THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.
|Affected OS Type
|Affected Software Product
|Affected Release Number
AsyncOS for ESA
12.0.0, 12.1.0, 12.5.0
AsyncOS for Content Security Management Appliance (SMA)
12.0.0, 12.0.1, 12.5.0
AsyncOS for WSA
11.7.0, 11.7.1, 11.8.0, 11.8.0(refresh)
|Virtual ESA/WSA/SMA Updates/Upgrades will fail after SL migration if XML <end_date> expires.
Smart License enabled virtual Cisco Content Security products might be unable to authenticate with the updates and upgrades server when the Smart Licenses or the traditional license (XML) file expires. As a result, the updates and upgrades will fail.
Smart License enabled virtual Cisco Content Security products still rely on the certificate distributed in the traditional license (XML) file to receive updates and upgrades. The license file expires at the same time the Smart Licenses go Out of Compliance (OOC). Once the license (XML) file expires, the appliance will not be able to authenticate with the updates and upgrades server to receive the updates and upgrades.
Early alerts will be generated before the licenses go OOC. Administrators are expected to download and apply the renewed or temporary license (XML) file, after which the updates and upgrades will go smoothly.
This issue affects any AsyncOS version with Smart License support:
- AsyncOS for Web Security Appliance (WSA) Version 11.7.x and later
- AsyncOS for Email Security Appliance (ESA) Version 12.x and later
- AsyncOS for Security Management Appliance (SMA) Version 12.x and later
The Cisco Content Security products will not be able to retrieve updates for the engines. The image upgrades will fail with this error:
"Dynamic manifest fetch failure: Failed to authenticate with manifest server"
Administrators are expected to raise a request to renew their licenses. Once they receive the new PAK file, they should download the renewed license (XML) file and then convert their licenses to Smart Licenses. The license file should be installed on the appliance, after which the updates and upgrades will go smoothly.
Alternately, contact the Cisco Systems Technical Assistance Center (TAC) in order to obtain a temporary license file from the Global Licensing team.
For More Information
If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:
Receive Email Notification For New Field Notices
My Notifications—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.