How to Configure a SecureStack B2/B3 Policy License

[FAQ_User]

Article ID: 5781

Products
SecureStack B3
B3POL-LIC
B3POL-LIC25
B3POL-LIC50
SecureStack B2
Firmware 3.00.14 and higher
Firmware 2.00.16 and higher
B2POL-LIC
B2POL-LIC25
B2POL-LIC50

Protocols/Features
Policy
License
UPN

Commands
'clear license'
'set license'
'show license'

Goals
Configure a SecureStack B2 / B3 Policy license
Policy licensing

Symptoms
"% Invalid input detected at '^' marker."
"No match for serial number"

Cause
The SecureStack B3 supports Policy with any firmware version, and the SecureStack B2 supports Policy as of firmware 2.00.16. In either case, Policy configuration requires one or more of the above-stated "BxPOLxx" Policy License components to permanently unlock the Policy capabilities (in the form of the 'set/clear/show policy' commands) built into the firmware.

For the process of redeeming and activating Policy Licensing, see 10833.

For the process of installing Policy Licensing, read on.

Solution
With B2 firmware 2.00.16 through 2.01.10, a "B2POL" license may be installed into each intended SecureStack B2 unit by means of this cli command format:
'set license <type> <feature> <database version> <expiration> <12-char license key> <12-char serial#> <unit#>'.
To demonstrate, installing the above-stated example license string into SecureStack B2 s/n 05451323800B would require the cli command:
'set license INCREMENT B2Policy 2005.1231 permanent 414EF94A2DE0 05451323800b 1'.
This command must use a lower-case serial# and must include a unit# (5780). This command will not be accepted unless the typed serial number matches to both the serial number encrypted into the license key during Activation, and to the actual serial number of the stated switch unit within the managed stack; or an error message will be issued.

With B2 firmware 3.00.14 and higher, a "B2POL" license may be installed into each intended SecureStack B2 unit (or with B2 firmware 4.00.22 or higher, or any B3 firmware, a "B2POL" license may be installed into each intended SecureStack B3 unit) by means of this cli command format:
'set license <type> <feature> <database version> <expiration> <12-char license key> <12-char serial#>'.
To demonstrate, installing the above-stated example license string into SecureStack B2 s/n 05451323800B would require the cli command:
'set license INCREMENT B2Policy 2005.1231 permanent 414EF94A2DE0 05451323800B'.
This command must use an upper-case serial# and must not include a unit#. The command will not be accepted unless the typed serial number matches to both the serial number encrypted into the license key during Activation, and to the actual serial number of a switch within the managed stack; or an error message will be issued.

With B2 firmware 4.00.22 or higher, or any B3 firmware, a "B3POL" license may be installed into each intended SecureStack B3 unit by means of this cli command format:
'set license <type> <feature> <database version> <expiration> <12-char license key> <12-char serial#>'.
To demonstrate, installing the above-stated example license string into SecureStack B3 s/n 07011323800B would require the cli command:
'set license INCREMENT policy 2006.1231 permanent 41ABF94A2DE0 07011323800B'.
This command must use an upper-case serial# and must not include a unit#. The command will not be accepted unless the typed serial number matches to both the serial number encrypted into the license key during Activation, and to the actual serial number of a switch within the managed stack; or an error message will be issued.
Note: The "B3POL" license is intended for use only on SecureStack B3 standalones, or on B3-only stacks. It is not compatible with SecureStack B2 units in any arrangement. At this time the "B2POL" license may optionally be used for this purpose as well, but the two license types are not compatible within the same stack.

Of the formatting mistakes mentioned above:

• Incorrectly formatting the unit# elicits a "% Invalid input detected at '^' marker." error message.
• Incorrect use of upper vs lower case letters in the serial# elicits a "No match for serial number" error message.

Note: If the "ID_STRING=" serial number prefix is used when Activating a license (10833), the serial number as displayed in the resulting license string/file will in all cases have any letters displayed as upper-case - eliminating the case sensitivity confusion though not the case sensitivity itself.

In a stacked topology, the 'set license' command must be issued separately, with unique Key/Serial#/(Unit#) values, on behalf of each unit in the stack. Because the manager unit will disable all unlicensed ethernet ports once it becomes license-aware, it is important to install the license of the Manager unit last if uninterrupted functionality of all ethernet ports is desired, or uninstall the license of the Manager unit first (or use the 'clear license featureId <feature> all' command) for the same reason.

Here is an example of how to clear all existing licensing from a stack (generally not necessary), confirm that no licenses are applied, establish the licensing on the stack, and then display the results. This stack is running B2 firmware 3.00.14, and unit 4 is the manager.

B2(su)->clear license featureId B2Policy ?
all clear all licenses on the stack
unit provide the unit number
B2(su)->clear license featureId B2Policy unit ?
unit number
B2(su)->clear license featureId B2Policy unit 1 ?

B2(su)->clear license featureId B2Policy all
B2Policy license on unit 4 (manager) cleared
Clearing license on unit 1
B2Policy license on unit 1 cleared
Clearing license on unit 2
B2Policy license on unit 2 cleared
Clearing license on unit 3
B2Policy license on unit 3 cleared
Clearing license on unit 5
B2Policy license on unit 5 cleared
Clearing license on unit 6
B2Policy license on unit 6 cleared
Clearing license on unit 7
B2Policy license on unit 7 cleared
Clearing license on unit 8
B2Policy license on unit 8 cleared
B2(su)->show license
unit 1 has no licenses
unit 2 has no licenses
unit 3 has no licenses
unit 4 has no licenses
unit 5 has no licenses
unit 6 has no licenses
unit 7 has no licenses
unit 8 has no licenses
B2(su)->set license INCREMENT B2Policy 2005.1228 permanent ADED8577EDF8 045200019101
Validating license on unit 1
License successfully validated and set on unit 1
B2(su)->set license INCREMENT B2Policy 2005.1228 permanent A37584C3EEF2 045200029101
Validating license on unit 2
License successfully validated and set on unit 2
B2(su)->set license INCREMENT B2Policy 2005.1228 permanent BF7E21DCEF8B 045100069101
Validating license on unit 3
License successfully validated and set on unit 3
B2(su)->set license INCREMENT B2Policy 2005.1228 permanent F3B33BA45D0B 045100049101
Validating license on unit 5
License successfully validated and set on unit 5
B2(su)->set license INCREMENT B2Policy 2005.1228 permanent 5D3222DCEE8D 045100059101
Validating license on unit 6
License successfully validated and set on unit 6
B2(su)->set license INCREMENT B2Policy 2005.1228 permanent 89632EAC621D 045100019101
Validating license on unit 7
License successfully validated and set on unit 7
B2(su)->set license INCREMENT B2Policy 2005.1228 permanent 0EA327BB2903 051502389141
Validating license on unit 8
License successfully validated and set on unit 8
B2(su)->set license INCREMENT B2Policy 2005.1228 permanent 944E36561C48 051400149141
Validating license on unit 4
License successfully validated and set on unit 4
B2(su)->show license
unit 1
key: INCREMENT B2Policy 2005.1228 permanent ADED8577EDF8 045200019101
status: Active
unit 2
key: INCREMENT B2Policy 2005.1228 permanent A37584C3EEF2 045200029101
status: Active
unit 3
key: INCREMENT B2Policy 2005.1228 permanent BF7E21DCEF8B 045100069101
status: Active
unit 4
key: INCREMENT B2Policy 2005.1228 permanent 944E36561C48 051400149141
status: Active
unit 5
key: INCREMENT B2Policy 2005.1228 permanent F3B33BA45D0B 045100049101
status: Active
unit 6
key: INCREMENT B2Policy 2005.1228 permanent 5D3222DCEE8D 045100059101
status: Active
unit 7
key: INCREMENT B2Policy 2005.1228 permanent 89632EAC621D 045100019101
status: Active
unit 8
key: INCREMENT B2Policy 2005.1228 permanent 0EA327BB2903 051502389141
status: Active
B2(su)->
Setting and clearing licenses has no effect on non-license processes, and does not lead to a system reboot.

As suggested by the elaborate feedback from the 'set license' and 'clear license' commands, issuing these commands causes the information to be programmed into hardware or removed from hardware. The licenses are thus non-volatile irrespective of the configuration file integrity.

For instance, issuing the command 'clear config all' does not clear any hardware-based licenses programmed into the stacked switch(es). Only the 'clear license' command can do that. And, any license-applied switch may be moved from stack to standalone to stack (etc) without loss of its hardware-programmed license - which will appear in the configuration of any stack it is a member of.

See also: 5834.