Implement 9800 Wireless LAN Controller Licenses: FAQs

Introduction

This document describes the licensing model used on 9800 Wireless LAN Controllers (WLCs) collected on 9800-CL WLC: 17.2.1 image.

Background information

This article explains the concept of licensing model used on 9800 Wireless LAN Controllers (WLCs).

Screenshots and command outputs are collected on 9800-CL WLC with 17.2.1 image.

This article is complementary to the licensing FAQ already present at https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/nb-06-cat9800-ser-wirel-faq-ctp-en.html#CiscoCatalyst9800SeriesWirelessControllerlicensing

Note: This article does not cover Smart Licensing Using Policy (SLUP) which was introduced in code version 17.3.2. Questions answered in this article are relevant for the Catalyst 9800 WLC versions <17.3.2.

Q. Do I need to license the 9800 controller itself?

A. No. Like on older AireOS based controllers, there is no special license for the 9800 controller itself (if no access points are joined to it).

You only need to license the Access Points that are joined to the controller.

However, it is the controller which communicates with Smart Licensing and it is the controller that verifies the licensing of all the joined access points.

Q. Which license do I need for Access Points that are joined to my 9800 WLC?

A.Every AP joined to 9800 controller consumes one (1) AIR Network License and one (1) AIR DNA License.

Once purchased, these licenses show up in your smart account which can be accessed HERE.

Both of these licenses can be configured to be either Essential or Advantage level. Example of a controller configured with advantage level license:

Q. Can I mix different licensing levels for the access points connected to the same Cisco Catalyst 9800 Series controller?

A. A 9800 series controller requires all access points connected to that controller to have the same license level.

Because the license level is set up at the controller level, the access points connected to the controller have to be at the same license level.

Q. What features are covered by Advantage and Essential license level?

A. This image specifies features covered by Essential and Advantage license level:

Q. Is reboot required after the change of license level?

A.Yes

Q. Is it really mandatory to license all the access points joined to the 9800 controller?

A. Yes, Cisco retains the right to conduct audits to check license compliance.

Q. Is there license enforcement on 9800 WLC?

A.No. If improperly licensed, 9800 WLC displays out-of-compliance notifications and sends syslog messages.

There is no hard enforcement and no impact on any of the functionalities.If your license expires, your network also keeps functionning.

Q. What is evaluation license and how long does it last?

A.Evaluation license allows you to use all 9800 controller functionalities for 90 days.

When the evaluations period expires, syslog messages and notifications appear and ask you to properly license your controller.

These messages do not affect 9800 functionalities. When the evaluation expires, it cannot be reset.

Q. Where do I download the .lic license file?

A. There are no licensing files for 9800. 9800 WLCs rely purely on Smart Licensing which requires no license file (but does not necessarily require an internet connection either).

Q. How can I get my 9800 controller licensed?

A.There are 3 ways to get 9800 WLC licensed:

1. Use CSSM (controller requires internet connection)
2. Use SLR (Specific License Reservation, known as offline licensing)
3. On-premises satellite server
   

Q. How does licensing via Smart Satellite work?

A. All versions of on-premises smart satellite are supported on 9800 Cisco IOS® XE releases 16.11 and lower.

For Cisco IOS® XE 16.12 and 17.x releases (and higher), it is mandatory to use Satellite Version 8 Release 202008 or later.

If you try to use 9800 16.12.x or 17.x with any version of satelite before Version 8 Release 202008, you get "Cisco bug ID CSCvr54020 - Licenses show as "PENDING" when using CSSM Satellite"

Q. How does CSSM licensing work?

A.Licensing 9800 WLC with Cisco Smart Software Manager requires your controller to have a functional DNS server and access to tools.cisco.com via http and https.

Once configured, your controller establishes connection with the smart licensing servers and occasionally reports license consumption to the server (every eight (8) hours).

The WLC can be placed behind NAT and is not required to have a public IP address. It is possible to specify which physical interface is used to communicate with the smart licensing servers.

Use of http(s) proxy is also allowed. As of publication of this article (code release 17.2.1), authenticated proxies are not supported

Q. How does CSSM licensing work with controllers in High Availability (HA) SSO?

A. Licensing procedure is almost identical to the single controller setup.

Once HA has been established between the 2 controllers, simply navigate to the licensing page in the web interface and follow the configuration prompt.

All configuration is synchronised between the primary and secondary controller.

Q. How does CSSM licensing work with controllers in N+1 HA?

A. N+1 HA refers to a setup where one WLC has all APs joined to it while the other is on standby. If the main controller goes down or becomes unreachable, all APs join the standby one.

In this case, simply connect both controllers to the smart licensing servers. If failover happens, the licenses show up on your smart account as "consumed" by the standby controller.

It requires up to eight (8) hours for this change to be reflected.

Q. How do I license my 9800 WLC offline, without internet access?

A. If access to the internet is not available, a 9800 WLC can be licensed offline with Specific License Reservation (SLR).

By default, the option of License Reservation is not available in smart accounts. License Reservation feature can be found in the Smart License Inventory under the Virtual Account > Licenses tab:

If this option is not available in your smart account, contact sa-adoptionsupport@external.cisco.com and ask to have License Reservation feature enabled.

Q. How does offline licensing work in HA SSO setups?

A. SLR can be done before or after HA is established. You have to spread the total license count between the two controllers.

For example, if the total AP count is 100, reserve 50 licenses for both primary and secondary controller.

It is not mandatory for each controller to have exactly one half of the AP licenses (could be 60%-40% as well).

HA setup is properly licensed as long as both primary and secondary WLC have at least one AP license. The WLCs then add up their license counts between each other.

Q. How does offline licensing (SLR) work in HA N+1 setups?

A. When N+1 HA runs with SLR, it is required to purchase additional set of licenses for every AP and reserve them on standby controller.

This means licensing twice the AP count. It is also possible to not license the N+1 WLC if you keep it just for failover scenarios and therefore rely on the evaluation license and that there is no enforcement if the number of APs is breached.

Q. Can I move licenses between two 9800 controllers?

A.  Yes. One of the benefits of smart licensing is that they can easily be “transferred” from one controller to the other.

In the case of SLR offline licensing, they first need to be removed from one controller and added to the other one.

In a case of CSSM licensing, AP licenses show up in your Smart Account as consumed on other controller once the APs have been moved.

It requires up to eight (8) hours for these changes to be reflected.

Q. What happens if I do not license my 9800 WLC?

A.Even if the controller is not properly licensed, it is fully functional. You occasionally see notifications and syslog messages that remind you to license your controller.

Cisco retains the right to conduct audits to check licensing compliance.

Q. Is there any difference in licensing on 9800-40, 9800-80, 9800-L and 9800-CL and EWC (with on 91XX series APs) controllers?

A. Licensing is identical on 9800-40, 9800-80, 9800-L and 9800-CL (this includes 9800 that run on 9000 series Catalyst switches).

Embedded EWC that runs on 9100 series access points (similar to Mobility Express) does not require any licensing unless it is integrated with DNA Center.

For more info about EWC, refer to EWC data sheet.

Q. What is the maximum number of APs I can join and license on each 9800 model?

A. This table contains the maximum number of supported APs for each 9800 WLC model:

Q. How long does it take for a license to be “consumed” and show up to be “in use”?

A.License count does not get updated for every ap join and disjoin. It can take up to eight (8) hours for the license to be consumed. Eight (8) hours timer is default and cannot be changed.

If the controller has been rebooted or HA has been set up, the first license count report happens one (1) hour later.

If the AP drops from the WLC due to unstable connection, the license is unlikely to be consumed.

Q. I see a “ASR_1000_AdvEnterprise” and “ASR_1000_AdvIpservices” license on my 9800 WLC. Do I really need ASR router license for my 9800 WLC?

A.No. This is caused by 2 bugs:

• Cisco bug ID CSCvt27421 - 9800 - 17.1 - Cannot remove advipservices license
• Cisco bug ID CSCvf53989 - 9800-40/80 - Smart licensing summary shows "ASR_1000_AdvIpservices "

Bugs are superficial. They have no impact on 9800 functionality and have been resolved in 17.2.1 code release.

Q.  What is the impact of hardware RMA on the Cisco Catalyst 9800 Series controller’s licensing?

 A. There is no impact on licenses due to hardware RMA. Customers can reconnect their access points to the new wireless controller post-RMA without any licensing impact.

Q. How do I troubleshoot licensing on 9800 WLC?

A.Before you open a case with Cisco TAC, make sure to perform the five (5) items from this checklist:

1. Verify that domain tools.cisco.com is resolvable.
2. Verify that tools.cisco.com is reachable via http(s).
   
3. Collect the output of these show commands:
   

   #show license tech support
   #show license air entities added
   #show license air entities deleted
   #show license air entities no-change
   #show license air entities summary
   #show license air entities bulk
   #show license eventlog
   #show license usage
   #show ap uptime
   #show wireless stats ap join summary

4. Collect the debugs:
   

   #set platform software trace ios chassis active R0 all-modules debug
   >> Reproduce the issue
   #show logging process ios internal to-file bootflash:license_debugs.txt
   

   This saves the file named license_debugs.txt  which contains the debugs in the boothflash of 9800 WLC. The easiest way to retrieve license_debugs.txt file from WLC is to download with a built in file browser that can be found under Administration > Management > File Manager . Alternatively, you can use any other supported file transfer protocol like SFTP, FTP, TFTP, and the like.

5. Collect the packet captures on the interface that have been specified to be used for smart licensing.

In the controller web interface, navigate to Troubleshooting > Packet Captures, set up the capture on relevant interface, and click Start .

The information is possibly encrypted, but it reveals no DNS or reachability issues:

Q. What is Smart Licensing using Policy?

A. Smart Licensing using Policy is an enhancement to Smart Licensing that enables a compliance relationship to account for hardware and software licenses purchased and in use.

This feature was introduced in Cisco IOS® XE releases Amsterdam-17.3.2.a and Bengaluru-17.4.1 and is enabled by default with these releases.

For details on configuration, refer Smart Licensing Using Policy config guide.