Cisco Licensing Explained: What You Buy Once, What Expires, and What Never Needed Registering

Written and maintained by Haink's network infrastructure team · Verified against Cisco licensing documentation, 22 August 2026 · authorized-channel, serial-verified

Most confusion about Cisco licensing comes from treating it as one thing. It is two: a perpetual licence that sets what the hardware can do, and a term subscription that adds management, analytics and — depending which one you buy — support. They are ordered together, they expire differently, and only one of them ever stops.

The second source of confusion is Smart Licensing, which most people still describe using rules that Cisco replaced in 2020. Under the current model there is no registration step, no evaluation period, and no licence server your switch has to phone home to before it will forward a packet.

The two-part structure

On Catalyst 9000 switches the perpetual tiers are Network Essentials and Network Advantage. Essentials covers Layer 2, static routing, routed access with RIP, EIGRP stub and OSPF, programmability, and 128-bit MACsec. Advantage adds full Layer 3 routing, EIGRP, HSRP, IS-IS, VRF, VXLAN, LISP, SGT, BGP EVPN VXLAN fabric and 256-bit MACsec.

There is no Network Premier tier on the switches. Cisco DNA Premier existed as a subscription for switching and wireless, but was withdrawn in 2021 in favour of the DNA Expansion Pack. If a quote offers you "Premier" on a Catalyst 9000 switch, ask what it refers to.

DNA or Catalyst subscription — the difference is support, not features

Cisco sells two subscription families for switching that look interchangeable on a price list and are not. They appear in the ordering matrix as pairs: Cisco DNA Essentials alongside Cisco Catalyst Essentials, marked DNX; DNA Advantage alongside Catalyst Advantage.

So the DNA line looks cheaper and then needs a SmartNet contract added to it, while the Catalyst (DNX) line carries hardware support inside the subscription with a slower TAC objective. Which is cheaper depends entirely on how you were going to cover the hardware anyway — and comparing two quotes without checking which family they use compares nothing.

Smart Licensing Using Policy: what actually changed

Since IOS-XE 17.3.2 the model is Smart Licensing Using Policy, and Cisco's stated objective is a licensing solution "that does not interrupt the operations of your network." In practice that means three things people still get wrong:

• No registration. Cisco: "preliminary steps such as registration or generation of keys are not required, unless you use an export-controlled or an enforced license." And: "all the license levels that are purchased are in use right out of the box."
• No evaluation mode. "The notion of evaluation licenses does not apply." The old behaviour — 90 days of evaluation, then enforcement — is gone. A device does not degrade because it was never registered.
• Reporting is after the fact. Unenforced licences "do not require authorization before use in air-gapped networks, or registration, in connected networks." You use the licence, then report usage.

Reporting intervals are set by policy and, usefully for anyone planning an audit position, they are not the same across platforms:

What happens if you never report? Cisco documents syslog notifications — %SMART_LIC-6-REPORTING_REQUIRED, raised at the deadline and thirty days before it — and does not document any functional consequence for unenforced licences. That is not the same as a guarantee, and the exposure is commercial rather than technical: an account that shows unreported usage is an audit conversation, not an outage.

Air-gapped and restricted networks

This matters disproportionately for the markets we supply, and the answer is better than most people expect. Cisco documents six supported topologies, and full disconnection is one of them — not a workaround but a supported deployment:

1. Connected to Cisco's cloud through CSLU, a small utility that brokers the connection
2. Connected directly
3. CSLU present but itself offline — signed files move in and out
4. Connected through SSM On-Prem, a local licence server
5. SSM On-Prem with no internet
6. No connectivity at all — usage reports exported to file, uploaded manually, acknowledgement imported back

The offline procedure is four commands: set the transport off, save the unreported usage to a file, upload that file in the licensing portal, import the acknowledgement. From IOS-XE 17.7.1a onward the export automatically includes a trust code request, which removes a step that used to be done separately.

One important exception to flag, because it runs the other way: registration of next-generation devices including Wi-Fi 7 access points is not supported through Smart Software Manager On-Prem. Estates that rely on an on-premises licence server should confirm platform support before ordering new-generation hardware.

Enforced licences: the one place authorization is required

A small set of licences do require authorization before use, and they are the export-controlled ones. The example on routing platforms is the HSECK9 key, which authorizes full cryptographic functionality and throughput above 250 Mbps. Without it a Catalyst 8300 is capped at 250 Mbps of encrypted traffic and 1,000 tunnels.

Authorization comes as a Smart Licensing Authorization Code, and it can be obtained offline. Either generate it in the licensing portal by entering the device details, or — from 17.7.1a — have the device write a request to a file, upload that, and install the returned code. Neither route requires the device itself to reach the internet.

Worth knowing per platform: on Nexus switches, Cisco states that all licences are unenforced and there are no export-controlled or enforced licences at all. On the Catalyst 8500 and 8500L, HSECK9 does not affect throughput or tunnel scale — it is required "only for compliance purposes."

On routers, the licence sets the speed

Switching and routing licensing work differently in one decisive way. On a Catalyst 9000 switch the licence tier sets which features are available. On a Catalyst 8000 router the subscription sets a bandwidth tier, and that tier is a hard ceiling regardless of what the hardware can do:

Out of the box the router is throttled to 10 Mbps in autonomous mode and 250 Mbps in controller mode until the level is configured, and Essentials tiers cannot go above T2. The full treatment, including what happened to the old performance and Boost licences, is in the ISR 4000 to Catalyst 8000 guide.

Cisco Networking Subscription — a different model, for different hardware

Cisco Networking Subscription is the newer licensing model, and the important thing to know about it is which hardware it applies to: the C9350, C9550 and C9610 Smart Switches, the Cisco 8000 Series Secure Routers, Wi-Fi 7 access points, and the 9800 wireless controllers. It does not cover the Catalyst 9200 through 9600 installed base, and it does not cover the Catalyst 8200 or 8300.

It bundles product support — hardware and software coverage, 24×7 TAC, OS updates — into the subscription, offers Essentials and Advantage tiers across wireless, switching and WAN, and can be managed through either the Meraki dashboard or Smart Software Manager. Minimum term is 36 months for a new subscription.

Cisco publishes no migration path from existing DNA subscriptions to this model, which is consistent with it being positioned for new hardware generations rather than as a replacement for what is already deployed. If a quote for Catalyst 9300 switches mentions Cisco Networking Subscription, something is wrong with the quote.

What this means for a purchase

1. Check which subscription family the quote uses — DNA or Catalyst (DNX). One includes hardware support and one does not.
2. Match the tier to the SKU suffix. An -A switch requires an Advantage subscription; the mismatch is rejected at order.
3. Choose the term deliberately. Three, five and seven years all exist, and on hardware with a seven-year life the longest term is usually the lowest annual cost.
4. For air-gapped sites, confirm the topology before ordering — and confirm platform support if you rely on SSM On-Prem.
5. For routers, size the bandwidth tier against the circuit, and order HSEC where encrypted throughput will exceed 250 Mbps.
6. Do not assume the subscription covers software updates for the perpetual stack. It does not — that is a support contract, covered in SmartNet versus warranty.

Frequently asked questions

Do I have to register a Cisco switch for its licences to work?

No. Under Smart Licensing Using Policy, registration is not required unless the licence is export-controlled or enforced, and purchased licence levels are usable out of the box. There is also no evaluation period that expires.

Can I run Cisco licensing in a fully disconnected network?

Yes. Complete disconnection is one of the six topologies Cisco supports. Usage reports are exported to a file, uploaded manually, and the acknowledgement imported back to the device.

What is the difference between Cisco DNA and Cisco Catalyst subscriptions?

Support scope. The Catalyst subscription, marked DNX, includes software, OS and hardware support with a four-hour TAC objective. The DNA subscription includes software support only with a one-hour objective, and hardware coverage needs a separate contract.

Is there a Network Premier tier on Catalyst 9000 switches?

No. The perpetual tiers are Network Essentials and Network Advantage. Cisco DNA Premier existed as a subscription for switching but was withdrawn in 2021.

What happens if I never submit a licence usage report?

Cisco documents syslog warnings and no functional consequence for unenforced licences. The exposure is a compliance and audit one rather than a technical one — which is not the same as saying it does not matter.

Does Cisco Networking Subscription apply to my Catalyst 9300s?

No. It covers the C9350, C9550 and C9610 Smart Switches, Cisco 8000 Series Secure Routers, Wi-Fi 7 access points and 9800 controllers. The Catalyst 9200 to 9600 range uses DNA or Catalyst subscriptions.

Related

• Is the DNA subscription mandatory? — the buy-it and keep-it questions, separated
• Do Cisco licences transfer with used hardware?
• SmartNet versus warranty — which one gets you software updates
• ISR 4000 to Catalyst 8000 — where the licence sets the throughput
• Catalyst 2960-X replacement — where the licensing model change is the migration cost
• How to choose Cisco switches, routers and firewalls · Cisco stock and lead times

Sources

• Cisco — Smart Licensing Using Policy, concepts · configuration workflows
• Cisco — Smart Licensing Using Policy on Catalyst switches (reporting intervals, offline procedure)
• Cisco — Available licences on Catalyst 9000 (perpetual vs add-on, tiers)
• Cisco — Catalyst and DNA software subscription matrix for switching
• Cisco — Configure licences and throughput on Catalyst 8000
• Cisco — Networking Subscription data sheet