Licensing with Cisco DNA and Smart Licensing

1. Licensing Tiers

The Two-Stack Model: Network Stack vs. DNA Stack

The single most important idea in Catalyst 8000 licensing is that every router carries two licenses, not one. Cisco organizes IOS XE licensing into two parallel "stacks." The Network stack maps to the routing feature set, comes in two tiers (Essentials and Advantage), and behaves as a perpetual license — even after everything else expires, the box keeps routing. The DNA stack is the subscription add-on that rides on top, comes in three tiers (Essentials, Advantage, Premier), and is term-based (rented for 3, 5, or 7 years).

A useful analogy: the Network stack is like owning a car and the DNA stack like a subscription to a navigation-and-driver-assist service. When the subscription lapses, the car still drives — you simply lose the smart features layered on top. The two stacks are tier-matched: Network Essentials pairs with DNA Essentials, Network Advantage pairs with DNA Advantage. In ordering this usually appears as a single bundled SKU. On the 8200 and 8300 the DNA subscription is mandatory; the older perpetual add-ons (SEC, UC, APP) have been retired.

Figure 4.1: The two-stack model and tier-matching

DNA Essentials, Advantage, and Premier

The DNA-stack tier determines which subscription features light up. DNA Essentials delivers core SD-WAN, basic device management, and basic telemetry — often enough for a branch doing SD-WAN with direct internet access break-out. DNA Advantage adds the full SD-WAN feature set with advanced policies, richer security/segmentation, deeper analytics, and ecosystem integration (ISE, Secure Network Analytics, ThousandEyes); the DNA portion typically runs 50–100% more than Essentials. DNA Premier sits above Advantage as a bundle rolling in additional Cisco software entitlements (such as advanced security/threat services). Critically, the DNA subscription is the SD-WAN license — there is no separate SD-WAN product.

What Happens When the Term Expires

Because the DNA stack is a rental, expiry matters. When a DNA term ends and is not renewed, the device keeps routing using the Network tier you own, but you lose DNA-only capabilities (advanced SD-WAN control, certain automation/analytics, DNA cloud services) and entitlement to new DNA-scope feature updates and subscription support. The danger is that this happens quietly — routing continues, so nobody notices until an SD-WAN feature or support case is needed. Track end dates and budget renewals against the hardware lifecycle (a 5-year term aligned to a 5-year refresh is a common pattern).

Figure 4.2: What persists and what is lost when the DNA term expires

Throughput-Based Tiers (T0/T1/T2/T3)

Beyond the feature stacks, Catalyst 8000 ordering includes a throughput tier — a software-enforced cap on how much traffic the router will forward. The platform supports multiple levels (commonly grouped T0–T3, mapping to ascending bandwidth ranges such as 50 Mbps, 100 Mbps, 250 Mbps, 500 Mbps, 1 Gbps and higher). IOS XE polices the data plane to the configured tier, so capable hardware still caps forwarding at the tier you licensed. On the C8000V you configure throughput explicitly; on hardware it is generally tied to your DNA license selection. As the HSEC section shows, the throughput tier and the crypto cap are independent controls.

Cisco Networking Subscription: Why Routers Are Excluded

Cisco has introduced Cisco Networking Subscription (CNS) as a unified subscription spanning many product families — but routing is explicitly excluded from CNS today. Catalyst 8000 routers stay on DNA subscriptions; you cannot migrate them into CNS. In a mixed environment, your switches and wireless may move to CNS (36-month minimum term) while your routers stay on the Network + DNA model. Plan budgets accordingly.

2. Smart Licensing Using Policy

From "Register First" to "Report Usage"

Legacy Smart Licensing (16.x and early 17.x) followed an "obtain authorization before use" model: you generated a token, ran license smart register idtoken ..., and the device sat in evaluation mode until Cisco authorized it. If it could not reach Cisco it risked falling out of compliance with noisy warnings. SLP, introduced in IOS XE 17.3.2, flips this to "trust, then verify by reporting": no registration token for unenforced licenses, no evaluation mode, unenforced licenses authorized by default, and usage reporting replacing continuous authorization on a policy schedule.

CSSM, RUM Reports, and Trust

Cisco Smart Software Manager (CSSM) is the central cloud portal managing your Smart Account, virtual accounts, and entitlements. Under SLP it is the system of record: for each license type it shows Purchased, In Use, and Balance (Purchased − In Use). With 50 CUBE sessions purchased and 20 in use, CSSM shows Purchased 50, In Use 20, Balance 30. If usage exceeds entitlement (balance goes negative), CSSM flags Insufficient Licenses.

The router feeds CSSM through RUM reports — structured data showing which licenses are in use, quantities (throughput level, session count), device identifiers, timestamps, and policy metadata. The product instance continuously records usage, generates reports, stores them until sent, and logs alerts if a report becomes overdue. The policy governs how often you must report (e.g., 30, 90, or 365 days); general guidance is a report within 90 days of a usage change. Trust is now a policy-driven state: the router sends a RUM report, CSSM associates it with the account and returns confirmation, and the device tracks whether it holds a valid current policy and reported within the window. A stale trust state produces warnings, but unenforced features keep working.

Reporting Methods: Online, On-Prem, and Air-Gapped

SLP supports three transports so you can match licensing to your security posture: (1) Direct online (Smart Transport) — HTTPS straight to Cisco's cloud CSSM, configured with license smart transport smart; (2) On-prem via CSLU or CSSM Satellite — deploy a Cisco Smart License Utility registered to your Smart Account and point the router at it, then the on-prem server syncs to cloud CSSM; (3) Offline / air-gapped file exchange — the router accumulates usage, you export a RUM file, upload it to CSSM from a connected machine, then download and import updated policy/trust. You can verify state with show license all and show license usage, and trigger reporting with license smart sync all.

Figure 4.3: RUM report flow from router to CSSM across the three transports

3. HSEC and Throughput

The HSEC License and the 250 Mbps Crypto Cap

A Catalyst 8000 licensed for 1 Gbps of throughput may still refuse to push more than ~250 Mbps of encrypted traffic — because of export control, not hardware. U.S. regulations historically required vendors to limit high-speed strong encryption in certain territories. Cisco implements this as a soft cap of ~250 Mbps on encrypted (IPsec/crypto) throughput and on tunnel/SA scale, lifted only with an export-control license. SEC-K9 enables standard crypto but stays export-limited; HSEC-K9 (High-Security Export Control) removes the limitation so the router can use its full crypto capability, subject to whatever throughput tier you hold. The cap applies only to encrypted traffic — on a 1 Gbps router without HSEC, unencrypted traffic flows near 1 Gbps while IPsec stubbornly tops out around 250 Mbps. That is the classic symptom: tunnels that never exceed ~200–250 Mbps no matter how much WAN bandwidth you provision.

Throughput Tiers and HSEC Are Independent

The key mental model: the throughput tier and HSEC are two separate gates, and your encrypted throughput is limited by whichever is lower.

• Tier = 100 Mbps with HSEC → encrypted traffic capped at ~100 Mbps (the tier is the bottleneck).
• Tier = 1 Gbps without HSEC → encrypted traffic capped at ~250 Mbps (export control is the bottleneck); plaintext approaches 1 Gbps.
• Tier = 1 Gbps with HSEC → encrypted traffic can approach 1 Gbps.

To push more than 250 Mbps of IPsec you need both a throughput tier high enough for the target bandwidth and an active HSEC license.

Figure 4.4: The two independent gates limiting encrypted throughput

Boost / Performance Licenses

On the older ISR 4000 series, Cisco used a Performance (Boost) license to lift an artificial cap on overall forwarding — letting the box run unthrottled up to its hardware limits. Boost is not HSEC: Boost removes the general forwarding cap, HSEC removes the crypto cap. On an ISR 4K you can install Boost and still see IPsec stuck at ~250 Mbps because HSEC is missing — you need both. On the Catalyst 8000 the Boost role is filled by the throughput tiers, but the same logic holds: high crypto throughput requires a high tier and HSEC.

Installing and Verifying HSEC

Catalyst 8000 manages HSEC through Smart Licensing / SLP. Verify with show license all, show license usage, and show platform hardware throughput level; look for an HSEC/HSEC-K9 entry with status IN USE or AUTHORIZED, and confirm the throughput level is high enough. If HSEC is missing: in SD-WAN deployments use the "Sync and Install HSEC Licenses" workflow in Cisco SD-WAN Manager (vManage); in autonomous mode follow the online or offline HSEC install guide (register with Smart Licensing, then install/activate HSEC). On the C8000V you set throughput explicitly and reload (e.g., platform hardware throughput level 500000); at or above 250 Mbps/T1 an HSEC license is required to avoid the export cap. Remember that feature overhead (zone-based firewall, IPS, NetFlow, heavy QoS) consumes data-plane cycles and can hold real throughput below the licensed ceiling even when HSEC and the tier are correct — check show platform hardware qfp active datapath utilization summary if numbers fall short.

Worked Example: Choosing the Right Tier

Site A — Small branch, simple SD-WAN. A Catalyst 8300 with SD-WAN, DIA break-out, basic app-aware routing, standard NAT/firewalling, and a 200 Mbps circuit all encrypted to the hub. Feature need → DNA Essentials + Network Essentials. Throughput → ~200 Mbps, all encrypted, below the 250 Mbps cap, so a 250 Mbps (T1-class) tier covers it and no HSEC is required. Term → 5 years. Result: Network Essentials + DNA Essentials, 250 Mbps tier, 5 years, no HSEC.

Site B — Regional hub, complex and high-speed. A Catalyst 8500 aggregating many branches with large-scale SD-WAN, advanced traffic engineering, segmentation, integrated security, and ecosystem integration, carrying ~800 Mbps of encrypted hub traffic. Feature need → DNA Advantage + Network Advantage. Throughput → ~800 Mbps encrypted, exceeding 250 Mbps, so a 1 Gbps (T2/T3-class) tier and an HSEC license — both gates cleared. Term → 5–7 years. Result: Network Advantage + DNA Advantage, ~1 Gbps tier, HSEC-K9, 5–7 years.

The reusable rule: default to Essentials, escalate to Advantage by exception, and add HSEC the moment your encrypted throughput target crosses ~250 Mbps.

Figure 4.5: License-selection decision tree