Symptom

ISR4000 or ISR1000 running 17.6.X or newer is consuming DNA_HSEC license instead of ISR_xxxx_Hsec Example: Authorizations: ISR_4331_Hsec (ISR_4331_Hsec): Description: U.S. Export Restriction Compliance license for 4330 series Total available count: 1 Enforcement type: EXPORT RESTRICTED Term information: Active: PID:ISR4331/K9,SN:xxxxxxxx Authorization type: SMART AUTHORIZATION INSTALLED License type: PERPETUAL Term Count: 1 regid.2019-03.com.cisco.DNA_HSEC,1.0_509c41ab-05a8-431f-95fe-ec28086e8844: DisplayName: hseck9 Description: hseck9 Total available count: 1 Term information: Active: PID:ISR4331/K9,SN:xxxxxxxxx License type: PERPETUAL Term Count: 1 #show license summary License Usage: License Entitlement Tag Count Status ----------------------------------------------------------------------------- throughput (ISR_4331_300M_Performance) 1 IN USE hseck9 (DNA_HSEC) 1 IN USE <<<<<<<<<<<<<< uck9 (ISR_4331_UnifiedCommun...) 1 IN USE securityk9 (ISR_4331_Security) 1 IN USE SRST_EP (SRST_EP) 100 IN USE CUBE_T_VGW (CUBE_T_VGW) 2 IN USE ISR_4331_Hsec (ISR_4331_Hsec) 0 NOT IN USE <<<<<<<<<<<<<<

Conditions

This issue will show up on any ISR platform that had a previously installed PAK license for HSEC and was upgraed from an older (pre-17.6.x) IOSXE version to 17.6.x or newer IOSXE version. if customer uses without importing a SLAC for ISR4xxx_HSEC it automatically takes the DNA_HSEC

Workaround

1. Disable HSECK9 and reload the device Router#conf t Enter configuration commands, one per line. End with CNTL/Z. Router(config)#no license feature hseck9 % use 'write' command to disable 'hseck9' license on next boot Check boot statements and reload 2. After the boot up, return the Authorization to SSM Router#license smart authorization return local online Enter this return code in Cisco Smart Software Manager portal: UDI: PID:XXXXXXXXXXXX,SN:XXXXXXXXXXX Return code: XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXX Router# 3. Wait a minute and Sync with SSM. Might need to perform this twice. Router#license smart sync local 4. Sync SSM to CSSM , first from Reports, Usage Schedules, Sync now. Check for Reservation clear on CSSM, Product instance under the SSM account. Once done - Generate new Auth from CSSM-Product Instance under the SSM VA for HSECK9 only 5. Install the new Auth on SSM, SL Using Policy - Import from Cisco. 6. Activate HSECK from Router's side. Router(config)#license feature hseck9 Router(config)#end Router# %SMART_LIC-6-AUTHORIZATION_INSTALL_SUCCESS: A new licensing authorization code was successfully installed on PID:ISRXXXX/K9,SN:XXXXXXXX 7. SYNC with SSM On-prem Router#license smart sync local

Further Problem Description