 250 Mbps?"}
    B -->|No| C["Tiers T0/T1, up to 250 Mbps"]
    C --> D["Honor-based: no HSECK9, use then report"]
    B -->|Yes| E["Tier T2 and above"]
    E --> F{"HSECK9 plus installed SLAC?"}
    F -->|No| G["Crypto throttled to 250 Mbps per direction, tunnels capped"]
    F -->|Yes| H["Enable hseck9, set throughput, reload"]
    H --> I["Full crypto and throughput above 250 Mbps"]

References

• How Smart Licensing Using Policy Works
• Smart Licensing Using Policy — Information About
• Configure Smart Licensing Using Policy on IOS XE
• Configure Licenses and Throughput on Catalyst 8000 Platforms
• Compare Traditional Licensing and Smart Licensing
• Smart Licensing Using Policy Overview
• Smart Licensing Using Policy FAQ (PDF)
• Managing HSEC Licenses in Cisco Catalyst SD-WAN (PDF)
• Cisco Licensing Guide