Licenses and Licensing Models

This chapter provides information about the licenses that are available on Cisco Catalyst 8000 Edge Platforms Family, supported throughput options, and how to configure the available licenses and throughput. It also outlines the licensing models available on Cisco Catalyst 8000 Edge Platforms Family.

? The information in this chapter applies predominantly to a device operating in the autonomous mode. References to the controller mode are included in certain sections for the sake of comparison and completeness. Where the information applies to controller mode, this has been called-out categorically.

For a more detailed overview on Cisco Licensing, go to https://cisco.com/go/licensingguide.

This chapter includes the following major sections:

Feature Information for Available Licenses and Licensing Models, on page 1
Available Licenses, on page 3
Throughput, on page 9
How to Configure Available Licenses and Throughput, on page 22
Available Licensing Models, on page 37

Feature Information for Available Licenses and Licensing Models

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Feature Name	Releases	Feature Information
Aggregate Throughput Throttling - Virtual Platforms	Cisco IOS XE Cupertino 17.9.1a	On virtual platforms of the Cisco Catalyst 8000 Edge Platforms Family, for all throughput levels, when you configure a bidirectional throughput value on the device, aggregate throughput throttling is effective. This enhancement does not change the throttling behaviour that has always been applicable to virtual platforms: any throttling applies only to data that is transmitted (Tx). Data that is received (Rx) is unthrottled. See Throughput, on page 9, Throughput as a Numeric Value, on page 10, and Throughput as a Tier, on page 16.
Aggregate Throughput Throttling - Physical Platforms	Cisco IOS XE Cupertino 17.8.1a	On the physical platforms of Cisco Catalyst 8000 Edge Platforms Family, for throughput levels greater than 250 Mbps and Tier 2 and higher tiers, when you configure the bidirectional throughput value on the device, aggregate throughput throttling is effective. This means that traffic is throttled in an aggregate manner irrespective of the distribution of the traffic in the upstream and downstream direction. The bidirectional throughput is represented in the license PID (For example, DNA-C-500M-E-3Y and DNA-C-T2-E-3Y). The aggregate throughput is double the bidirectional throughput. See Throughput as a Numeric Value, on page 10 and Throughput as a Tier, on page 16.
Tier-Based Licenses	Cisco IOS XE Cupertino 17.7.1a	Support for tier-based throughput configuration was introduced in addition to existing bandwidth-based (numeric) throughput configuration. Starting with the lowest throughput level, the available tiers are Tier 0 (T0), Tier 1 (T1), Tier 2 (T2), and Tier3 (T3). Each tier represents a throughput level. If the license PID for a product is tier-based, the license is displayed with the tier value in the CSSM Web UI. For a product with a tier-based license, you can configure a tier-based throughput value, and you can also convert to a tier-based throughput value.

Available Licenses

This section lists all the licenses that are available on Cisco Catalyst 8000 Edge Platforms Family, usage guidelines, and ordering considerations.

Cisco DNA License

A Cisco Digital Network Architecture (DNA) software license combines several feature-specific licenses.

? A Cisco DNA license includes all feature licenses except the following: High Security (HSECK9), Cisco Unified Border Element (Cisco UBE), Cisco Unified Communications Manager Express (Cisco Unified CME), and Cisco Unified Survivable Remote Site Telephony (Cisco Unified SRST). See Ordering Considerations for a Cisco DNA License, on page 5.

Cisco DNA licenses are categorized into network-stack licenses and DNA-stack add-on licenses.

Cisco DNA Licenses Available on Catalyst 8000V Edge Software, Catalyst 8200, and 8300 Series Edge Platforms:

Network-stack licenses:

Network Essentials
Network Advantage: includes features available with Network Essentials, and more.

Network Premier:

Network Premier: includes features available Network Essentials, Network Advantage, and more.

DNA-stack add-on licenses:

Cisco DNA Essentials: add-on license available only with Network Essentials.
Cisco DNA Advantage: add-on license available only with Network Advantage. Includes features available with DNA Essentials and more.
Cisco DNA Premier: add-on license available only with Network Premier. Includes features available with DNA Essentials, DNA Advantage and more.

Cisco DNA Licenses Available on Catalyst 8500 Series Edge Platforms:

Network-stack licenses:

Network Advantage
Network Premier: includes features available Network Advantage, and more.

DNA-stack add-on licenses:

Cisco DNA Advantage
Cisco DNA Premier: add-on license available only with Network Premier. Includes features available with DNA Advantage and more.

Guidelines for Using a Cisco DNA License

Guidelines that apply to all platforms in the Cisco Catalyst 8000 Edge Platforms Family:

A network-stack license is a perpetual or permanent license and has no expiration date.
A DNA-stack add-on license is a subscription or term license and is valid only until a certain date. A 3-year and 5-year option is available for all DNA-stack add-on licenses. A 7-year subscription option is available for certain DNA-stack add-on licenses.
If you order a Cisco DNA license when purchasing new hardware, the license is not preconfigured on the device. You must configure the boot level license and then the throughput, on the device.
If you configure tier-based throughput, which is supported from Cisco IOS XE Cupertino 17.7.1a, Tier 3 (T3) is not supported with the Network Essentials and DNA Essentials licenses. This means, to configure T3 (throughput greater than or equal to 2.5 G), you must configure Network Advantage/ DNA Advantage, or Network Premier/DNA Premier as the boot level license. This also means that if you have configured T3 as the throughput, you cannot change the boot level license to Network Essentials and DNA Essentials.

Guidelines that apply only to Catalyst 8000V Edge Software:

On Catalyst 8000V Edge Software, when you configure a network-stack license, you must also configure the corresponding DNA-stack add-on license.

Guidelines that apply only to Catalyst 8200, 8300, 8500 Series Edge Platforms:

The DNA-stack add-on license that is available with each network-stack license is optional. You can configure a network-stack license without a DNA-stack add-on license, but you cannot configure DNA-stack add-on license without the corresponding network-stack license.
If you use a DNA-stack add-on license, renew the license before term expiry to continue using it, or deactivate the DNA-stack add-on license and then reload the device to continue operating with the network-stack license capabilities.

Ordering Considerations for a Cisco DNA License

A Cisco DNA license subsumes all performance, boost, and technology package licenses (securityk9, uck9, and appxk9). This means that when you order a Cisco DNA network-stack license, or a Cisco DNA-stack add-on license, if a performance, boost, and technology package license is required or applicable, it is automatically added to the order.

The license Product ID (PID) you purchase can only be a DNA-stack add-on license PID.

The license PID also indicates the throughput you are entitled to. The throughput may be represented by a numeric value or a tier. For example:

DNA-C-10M-E-3Y, is a license PID where the throughput is represented by a numeric value. The 10M means that you are entitled to 10 Mbps bidirectional throughput. For more information about a numeric throughput value and related concepts, see sections Throughput, on page 9 and Throughput as a Numeric Value, on page 10.
DNA-C-T0-E-3Y, is a license PID where the throughput is represented by a tier value. The T0 means that you are entitled to up to 15 Mbps bidirectional throughput. For more information about a tier-based throughput value and related concepts, see sections Throughput, on page 9 and Throughput as a Tier, on page 16.

If the throughput you order is greater than 250 Mbps, or Tier 2 or a higher tier, an HSECK9 license is required. See High Security License, on page 5.

? When you purchase a license PID with a tier-based throughput value of T1, an HSECK9 license is automatically provided. Throttling behaviour varies based on whether the platform is physical or virtual, and the release:

>= 17.9.1a (physical platform) with or without HSEKC9: 200 Mbps bidirectional
>= 17.9.1a (virtual platform) with or without HSEKC9: 200 Mbps Tx
>=17.10.1a (physical platform) with HSECK9: 500 Mbps aggregate
>=17.10.1a (physical platform) without HSECK9: 250 Mbps bidirectional
>=17.10.1a (virtual platform) with HSECK9: 500 Mbps Tx
>=17.10.1a (virtual platform) without HSECK9: 250 Mbps Tx

High Security License

The High Security license (HSECK9 license) is an export-controlled license. An export-controlled license is restricted by U.S. export control laws.

This license is required for the use of full cryptographic functionality, that is, throughput greater than 250 Mbps (Tier 2 and higher tiers), and tunnel count over and above a certain number (the number varies depending on the platform).

? The term "throughput" refers to encrypted throughput on physical platforms. On virtual platforms, it refers to encrypted and unencrypted throughput - combined.

Without an HSECK9 license, the supported tunnel count and the supported throughput for the various models of the Cisco Catalyst 8000 Edge Platforms Family is as follows:

PID	No. Of Tunnels Without HSECK9 License	Supported Throughput Without HSECK9 License
C8500-12X	N/A	N/A
C8500-12X4QC	N/A	N/A
C8500L-8G4X	N/A	N/A
C8300-2N2S-4T2X	1000	T0, T1
C8300-2N2S-6T	1000	T0, T1
C8300-1N1S-4T2X	1000	T0, T1
C8300-1N1S-6T	1000	T0, T1
C8200-1B-4T	1000	T0, T1
C8200L-1N-4T	1000	T0, T1
C8000V	150	T0, T1

? By using an HSECK9 license the tunnel count restriction is lifted and you can configure throughput greater than 250 Mbps. For detailed information about the available throughput options, see Throughput and System Hardware Throttling Specifications in the Autonomous Mode, on page 11 and Numeric and Tier Mapping.

To know if an HSECK9 license is being used on a device, enter the show license summary command in privileged EXEC mode. On all devices in the Cisco Catalyst 8000 Edge Platforms Family, the HSECK9 license as displayed as: Router US Export Lic. for DNA (DNA_HSEC). For example:

Device# show license summary

Account Information:
Smart Account: Eg-SA As of Dec 03 15:26:02 2021 UTC
Virtual Account: Eg-VA

License Usage:
 License Entitlement Tag Count Status
 ---------------------------------------------------------------------------
 network-advantage_T2 (NWSTACK_T2_A) 1 IN USE

Guidelines for Using an HSECK9 License

The HSECK9 license is tied to the chassis. Therefore, one HSECK9 license is required for each chassis UDI where you want to use cryptographic functionality.

An HSECK9 license requires authorization before use. This authorisation is provided by a Smart Licensing Authorization Code (SLAC), which you must install on the device. You must install a SLAC for each HSECK9 license you use. A SLAC is generated in and obtained from CSSM. How you obtain SLAC from CSSM depends on the topology you have implemented. For more information, see Installing SLAC for an HSECK9 License, on page 25.

Once SLAC is installed, enter the show license authorization command in privileged exec mode, to confirm. If SLAC is installed, the status field displays: SMART AUTHORIZATION INSTALLED on <timestamp>. For example:

Device# show license authorization
Overall status:
Active: PID:C8300-1N1S-4T2X,SN:FDO2250A0J5
Status: SMART AUTHORIZATION INSTALLED on Dec 03 08:24:35 2021 UTC
Last Confirmation code: 418b11b3

Authorizations:
 Router US Export Lic. for DNA (DNA_HSEC):
 Description: U.S. Export Restriction Compliance license for DNA based Routers
 Total available count: 1
 Enforcement type: EXPORT RESTRICTED
 Term information:
 Active: PID:C8300-1N1S-4T2X,SN:FDO2250A0J5
 Authorization type: SMART AUTHORIZATION INSTALLED
 License type: PERPETUAL
 Term Count: 1

Purchased Licenses:
 No Purchase Information Available

Ordering Considerations for an HSECK9 License

If you order your DNA licenses in the same configuration as Catalyst 8000 hardware platforms, the option to order an HSECK9 license is available or is selected, if applicable. For example, in case of Catalyst 8500 Series Edge Platforms, when you order hardware, an HSECK9 license is automatically added to the order, because throughput support starts at greater than 250 Mbps on these platforms. Further, the requisite SLAC for the HSECK9 license is also factory-installed on the device.

If you order your DNA licenses in a configuration that is separate from your Catalyst 8000 hardware platforms, you must order the HSECK9 license in the configuration for the Catalyst 8000 hardware platforms, if required.

If you plan to use an HSECK9 license with new hardware that you are ordering, provide your Smart Account and Virtual Account information with the hardware order. This enables Cisco to factory-install SLAC for the HSECK9 license on the hardware. You must still configure throughput on the device before you start using it.

? If the HSECK9 license is ordered separately (not with the hardware order), SLAC cannot be factory-installed.

Cisco CUBE License

A Cisco Unified Border Element License (Cisco UBE license) does not require any boot level configuration before you enable it. After purchase, you can refer to the configuration guide to configure the available Cisco UBE features.

For information about the features available with a Cisco UBE license, see the Cisco Unified Border Element Configuration Guide for the required release at: https://www.cisco.com/c/en/us/support/unified-communications/unified-border-element/products-installation-and-configuration-guides-list.html.

For information about supported platforms and about purchasing a Cisco UBE license, see the datasheet at: https://www.cisco.com/c/en/us/products/collateral/unified-communications/unified-border-element/data-sheet-c78-729692.html.

You must order a Cisco UBE license separately if required. It is not automatically included with any other license.

For information about how to report usage of a Cisco UBE license, see Smart Licensing Using Policy for Cisco Enterprise Routing Platforms. In the context of this licensing model, a Cisco UBE license is an unenforced license.

Cisco Unified CME License

A Cisco Unified Communications Manager Express License (Cisco Unified CME license) does not require any boot level configuration before you enable it. After purchase, you can refer to the configuration guide to configure the available features.

For information about the features available with a Cisco Unified CME license, see the Cisco Unified Communications Manager Express System Administrator Guide.

For information about supported platforms and about purchasing a Cisco Unified CME license, see the datasheet at: https://www.cisco.com/c/en/us/products/collateral/unified-communications/unified-communications-manager-express/datasheet-c78-744069.html.

You must order a Cisco Unified CME license separately if required. It is not automatically included with any other license.

For information about how to report usage of a Cisco Unified CME license, see Smart Licensing Using Policy for Cisco Enterprise Routing Platforms. In the context of this licensing model, a Cisco Unified CME license is an unenforced license.

Cisco Unified SRST License

A Cisco Unified Survivable Remote Site Telephony License (Cisco Unified SRST license) does not require any boot level configuration before you enable it. After purchase, you can refer to the configuration guide to configure the available Unified SRST features.

For information about the features available with a Cisco Unified SRST license, see the Cisco Unified SCCP and SIP SRST System Administrator Guide (All Versions).

For information about supported platforms and about purchasing a Cisco Unified SRST license, see the datasheet at: https://www.cisco.com/c/en/us/products/collateral/unified-communications/unified-communications-manager-express/datasheet-c78-744069.html.

You must order a Cisco Unified SRST license separately if required. It is not automatically included with any other license.

Throughput

For information about how to report usage of a Unified SRST license, see Smart Licensing Using Policy for Cisco Enterprise Routing Platforms. In the context of this licensing model, a Unified SRST license is an unenforced license.

The throughput tells you how much data is allowed to be transferred on the device. You can configure this value in the autonomous mode. Data is then transmitted (Tx) and received (Rx) at the configured rate. If you don't explicitly configure a throughput, default throughput is effective.

Encrypted and Unencrypted Throughput

Encrypted throughput, also known as crypto throughput, is throughput that is protected by a cryptographic algorithm.

Unencrypted throughput on the other hand, is in plain text. Unencrypted throughput is also referred to as Cisco Express Forwarding (CEF) traffic.

⚠️ In case of physical platforms (Catalyst 8200, 8300, and 8500 Series Edge Platforms), all references to "throughput" in this document refer only to cryptographic throughput.

⚠️ In case of virtual platforms (Catalyst 8000V Edge Software), all references to "throughput" in this document refer to both, encrypted and unencrypted throughput.

Throttled and Unthrottled Throughput

Throttled throughput refers to the enforcement of a restriction on the throughput.

Unthrottled throughput means no limit is enforced, and the device throughput is at the maximum capability of the device.

Whether throughput will be throttled or not, is determined by the throughput value you configure, and if the system's hardware is designed to impose a throttling limit for that configured throughput level. For more information about this, see Throughput and System Hardware Throttling Specifications in the Autonomous Mode, on page 11 in this document.

Depending on whether the device is a physical or a virtual one, throttling is also applied differently. On virtual platforms, if throughput is throttled, throttling applies only to Tx data and not Rx data. On physical platforms, if throughput is throttled, throttling applies to Tx and Rx data.

? On physical platforms (Catalyst 8200, 8300, and 8500 Series Edge Platforms), unencrypted throughput (Tx and Rx), is unthrottled by default.

Where to Find Throughput Information for a Device

The throughput you are entitled to, is a value that is represented in the License product ID (PID) when you order a Cisco DNA license. It can be a numeric throughput value, such as DNA-C-10M-E-3Y, or a tier-based throughput value, such as DNA-C-T0-E-3Y.

Throughput as a Numeric Value

To display current throughput configuration on the device:

For physical platforms enter the show platform hardware throughput crypto privileged EXEC command.
For virtual platforms enter the show platform hardware throughput level privileged EXEC command.

Depending on whether your license PID has a numeric throughput value, or tier-based throughput value, refer to the corresponding section below for further details.

This refers to a numeric value (10M, 15M, 250M, 1G, and so on) that is configured as throughput.

The numeric throughput value you are entitled to is in the license PID and it is bi-directional. It is the maximum throughput that is allowed in each direction (Tx and Rx). The aggregate throughput is the sum of the throughput in both directions and therefore double the bi-directional throughput.

For example, if the license PID is DNA-C-10M-E-3Y, 10 Mbps is the bi-directional throughput, and the throughput value you configure on the device. It means that a maximum of 10 Mbps can be transmitted and 10 Mbps can be received. The aggregate throughput available is 20 Mbps.

Starting with Cisco IOS XE Cupertino 17.8.1a, throttling behaviour has changed as follows: Only on physical platforms, and for throughput levels greater than 250 Mbps, when you configure a throughput value on the device, aggregate throughput throttling is effective. This means that traffic is throttled in an aggregate manner irrespective of the distribution of Tx and Rx traffic.

Starting with Cisco IOS XE Cupertino 17.9.1a, throttling behaviour has changed as follows: On virtual platforms, for all throughput levels, when you configure a bidirectional throughput value on the device, aggregate throughput throttling is effective. This enhancement does not change the throttling behaviour that has always been applicable to virtual platforms: any throttling applies only to Tx data. Rx data is always unthrottled.

? If the aggregate for the throughput level you configure on a virtual platform is greater than 250 Mbps, aggregate throttling is not effective unless an HSECK9 license is available on the device (that is, SLAC is installed).

▶️ Example: Throttling when throughput is greater than 250 Mbps

Let us suppose that you order license PID DNA-C-500M-A-3Y. This means that 500 Mbps is the bi-directional throughput and 1Gbps is the aggregate throughput. The release-wise configuration and behaviour is as follows:

Until Cisco IOS XE Cupertino 17.7.x, on physical and virtual platforms: If you configure a throughput of 500 Mbps on the device, the maximum Tx throughput available is 500 Mbps and the maximum Rx throughput is 500 Mbps. (Except on virtual platforms, where Rx is not throttled.)
From Cisco IOS XE Cupertino 17.8.1a: On physical platforms, if you configure a throughput of 500 Mbps on the device, a maximum of 1 Gbps Tx and 0 Mbps Rx, or, 100 Mbps Tx and 900 Mbps Rx or any other ratio within the aggregate 1 Gbps throughput limit, is supported. On virtual platforms, if you configure a throughput of 500 Mbps on the device, a maximum of 500 Mbps Tx throughput is supported. Rx is not throttled.

Throughput and System Hardware Throttling Specifications in the Autonomous Mode

From Cisco IOS XE Cupertino 17.9.1a:

On physical platforms, throughput throttling behaviour described above (starting with 17.8.1a) continues to apply.
On virtual platforms, if you configure a throughput of 500 Mbps on the device, a maximum of 1 Gbps Tx throughput is supported. Rx continues to remain unthrottled.

▶️ Example: Throttling when throughput is equal to or lesser than 250 Mbps

Let us suppose that you order license PID DNA-C-250M-A-3Y. This means that 250 Mbps is the bi-directional throughput, and 500 Mbps is the aggregate throughput. The release-wise configuration and behaviour is as follows:

Until Cisco IOS XE Cupertino 17.8.x, on physical and virtual platforms: If you configure a throughput of 250 Mbps on the device, the maximum Tx throughput supported is 250 Mbps and the maximum Rx throughput is 250 Mbps - it is not aggregated. (Except on virtual platforms where Rx is not throttled.)
From Cisco IOS XE Cupertino 17.9.1a, only on virtual platforms, if you configure a throughput of 250 Mbps on the device, the aggregate amounts to 500 Mbps, which requires an HSECK9 license. If you have installed SLAC for the HSECK9 license, then the maximum Tx throughput available is 500 Mbps. Rx throughput continues to remain unthrottled. By contrast, if you configure a throughput of 100 Mbps on a virtual device, then the maximum Tx throughput available is 200 Mbps. Rx throughput remains unthrottled.

? On C8200-1N-4T-L, if you configure a numeric value of 250 Mbps, a maximum of 250 Mbps is available in each direction. But if you configure a tier-based value (T2), 500 Mbps is available for use in any Tx and Rx ratio.

The recommended way to arrive at the required throughput for your network is to first calculate the aggregate throughput (Tx and Rx) and divide that by 2 to arrive at the bidirectional throughput value. Finally, select the license PID that is equal to or greater than the bidirectional throughput (tier-based or numeric).

The tables below provide throughput specifications for all devices in the Cisco Catalyst 8000 Edge Platforms Family:

? Separate tables are provided for throughput specifications in the autonomous mode and SD-WAN controller mode.

Throughput and System Hardware Throttling Specifications in the Autonomous Mode

Supported throughputs: All the throughput values you can configure on the device. These are the only throughput values you can configure on the specified device. The column heading also mentions the default throughput for a PID.
Hardware throttled throughput: The throttling limit imposed by the system's hardware, for a supported throughput level. This column in the tables below tell you if hardware is throttled for each supported throughput level and what that hardware throttled level is. Where the value is listed as unthrottled, it means that throughput is not throttled even if you configure a limit.
Require HSECK9?: Indicates if a supported throughput level requires an HSECK9 license (anything lesser than or equal to 250 Mbps does not require HSECK9).
Supported Release & Throughput Throttling Behavior: This column provides a few different details. The applicable release for the specified throttling behaviour, if what is finally available is bi-directional or aggregate, and if the throughput being referred to is encrypted or unencrypted. Note that throughput always refers to encrypted throughput for physical platforms; for for virtual platforms it is both, encrypted and unencrypted.

	Supported Release & Throughput Throttling Behavior		Supported Release & Throughput Throttling Behavior

C8300-1N1S-4T2X	Supported Throughputs (default 10M)	Hardware Throttled Throughput	Require HSECK9?	Supported Release & Throughput Throttling Behavior	Supported Release & Throughput Throttling Behavior
	10M, 15M, 25M, 50M, 100M, 250M	250M	No	>= 17.3.2 Bi-directional; encrypted	Bi-directional; >=17.8.1a encrypted
	500M	500M	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
	1G	1G	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
	2.5G	unthrottled	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
C8300-2N2S-6T	Supported Throughputs (default 10M)	Hardware Throttled Throughput	Require HSECK9?	Supported Release & Throughput Throttling Behavior	Supported Release & Throughput Throttling Behavior
	10M, 15M, 25M, 50M, 100M, 250M	250M	No	>= 17.3.2 Bi-directional; encrypted	Bi-directional; >=17.8.1a encrypted
	500M	500M	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
	1G	1G	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
C8300-1N1S-6T	Supported Throughputs (default 10M)	Hardware Throttled Throughput	Require HSECK9?	Supported Release & Throughput Throttling Behavior	Supported Release & Throughput Throttling Behavior
	10M, 15M, 25M, 50M, 100M, 250M	250M	No	>= 17.3.2 Bi-directional; encrypted	Bi-directional; >=17.8.1a encrypted
	500M	500M	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
	1G	1G	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
C8300-2N2S-4T2X	Supported Throughputs (default 10M)	Hardware Throttled Throughput	Require HSECK9?	Supported Release & Throughput Throttling Behavior	Supported Release & Throughput Throttling Behavior
	10M, 15M, 25M, 50M, 100M, 250M	250M	No	>= 17.3.2 Bi-directional; encrypted	Bi-directional; >=17.8.1a encrypted
	500M	500M	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
	1G	1G	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
	2.5G	unthrottled	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
C8200-1N-4T	Supported Throughputs (default 10M)	Hardware Throttled Throughput	Require HSECK9?	Supported Release & Throughput Throttling Behavior	Supported Release & Throughput Throttling Behavior
	10M, 15M, 25M, 50M, 100M, 250M	250M	No	17.4.1a Bi-directional; encrypted	Bi-directional; >=17.8.1a encrypted
	500M	500M	Yes	17.4.1a Bi-directional; encrypted	Aggregate, encrypted
C8200L-1N-4T	Supported Throughputs (default 10M)	Hardware Throttled Throughput	Require HSECK9?	Supported Release & Throughput Throttling Behavior	Supported Release & Throughput Throttling Behavior
	10M, 15M, 25M, 50M, 100M, 250M	250M	No	>= 17.5.1a Bi-directional; encrypted	Aggregate, encrypted
Note: On C8200-1N-4T-L, if you configure a numeric value of 250 Mbps, a maximum of 250 Mbps is available in each direction. But if you configure tier-based value T2 (which requires an HSECK9 license), 500 Mbps is available for use in any Tx and Rx ratio.

	Supported Release & Throughput Throttling Behavior	Supported Release & Throughput Throttling Behavior
C8500-12X4QC	Supported Throughputs (default 2.5G)	Hardware Throttled Throughput	Require HSECK9?	Supported Release & Throughput Throttling Behavior	Supported Release & Throughput Throttling Behavior
	2.5G	2.5G	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
	5G	5G	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
	10G	unthrottled	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
C8500-12X	Supported Throughputs (default 2.5G)	Hardware Throttled Throughput	Require HSECK9?	Supported Release & Throughput Throttling Behavior	Supported Release & Throughput Throttling Behavior
	2.5G	2.5G	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
	5G	5G	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
	10G	unthrottled	Yes	>= 17.3.2 Bi-directional; encrypted	Aggregate, encrypted
C8500L-8S4X	Supported Throughputs (default 1G)	Hardware Throttled Throughput	Require HSECK9?	Supported Release & Throughput Throttling Behavior	Supported Release & Throughput Throttling Behavior
	1G	1G	Yes	17.4.1a Bi-directional; encrypted	Aggregate, encrypted
	2.5G	2.5G	Yes	17.4.1a Bi-directional; encrypted	Aggregate, encrypted
	5G	5G	Yes	17.4.1a Bi-directional; encrypted	Aggregate, encrypted
	10G	unthrottled	Yes	17.4.1a Bi-directional; encrypted	Aggregate, encrypted

	Supported Release & Throughput Throttling Behavior	Supported Release & Throughput Throttling Behavior
C8500-20X6C	Supported Throughputs (default T4)	Hardware Throttled Throughput	Require HSECK9?	Supported Release & Throughput Throttling Behavior	Supported Release & Throughput Throttling Behavior
	T4	50G	Yes	-	>=17.10.1a Aggregate, encrypted
	T5	unthrottled	Yes	-	>=17.10.1a Aggregate, encrypted
C8000v	Supported Throughputs (default )	Hardware Throttled Throughput	Require HSECK9?	Supported Release & Throughput Throttling Behavior	Supported Release & Throughput Throttling Behavior
	10M	10M	No	>= 17.4.1a Bi-directional; encrypted and unencrypted throughput	Aggregate; encrypted and unencrypted throughput
	25M	25M	No
	50M	50M	No
	100M	100M	No
	250M	250M	No
	500M	500M	Yes
	1G	1G	Yes
	2.5G	2.5G	Yes
	5G	5G	Yes
	10G	10G	Yes
Note: This is a virtual platform; Rx is always unthrottled.

Throughput and System Hardware Throttling Specifications in the SD-WAN Controller Mode

PID	Introductory Release for PID	Throughput Without HSECK9	Throughput With HSECK9 (>=17.3.2 and <17.8.1a; Bi-directional)	Throughput With HSECK9 (>17.8.1a; Aggregate)
C8300-1N1S-4T2X (default 250M)	17.3.2	250M	unthrottled	unthrottled
C8300-2N2S-6T (default 250M)	17.3.2	250M	1G	2G

Throughput as a Tier

Tier-based throughput configuration is supported starting with Cisco IOS XE Cupertino 17.7.1a.

A tier represents a throughput level. Starting with the lowest throughput level, the available tiers are Tier 0 (T0), Tier 1 (T1), Tier 2 (T2), and Tier 3 (T3). T2 and higher tiers require an HSECK9 license.

The tier-based throughput value you are entitled to is in the license PID and it is bi-directional. It is the maximum throughput that is allowed in each direction (Tx and Rx). The aggregate throughput is the sum of the throughput in both directions and therefore double the bi-directional throughput.

For example, if the license PID is DNA-C-T0-A-3Y, T0 is the bi-directional throughput, and the throughput value you configure on the device. When you configure this value, T0 Tx and T0 Rx, is supported. See table Tier and Numeric Throughput Mapping, on page 18 for information about how numeric throughput values are mapped to tiers and the DNA licenses that are available with each tier.

Note the following:

All tiers are not available with all Cisco DNA licenses. For example, T3 is not available with the Network Essentials and DNA-Essentials licenses. This also means that if you have T3 as the configured throughput, you cannot change the boot level license to Network Essentials and DNA Essentials. The Tier and Numeric Throughput Mapping, on page 18 table clarifies this.
Different platforms support different maximum throughput levels, therefore each tier means a different value for different platforms. For example, T2 means 1G throughput for C8300-2N2S-4T2, 500M for C8200-1N-4T, and 250M for C8200-1N-4T-L. The Tier and Numeric Throughput Mapping, on page 18 table clarifies this.

Starting with Cisco IOS XE Cupertino 17.8.1a, throttling behaviour has changed as follows: Only on physical platforms, and when you configure T2 or highter tiers, aggregate throughput throttling is effective. This means that traffic is throttled in an aggregate manner irrespective of the distribution of Tx and Rx traffic.

Starting with Cisco IOS XE Cupertino 17.9.1a, throttling behaviour has changed as follows: On virtual platforms, when you configure a tier (any tier), aggregate throughput throttling is effective. This enhancement does not change the throttling behaviour that has always been applicable to virtual platforms: any throttling applies only to Tx data. Rx data is always unthrottled.

▶️ Example: Throttling when throughput is T2 or a higher tier

Let us suppose that you order license PID DNA-C-T2-A-3Y. With T2, the bi-directional throughput can be upto 1 Gbps and the aggregate throughput can be upto 2 Gbps. The release-wise configuration and behaviour is as follows:

Until Cisco IOS XE Cupertino 17.7.x, on physical and virtual platforms: You configure T2 on the device, and depending on the device, a maximum of up to 1 Gbps Tx and up to 1 Gbps Rx throughput is supported. Except on virtual platforms where Rx is not throttled.
From Cisco IOS XE Cupertino 17.8.1a: On physical platforms if you configure T2, depending on the device, up to 2 Gbps of aggregate throughput is available for use in any Tx and Rx ratio.
From Cisco IOS XE Cupertino 17.9.1a: On physical platforms, the throughput throttling behaviour described above (starting with 17.8.1a) continues to apply. On virtual platforms, if you configure T2, up to 2 Gbps of aggregate throughput is supported. Accordingly, Tx is throttled at the aggregate level and Rx continues to remain unthrottled.

? On C8200-1N-4T-L, if you configure T2, 500 Mbps is available for use in any upstream and downstream ratio. But if you configure a numeric value of 250M, a maximum of 250 Mbps is available in each direction.

▶️ Example: Throttling when throughput is T0 or T1

Let us suppose that you order license PID DNA-C-T1-A-3Y. With T1, 100 Mbps is the bi-directional throughput, 200 Mbps is the aggregate throughput. The release-wise configuration and behaviour is as follows:

Until Cisco IOS XE Cupertino 17.8.x, on physical and virtual platforms: if you configure a throughput of T1 on the device. A maximum of 100 Mbps Tx and 100 Mbps Rx throughput is available. (Except on virtual platforms where Rx is not throttled).
From Cisco IOS XE Cupertino 17.9.1a, only on virtual platforms, if you configure a throughput of T1 on the device, Tx is throttled to a maximum of 200 Mbps. Rx continues to remain unthrottled.

Tier and Numeric Throughput Mapping

The following tables provide information about how numeric throughput values are mapped to tiers and the DNA licenses that are available with each tier.

>= 17.9.1a (physical platform) with or without HSEKC9: 200 Mbps bidirectional
>= 17.9.1a (virtual platform) with or without HSEKC9: 200 Mbps Tx
>=17.10.1a (physical platform) with HSECK9: 500 Mbps aggregate
>=17.10.1a (physical platform) without HSECK9: 250 Mbps bidirectional
>=17.10.1a (virtual platform) with HSECK9: 500 Mbps Tx
>=17.10.1a (virtual platform) without HSECK9: 250 Mbps Tx

Table 2: Tier and Numeric Throughput Mapping for Virtual Platforms (C8000v), Cisco IOS XE Cupertino 17.9.1a and Later Releases

Table 3: Tier and Numeric Throughput Mapping for Physical Platforms, Cisco IOS XE Cupertino 17.8.1a and Later Releases

Table 4: Tier and Numeric Throughput Mapping for Physical and Virtual Platforms, Cisco IOS XE Cupertino 17.7.x and Earlier Releases

? Network Premium and DNA Premium

? Network Advantage and DNA Advantage

? Network Essentials and DNA Essentials

Tier (Agg. Value):	T0 (Tx 50M)				T1 (Tx 200M)				T2* (Tx 2 Gbps)				T3* (Tx 20 Gbps)
Configured Numeric Value:	15M	25M	50M	100M	250M	500M	1G	2.5G	5G	10G
											*HSECK9 License Required.

Tier (Agg.):	T0 (50M Agg)	T1 (200M Bi-directional)	T2* (2G Agg.)	T3* (20G Agg. or unthrottled)	T4* (50G Agg.)	T5* (Unhottled Agg.)
Configured Numeric Value:	10M	15M	25M	50M	100M	250M	500M	1G	2.5G	5G	10G
C8300-1N1S-6T	???	???	???	???	???	???	???	???				*HSECK9 License Required
C8300-2N2S-6T	???	???	???	???	???	???	???	???
C8300-1N1S-4T2X	???	???	???	???	???	???	???	???	??
C8300-2N2S-4T2X	???	???	???	???	???	???	???	???	??
C8200-1N-4T	???	???	???	???	???	???	???
C8200-1N-4T-L	???	???	???	???	???	???
C8500-12X						??	??	??
C8500-12X4QC						??	??	??
C8500L-8S4X						??	??	??	??
C8500-20X6C							??	??

Tier:	T0	T1	T2*	T3*
Configured Numeric Value:	10M	15M	25M	50M	100M	250M	500M	1G	2.5G	5G	10G
C8300-1N1S-6T	???	???	???	???	???	???	???	???				*HSECK9 License Required
C8300-2N2S-6T	???	???	???	???	???	???	???	???
C8300-1N1S-4T2X	???	???	???	???	???	???	???	???	??
C8300-2N2S-4T2X	???	???	???	???	???	???	???	???	??

Numeric vs. Tier-Based Throughput Configuration

With the introduction of tier-based throughput configuration in Cisco IOS XE Cupertino 17.7.1a, when you configure throughput on the device, both numeric and tier-based options are available. This section provides information about when to configure a numeric throughput value and when to configure tier-based throughput.

Cisco Smart Software Manager (CSSM) is a portal that enables you to manage all your Cisco software licenses. All the license PIDs you purchase are listed in the CSSM Web UI at: https://software.cisco.com → Manage licenses. Log in to the portal and in the corresponding Smart Account and Virtual Account, navigate to Inventory > Licences, to display the numeric and tier-based licenses in the account. Figure 1: Numeric and Tier Values Displayed in the CSSM Web UI, on page 21 shows you how to distinguish between the two.

If you purchase a numeric license PID, the license is displayed with the numeric throughput value and tier-based value in the CSSM Web UI. For such a license, we recommend that you configure only a numeric throughput value. See Configuring a Numeric Throughput, on page 26.
If you purchase a tier-based license PID, the license is displayed with only the tier value in the CSSM Web UI. For such a license, you can either configure a tier-based throughput value to match the display in the CSSM Web UI, or you can configure a numeric throughput value. See Configuring a Tier-Based Throughput, on page 29 or Configuring a Numeric Throughput, on page 26.

? There is no functional impact if you have tier-based license PID in CSSM and you configure a numeric throughput value on the device.

Figure 1: Numeric and Tier Values Displayed in the CSSM Web UI

Figure 1: Numeric and Tier Values Displayed in the CSSM Web UI shows a screenshot of the Cisco Smart Software Manager (CSSM) web interface, listing various Routing DNA licenses (Advantage, Essentials, Premier) with their associated tiers (e.g., Tier 2, Tier 1: 100M) and indicating whether they are 'Tier-Based' or 'Numeric' and 'Prepaid'.

The following scenarios further clarify when you can convert from numeric to tier-based throughput configuration, or from tier-based throughput configuration to numeric, when conversion is required, and when it is optional:

You have configured a numeric throughput value on the device and the license PID is a numeric license: You must not convert to tier-based throughput value.
You have configured a numeric throughput value on the device and the license PID is a tier-based license: You can convert the throughput configuration to tier-based value - but this is optional. There is no functional impact if you do not convert to a tier-based throughput value. If you want to convert to a tier-based value, see Converting From a Numeric Throughput Value to a Tier, on page 33
You are upgrading to a release where tier-based throughput values are supported and the license PID is tier-based: You can convert the throughput to tier-based value after upgrade - but this is optional. There is no functional impact if you do not convert to a tier-based throughput value. See Upgrading from a Release Supporting Numeric Throughput to a Release Supporting Tiers, on page 36.
You are upgrading to a release where tier-based throughput values are supported, and your license PID is numeric: You must not convert to a tier-based throughput value.
You are downgrading to a release where only numeric throughput values are supported and your license PID and throughput configuration are tier-based: You must change configuration to a numeric throughput value, before you downgrade. See Downgrading from a Release Supporting Tiers to a Release Supporting Only Numeric Throughput, on page 37.

How to Configure Available Licenses and Throughput

This section provides information about the tasks you must complete, for the licenses available on the Cisco Catalyst 8000 Edge Platforms Family - before you can start using them.

For a Cisco DNA license: Configure a Boot Level License → Configure Numeric or Tier-Based Throughput → Implement a Smart Licensing Using Policy Topology → Report License Usage (If Applicable).

For an HSECK9 license: Configure a Boot Level License → Implement a Smart Licensing Using Policy Topology → Install SLAC¹ → Enable HSECK9 on applicable platforms²→ Configure Numeric or Tier-Based Throughput → Report License Usage (If Applicable).

For a Cisco UBE, or Cisco Unified CME, or Cisco Unified SRST license: Implement a Smart Licensing Using Policy Topology → Report License Usage (If Applicable).

¹ If a SLAC has been factory-installed by Cisco manufactory (in case of new hardware), skip this step

² Enter the license feature hseck9 command in global configuration mode for Catalyst 8200, and 8300 Series Edge Platforms only.

Configuring a Boot Level License

If you have purchased a Cisco DNA license for a new device, or if you have an existing device and you want to change (upgrade or downgrade, add or remove) the currently configured license on your device, complete the following task.

This sets a boot level license and requires a reload before the configured changes are effective.

SUMMARY STEPS

show version
configure terminal
Depending on whether the device is a physical or virtual one, configure the applicable command:
- For physical platforms: [no] license boot level {network-advantage [addon dna-advantage] | network-essentials [addon dna-essentials] | network-premier [addon dna-premier] }
- For virtual platforms: [no] license boot level {network-advantage {addon dna-advantage} | network-essentials {addon dna-essentials} | network-premier {addon dna-premier} }
exit
copy running-config startup-config
reload
show version
show license summary
Complete usage reporting - if required

DETAILED STEPS

Step	Command or Action	Purpose
Step 1	`show version` Example: Device# show version <output truncated> Technology Package License Information: ----------------------------------------------------------------- Technology Type Technology-package Technology-package Current Next Reboot ----------------------------------------------------------------- Smart License Perpetual network-advantage network-advantage Smart License Subscription dna-advantage dna-advantage <output truncated>	Displays the currently set boot level license. In the accompanying example, Network Advantage and DNA Advantage licences are configured on the device.
Step 2	`configure terminal` Example: Device# configure terminal	Enters global configuration mode.
Step 3	Depending on whether the device is a physical or virtual one, configure the applicable command: For physical platforms: `[no] license boot level {network-advantage [addon dna-advantage] \| network-essentials [addon dna-essentials] \| network-premier [addon dna-premier] }` For virtual platforms: `[no] license boot level {network-advantage {addon dna-advantage} \| network-essentials {addon dna-essentials} \| network-premier {addon dna-premier} }` Example: Device(config)# license boot level network-premier addon dna-premier % use 'write' command to make license boot config take effect on next boot	Sets a boot level license. On all platforms, first configure a network-stack license. Only after this can you configure the corresponding add-on license. In the command syntax note how the configuration of a DNA-stack add-on license is optional on physical platforms, but mandatory on virtual platforms. The accompanying example, shows configuration on a C8300-1N1S-4T2X router, which is a physical platform. The network-stack license, Network Premier and the corresponding add-on license, DNA-Premier are configured.
Step 4	`exit` Example: Device# exit	Exits global configuration mode and returns to privileged EXEC mode.
Step 5	`copy running-config startup-config` Example: Device# copy running-config startup-config Destination filename [startup-config]? Building configuration... [OK] <output truncated>	Saves your entries in the configuration file.
Step 6	`reload` Example: Device# reload Proceed with reload? [confirm] *Dec 8 01:04:12.287: %SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload Command. <output truncated>	Reloads the device. License levels configured in Step 3 are effective and displayed only after this reload.
Step 7	`show version` Example: Device# show version <output truncated> Technology Package License Information: ----------------------------------------------------------------- Technology Type Technology-package Technology-package Current Next Reboot ----------------------------------------------------------------- Smart License Perpetual network-premier network-premier Smart License Subscription dna-premier dna-premier <output truncated>	Displays the currently set boot level license. In the accompanying example, the output confirms that Network Premier and DNA-Premier licenses are configured.
Step 8	`show license summary` Example: Device# show license summary Account Information:	Displays a summary of license usage, which includes information about licenses being used, the count, and status.
Step 9	Complete usage reporting - if required	After you configure a license level, you may have to send a RUM report (Resource Utilization Measurement Report) to CSSM to report license usage information. To know if reporting is required, you can wait for a system message or refer to the policy using show commands. The system message, which indicates that reporting is required: %SMART_LIC-6-REPORTING_REQUIRED: A Usage report acknowledgement will be required in [dec] days. [dec] is the amount of time (in days) left to meet reporting requirements. If using show commands, refer to the output of the `show license status` privileged EXEC command and check the Next ACK deadline field. This means a RUM report must be sent and the acknolwedgement (ACK) from CSSM must be installed by this date. How you send the RUM report, depends on the topology you have implemented in the Smart Licensing Using Policy environment. For more information, see How to Configure Smart Licensing Using Policy: Workflows by Topology.

Installing SLAC for an HSECK9 License

A Smart Licensing Authorization Code (SLAC) is generated in and obtained from Cisco Smart Software Manager (CSSM) portal.

There are multiple ways in which a product may be connected to the CSSM, in order to obtain a SLAC. Each way of connecting to CSSM is called a topology. You must implement one of the supported topologies so you can then install SLAC in the corresponding method.

For information about all the methods, see the Supported Topologies section of the Smart Licensing Using Policy for Cisco Enterprise Routing Platforms document.

Configuring a Numeric Throughput

? Ensure that a boot level license is already configured on the device. See Configuring a Boot Level License, on page 22. In the output of the show version privileged EXEC command ensure that a license is mentioned in the License Level field.

Required Tasks After Installing SLAC

Complete the following required tasks after installing SLAC - only if applicable to the platform:

Platform	Required Tasks After Installing SLAC
For Catalyst 8200 and 8300 Series Edge Platforms	Enter the `license feature hseck9` command in global configuration mode. This enables the HSECK9 license on these platforms.
For the C8500L models of the Catalyst 8500 Series Edge Platforms	Reload the device after installing SLAC.

This task shows you how to change the numeric throughput level on physical and virtual platforms. If you do not configure a throughput level, the platform's default throughput level is effective.

Configuration of a throughput level requires a reload on physical platforms (Catalyst 8200, 8300, and 8500 Series Edge Platforms). A reload is not required for virtual platforms (Catalyst 8000V Edge Software).

Before you begin

Read the Throughput as a Numeric Value, on page 10 and Numeric vs. Tier-Based Throughput Configuration, on page 20 sections.
Ensure that a boot level license is already configured on the device. See Configuring a Boot Level License, on page 22. In the output of the show version privileged EXEC command ensure that a license is mentioned in the License Level field.
If you are configuring throughput greater than 250 Mbps, ensure that you have already installed a Smart Licensing Authorization Code (SLAC) according to the method that applies to your topology in the Smart Licensing Using Policy environment. See Installing SLAC for an HSECK9 License, on page 25.
Note the throughput you are entitled to. This is indicated in the Cisco DNA license PID you purchase.

SUMMARY STEPS

Depending on whether the device is a physical or virtual one, enter the applicable command:
- For physical platforms: show platform hardware throughput crypto
- For virtual platforms: show platform hardware throughput level
configure terminal
Depending on whether the device is a physical or virtual one, configure the applicable command:
- For physical platforms: platform hardware throughput crypto {100M | 10M | 15M | 1G | 2.5G | 250M | 25M | 500M | 50M}
- For virtual platforms: platform hardware throughput level MB {100 | 1000 | 10000 | 15 | 25 | 250 | 2500 | 50 | 500 | 5000}
exit
copy running-config startup-config
reload
Depending on whether the device is a physical or virtual one, enter the applicable command:
- For physical platforms: show platform hardware throughput crypto
- For virtual platforms: show platform hardware throughput level

DETAILED STEPS

Step	Command or Action	Purpose
Step 1	Depending on whether the device is a physical or virtual one, enter the applicable command: For physical platforms: `show platform hardware throughput crypto` For virtual platforms: `show platform hardware throughput level` Example: Device# show platform hardware throughput crypto Current configured crypto throughput level: 250M Level is saved, reboot is not required Current enforced crypto throughput level: 250M Crypto Throughput is throttled at 250M Default Crypto throughput level: 10M Current boot level is network-advantage OR Device# show platform hardware throughput level The current throughput level is 1000000 kb/s	Displays the currently running throughput on the device. In the accompanying examples, The `show platform hardware throughput crypto` sample output is of a physical platform (a C8300-2N2S-4T2X). Here the throughput level is throttled at 250M. The `show platform hardware throughput level` sample output is of a virtual platform (a C8000V).
Step 2	`configure terminal` Example: Device# configure terminal	Enters global configuration mode.
Step 3	Depending on whether the device is a physical or virtual one, configure the applicable command: For physical platforms: `platform hardware throughput crypto {100M \| 10M \| 15M \| 1G \| 2.5G \| 250M \| 25M \| 500M \| 50M}` For virtual platforms: `platform hardware throughput level MB {100 \| 1000 \| 10000 \| 15 \| 25 \| 250 \| 2500 \| 50 \| 500 \| 5000}` Example: Device(config)# platform hardware throughput crypto ? 100M 100 mbps bidirectional thput 10M 10 mbps bidirectional thput 15M 15 mbps bidirectional thput 1G 2 gbps aggregate thput 2.5G 5 gbps aggregate thput 250M 250 mbps bidirectional thput 25M 25 mbps bidirectional thput 500M 1gbps aggregate thput 50M 50 mbps bidirectional thput Device(config)# platform hardware throughput crypto 1G % These values don't take effect until the next reboot. Please save the configuration. OR Device(config)# platform hardware throughput level MB 5000 %Throughput has been set to 5000 Mbps.	Configures the throughput level. The displayed throughput options depend on the device. The following apply to both physical and virtual platforms: At a minimum, you must have configured a network-stack license already. Otherwise the command is not recognized as a valid one on the command line interface. If you are configuring throughput greater than 250 Mbps, you must have already installed SLAC. Options greater than 250 Mbps are displayed only if SLAC is installed. In the accompanying examples, 1 Gbps is configured on the physical platform. Aggregate throughput throttling (Cisco IOS XE Cupertino 17.8.1a and later) is effective. After reboot, irrespective of the distribution of traffic in the upstream and downstream direction, an aggregate throughput limit of 2 Gbps is effective. 5000 Mbps is configured on the virtual platform. A maximum of 5000 Mbps upstream and 5000 Mbps downstream throughput is supported.
Step 4	`exit` Example: Device# exit	Exits global configuration mode and returns to privileged EXEC mode.
Step 5	`copy running-config startup-config` Example: Device# copy running-config startup-config	Saves your entries in the configuration file.
Step 6	`reload` Example: Device# reload	Reloads the device. ? Perform this step only if the device you are configuring throughput on is a physical platform (Catalyst 8200, 8300, and 8500 Series Edge Platforms). ? Skip this step if you are configuring throughput on a virtual platform (Catalyst 8000V Edge Software).
Step 7	Depending on whether the device is a physical or virtual one, enter the applicable command: For physical platforms: `show platform hardware throughput crypto` For virtual platforms: `show platform hardware throughput level` Example: Device# show platform hardware throughput crypto Current configured crypto throughput level: 500M Level is saved, reboot is not required Current enforced crypto throughput level: 500M Crypto Throughput is throttled at 500M Default Crypto throughput level: 10M Current boot level is network-premier OR Device# show platform hardware throughput level The current throughput level is 100000 kb/s	Displays the currently running throughput on the device.

Configuring a Tier-Based Throughput

This task shows you how to configure a tier-based throughput level on physical and virtual platforms. If you do not configure a throughput level, the platform's default throughput level is effective.

Tier-based throughput levels are supported starting with Cisco IOS XE Cupertino 17.7.1a only.

Before you begin

Read the Throughput as a Tier, on page 16 and Numeric vs. Tier-Based Throughput Configuration, on page 20 sections.
Ensure that a boot level license is already configured on the device. See Configuring a Boot Level License, on page 22. In the output of the show version privileged EXEC command, ensure that the license is mentioned.
If you want to configure Tier 3 (T3) ensure that the boot level license is Network Advantage/ DNA Advantage, or Network Premier/DNA Premier. T3 is not supported with Network Essentials and DNA Essentials.
If you are configuring Tier 2 (T2) or a higher tier, ensure that you have already installed a Smart Licensing Authorization Code (SLAC) according to the method that applies to your topology in the Smart Licensing Using Policy environment. See Installing SLAC for an HSECK9 License, on page 25.
On physical platforms, T2 or higher tiers are not displayed if SLAC is not installed.
On virtual platforms, all tier options are displayed even if SLAC is not installed. But SLAC is required if you want to configure T2 or a higher tier.
Note the throughput you are entitled to. This is indicated in the Cisco DNA license PID you purchase.

SUMMARY STEPS

Depending on whether the device is a physical or virtual one, enter the applicable command:
- For physical platforms: show platform hardware throughput crypto
- For virtual platforms: show platform hardware throughput level
show license authorization
configure terminal
Depending on whether the device is a physical or virtual one, configure the applicable command:
- For physical platforms: platform hardware throughput crypto {T0 | T1 | T2 | T3}
- For virtual platforms: platform hardware throughput level MB {T0 | T1 | T2 | T3 }
exit
copy running-config startup-config
reload
Depending on whether the device is a physical or virtual one, enter the applicable command:
- For physical platforms: show platform hardware throughput crypto
- For virtual platforms: show platform hardware throughput level

DETAILED STEPS

Step	Command or Action	Purpose
Step 1	Depending on whether the device is a physical or virtual one, enter the applicable command: For physical platforms: `show platform hardware throughput crypto` For virtual platforms: `show platform hardware throughput level` Example: Device# show platform hardware throughput crypto Current configured crypto throughput level: 250M Level is saved, reboot is not required Current enforced crypto throughput level: 250M Crypto Throughput is throttled at 250M Default Crypto throughput level: 10M Current boot level is network-premier OR Device# show platform hardware throughput level The current throughput level is 10000 kb/s	Displays the currently running throughput on the device. In the accompanying examples: The `show platform hardware throughput crypto` sample output is of a physical platform (a C8300-2N2S-4T2X). Here throughput is currently throttled at 250 Mbps. The `show platform hardware throughput level` sample output is of a virtual platform (a C8000V). Here the current throughput level is 10 Mbps.
Step 2	`show license authorization` Example: Device# show license authorization Overall status: Active: PID:C8300-2N2S-4T2X,SN:FDO2250A0J5 Status: SMART AUTHORIZATION INSTALLED on Mar 02 05:05:19 2022 UTC Last Confirmation code: 418b11b3 Authorizations: Router US Export Lic. for DNA (DNA_HSEC): Description: U.S. Export Restriction Compliance license for DNA based Routers Total available count: 1 Enforcement type: EXPORT RESTRICTED Term information: Active: PID:C8300-1N1S-4T2X,SN:FDO2250A0J5 Authorization type: SMART AUTHORIZATION INSTALLED License type: PERPETUAL Term Count: 1 Purchased Licenses: No Purchase Information Available OR Device# show license authorization Overall status: Active: PID:C8000V,SN:9I8GRCH8CMN Status: NOT INSTALLED	(Optional) Displays SLAC information on the product instance. In the accompanying example: SLAC is installed on the physical platform. This is so we can configure T2 in the subsequent steps. SLAC is not available on the virtual platform. Note how this affects throughput configuration in the subsequent steps.
Step 3	`configure terminal` Example: Device# configure terminal	Enters global configuration mode.
Step 4	Depending on whether the device is a physical or virtual one, configure the applicable command: For physical platforms: `platform hardware throughput crypto {T0 \| T1 \| T2 \| T3}` For virtual platforms: `platform hardware throughput level MB {T0 \| T1 \| T2 \| T3 }` Example: Device(config)# platform hardware throughput crypto ? 100M 100 mbps bidirectional thput 10M 10 mbps bidirectional thput 15M 15 mbps bidirectional thput 1G 2 gbps aggregate thput 2.5G 5 gbps aggregate thput 250M 250 mbps bidirectional thput 25M 25 mbps bidirectional thput 500M 1gbps aggregate thput 50M 50 mbps bidirectional thput Device(config)# platform hardware throughput crypto T2 % These values don't take effect until the next reboot. Please save the configuration. *Mar 02 05:06:19.042: %CRYPTO_SL_TP_LEVELS-6-SAVE_CONFIG_AND_RELOAD: New throughput level not applied until reload; please save config OR Device(config)# platform hardware throughput level MB ? 100 Mbps 1000 Mbps 10000 Mbps 15 Mbps 25 Mbps 250 Mbps 2500 Mbps 50 Mbps 500 Mbps 5000 Mbps T0 Tier0(up to 15M throughput) T1 Tier1(up to 100M throughput) T2 Tier2(up to 1G throughput) T3 Tier3(up to 10G throughput) T4 Tier4(unthrottled) Device(config)# platform hardware throughput level MB T2 %Requested throughput will be set once HSEC authorization code is installed	Configures a tier-based throughput. The throughput options that are displayed, depend on the device. ? Only tiers are mentioned in command, for the sake of clarity. When you enter the command on the CLI, numeric and tier values are displayed - as shown in the accompanying examples. The following apply to both physical and virtual platforms: You have configured a boot level license already. Otherwise the command for throughput configuration is not recognized as a valid one on the command line interface. If you are configuring T2 or a higher tier, you have installed SLAC. ? On a physical platform, you will not be able to configure T2 or a higher tier if SLAC is not installed. ? On a virtual platform, if you configure T2 or a higher tier without SLAC, the product instance automatically tries to reach CSSM to request and install SLAC. If it is successful, throughput is set to the configured tier. If it is not successful, the system sets the throughput to 250 Mbps. If and when SLAC is installed, the throughput is automatically set to the last configured value. In the accompanying examples: On the physical platform (`platform hardware throughput crypto`), tiers T2 and higher tiers are displayed, because SLAC is installed. If SLAC were not available, T1 would have been the highest tier displayed. Further, aggregate throughput throttling (Cisco IOS XE Cupertino 17.8.1a and later) is effective. After reboot, irrespective of the distribution of traffic in the upstream and downstream direction, an aggregate throughput limit of 2 Gbps is supported. On the virtual platform (`platform hardware throughput level MB`), all tiers are displayed. After T2 is configured, the system message alerts you to the fact that the configuration is not set, because SLAC is not installed.
Step 5	`exit` Example: Device# exit	Exits global configuration mode and returns to privileged EXEC mode.
Step 6	`copy running-config startup-config` Example:	Saves your entries in the configuration file.
Step 7	`reload` Example: Device# reload Proceed with reload? [confirm] *Mar 02 05:07:00.979: %SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload Command.	Reloads the device. ? A reload is required only for physical platforms.
Step 8	Depending on whether the device is a physical or virtual one, enter the applicable command: For physical platforms: `show platform hardware throughput crypto` For virtual platforms: `show platform hardware throughput level` Example: Device# show platform hardware throughput crypto Current configured crypto throughput level: T2 Level is saved, reboot is not required Current enforced crypto throughput level: 1G Crypto Throughput is throttled at 2G(Aggregate) Default Crypto throughput level: 10M Current boot level is network-premier OR Device# show platform hardware throughput level The current throughput level is 250000 kb/s	Displays the currently running throughput on the device. In the accompanying examples: On the physical platform, the tier value is set to T2. On the virtual platform, throughput is set to 250 Mbps. If and when SLAC is installed, the throughput will be automatically set to the last configured value, which is T2. ? On physical platforms, you can also enter the `show platform hardware qfp active feature ipsec state` privileged EXEC command to display the configured throughput level.

Converting From a Numeric Throughput Value to a Tier

This task shows you how to convert a numeric throughput value to a tier-based throughput value. To know how numeric throughput values are mapped to tier values refer to the table here: Tier and Numeric Throughput Mapping.

Converting the throughput level requires a reload on physical platforms (Catalyst 8200, 8300, and 8500 Series Edge Platforms). A reload is not required for virtual platforms (Catalyst 8000V Edge Software).

Before you begin

Read the Numeric vs. Tier-Based Throughput Configuration, on page 20 section.
If you are converting numeric throughput that is equal or greater than 250 Mbps, ensure that a SLAC is installed on the device. See Installing SLAC for an HSECK9 License, on page 25.
The software version running on the product instance is Cisco IOS XE Cupertino 17.7.1a or a later release.

SUMMARY STEPS

Depending on whether the device is a physical or virtual one, enter the applicable command:
- For physical platforms: show platform hardware throughput crypto
- For virtual platforms: show platform hardware throughput level
Depending on whether the device is a physical or virtual one, enter the applicable command:
- For physical platforms: license throughput crypto auto-convert
- For virtual platforms: license throughput level auto-convert
copy running-config startup-config
reload
Depending on whether the device is a physical or virtual one, enter the applicable command:
- For physical platforms: show platform hardware throughput crypto
- For virtual platforms: show platform hardware throughput level
Verify that conversion is complete.
- For physical platforms: license throughput crypto auto-convert
- For virtual platforms: license throughput level auto-convert

DETAILED STEPS

Step	Command or Action	Purpose
Step 1	Depending on whether the device is a physical or virtual one, enter the applicable command: For physical platforms: `show platform hardware throughput crypto` For virtual platforms: `show platform hardware throughput level` Example: Device# show platform hardware throughput crypto Current configured crypto throughput level: 500M Level is saved, reboot is not required Current enforced crypto throughput level: 500M Crypto Throughput is throttled at 500M Default Crypto throughput level: 10M Current boot level is network-premier OR Device# show platform hardware throughput level The current throughput level is 100000 kb/s	Displays the currently running throughput on the device.
Step 2	Depending on whether the device is a physical or virtual one, enter the applicable command: For physical platforms: `license throughput crypto auto-convert` For virtual platforms: `license throughput level auto-convert` Example: Device# license throughput crypto auto-convert Crypto throughput auto-convert from level 500M to T2 % These values don't take effect until the next reboot. Please save the configuration. *Dec 8 03:21:01.401: %CRYPTO_SL_TP_LEVELS-6-SAVE_CONFIG_AND_RELOAD: New throughput level not applied until reload; please save config OR Device# license throughput level auto-convert %Throughput tier set to T1 (100 Mbps) % Tier conversion is successful. Please write memory to save the tier config	Converts the numeric throughput to a tier-based throughput value. The converted tier value is displayed on the CLI.
Step 3	`copy running-config startup-config` Example:	Saves your entries in the configuration file. ? Even though the command you use to convert from numeric to tier-based throughput is a privileged EXEC command, it changes running configuration from a numeric value to a tier-based value. You must therefore save configuration for the next reload to be displayed with a tier value.
Step 4	`reload` Example:	Reloads the device. ? A reload is required only on physical platforms.
Step 5	Depending on whether the device is a physical or virtual one, enter the applicable command: For physical platforms: `show platform hardware throughput crypto` For virtual platforms: `show platform hardware throughput level` Example: Device# show platform hardware throughput crypto Current configured crypto throughput level: T2 Level is saved, reboot is not required Current enforced crypto throughput level: 1G Crypto Throughput is throttled at 1G Default Crypto throughput level: 10M Current boot level is network-premier	Displays the currently running throughput on the device.

Upgrading from a Release Supporting Numeric Throughput to a Release Supporting Tiers

If you are upgrading to Cisco IOS XE Cupertino 17.7.1 or later release and the license PID is a tier-based one, you can convert throughput configuration to a tier-based value, or you can retain the numeric throughput configuration.

? There is no functional impact if you have tier-based license PID in CSSM and a numeric throughput value is configured on the device.

If you want to convert to a tier-based value note the required action depending on the throughput level that is configured:

Throughput Configuration Before Upgrade	Action Before Upgrade	Action After Upgrade to 17.7.1 or Later
Lesser than 250 Mbps	No action required.	Converting From a Numeric Throughput Value to a Tier, on page 33
Equal to 250 Mbps	Obtain an HSECK9 license and install SLAC if you want to convert to T2.	Converting From a Numeric Throughput Value to a Tier, on page 33
Greater than 250 Mbps	No action required.	Converting From a Numeric Throughput Value to a Tier, on page 33

Downgrading from a Release Supporting Tiers to a Release Supporting Only Numeric Throughput

❗ If you are downgrading to a release where only numeric throughput configuration is supported, you must convert tier-based throughput configuration to a numeric throughput value before downgrade. This is applicable even if the license PID is a tier-based license PID.

❗ If a tier-based throughput value was configured before downgrade and you downgrade without changing to a numeric value, tier configuration is not recognized by a pre-17.7.1 image and configuration fails. Further, throughput may not be restored to the pre-downgrade level and you have to configure a numeric throughput level after downgrade.

Throughput Configuration Before Downgrade	Action Before Downgrade	Action After Downgrade to a pre-17.7.1 Version
Numeric	No action required.	No action required.
Tier	Configuring a Numeric Throughput, on page 26	No action required.

Available Licensing Models

The licensing model defines how you account for or report the licenses that you use, to Cisco. The following licensing models are available on the Cisco Catalyst 8000 Edge Platforms Family:

Smart Licensing Using Policy

With this licensing model, you purchase the licenses you want to use, configure them on the device, and then report license usage as required. You do not have to complete any licensing-specific operations, such as registering or generating keys before you start using the software and the licenses that are tied to it - unless you are using export-controlled and enforced licenses.

This licensing model is supported on all products in the Cisco Catalyst 8000 Edge Platforms Family.

For more information, see Smart Licensing Using Policy for Cisco Enterprise Routing Platforms.

Pay As You Go (PAYG) Licensing

? This licensing model is available only on Catalyst 8000V Edge Software.

Cisco Catalyst 8000V supports the PAYG licensing model with Amazon Web Services (AWS) and Microsoft Azure Marketplace - in both the autonomous mode and the controller mode. The Cisco Catalyst 8000V hourly-billed Amazon Machine Image (AMI) or the Pay As You Go licensing model allows you to consume an instance for a defined period of time.

In the autonomous mode, you can directly launch an instance from the AWS or Azure Marketplace and start using it. The licenses are embedded in the image and the selected license package and configured throughput level are effective when you launch the instance
In the controller mode, which is supported from Cisco IOS-XE Bengaluru 17.5.1, you must first onboard the device into Cisco SD-WAN as per Onboard Cisco Catalyst 8000V Edge Software Hosted by a Cloud Service, Using PAYG Licensing. After this, when you launch the instance from AWS, the device comes-up with the license already installed for unlimited throughput.

Managed Service Licensing Agreement

Managed Service Licensing Agreement (MSLA) is a consumption-based software licensing model designed for Cisco's Managed Service Provider business.

MSLA in Cisco SD-WAN Controller Mode

In the Cisco SD-WAN controller mode, an MSLA is supported on all products in the Cisco Catalyst 8000 Edge Platforms Family. For more information, see:

Managed Service Licensing Agreement (MSLA) for Cisco SD-WAN At-a-Glance
Cisco SD-WAN Getting Started Guide → Manage Licenses for Smart Licensing Using Policy.
Cisco vManage How-Tos for Cisco IOS XE SD-WAN Devices → Manage Licenses for Smart Licensing Using Policy.

MSLA in Autonomous Mode

In the autonomous mode, an MSLA is available only with Catalyst 8000V Edge Software, starting from Cisco IOS XE Cupertino 17.9.1a.

Here, you begin by entering into an MSLA with Cisco, and purchase licenses with subscription IDs.

Licenses with subscription IDs can be ordered on Cisco commerce workspace (CCW). Ordered licenses are deposited in the specified Smart Account and Virtual Account in CSSM, with the corresponding subscription IDs.

To complete licensing workflows, you must implement a supported topology. After CSSM receives license usage information, you are billed based on the throughput and the Cisco DNA subscription tier that is activated and in-use. For more information, see: MSLA and Utility Mode.

	Cisco Catalyst 9300 Series: Understanding and Configuring Licenses A comprehensive guide to managing licenses for Cisco Catalyst 9300 Series Switches, including Network Essentials, Network Advantage, DNA Essentials, DNA Advantage, and the HSECK9 export control key. Learn about installation, configuration, and best practices.
	Cisco Catalyst SD-WAN Licensing Guide This document provides a comprehensive guide to DNA licensing for Cisco Catalyst SD-WAN, covering subscription benefits, licensing models, and configuration steps for various Cisco routing platforms.
	Cisco Catalyst 9500 Series Switches Datasheet A comprehensive datasheet detailing the features, specifications, software, licensing, and support for the Cisco Catalyst 9500 Series high-performance enterprise network switches, built for security, IoT, and cloud environments.
	Cisco FlexConnect Bonjour Deployment Guide for Cisco DNA Service A comprehensive guide detailing the deployment of Cisco DNA Service for Bonjour with Cisco FlexConnect wireless networks, enabling seamless service discovery and distribution across wired and wireless environments.
	Cisco K-12 EDU SKU Product Family: Switching and Wireless Solutions Explore the Cisco K-12 EDU SKU Product Family, featuring specialized switching and wireless solutions designed for educational institutions. This guide details product families, support matrices, SKU lists, and E-Rate eligibility.
	Cisco Catalyst 8000 Edge Platforms: SD-WAN and SASE Solutions Explore the Cisco Catalyst 8000 Series Edge Platforms, designed for SD-WAN and SASE, offering high performance, advanced security, and flexible deployment options. Includes specifications, modules, and Cisco DNA licensing details.
	Cisco Catalyst 9136 Series Access Points Deployment Guide A comprehensive deployment guide for Cisco Catalyst 9136 Series Access Points, covering Wi-Fi 6E technology, hexa-radio architecture, installation, configuration, and advanced features like IoT integration and AI/ML-driven scanning.
	Cisco DNA Software for SD-WAN and Routing Ordering Guide This guide provides comprehensive instructions for ordering Cisco DNA Software subscriptions for SD-WAN and Routing. It covers platform selection, software types, subscription tiers, bandwidth entitlements, and the ordering process, including smart account and virtual account setup, as well as services and security features.

Licenses and Licensing Models

Feature Information for Available Licenses and Licensing Models

Available Licenses

Cisco DNA License

Network-stack licenses:

Network Premier:

DNA-stack add-on licenses:

Network-stack licenses:

DNA-stack add-on licenses:

Guidelines for Using a Cisco DNA License

Ordering Considerations for a Cisco DNA License

High Security License

Guidelines for Using an HSECK9 License

Ordering Considerations for an HSECK9 License

Cisco CUBE License

Cisco Unified CME License

Cisco Unified SRST License

Throughput

Encrypted and Unencrypted Throughput

Throttled and Unthrottled Throughput

Where to Find Throughput Information for a Device

Throughput as a Numeric Value

Throughput and System Hardware Throttling Specifications in the Autonomous Mode

Throughput and System Hardware Throttling Specifications in the Autonomous Mode

Throughput and System Hardware Throttling Specifications in the SD-WAN Controller Mode

Throughput as a Tier

Tier and Numeric Throughput Mapping

Numeric vs. Tier-Based Throughput Configuration

Figure 1: Numeric and Tier Values Displayed in the CSSM Web UI

How to Configure Available Licenses and Throughput

Configuring a Boot Level License

SUMMARY STEPS

DETAILED STEPS

Installing SLAC for an HSECK9 License

Configuring a Numeric Throughput

Required Tasks After Installing SLAC

Before you begin

SUMMARY STEPS

DETAILED STEPS

Configuring a Tier-Based Throughput

Before you begin

SUMMARY STEPS

DETAILED STEPS

Converting From a Numeric Throughput Value to a Tier

Before you begin

SUMMARY STEPS

DETAILED STEPS

Upgrading from a Release Supporting Numeric Throughput to a Release Supporting Tiers

Downgrading from a Release Supporting Tiers to a Release Supporting Only Numeric Throughput

Available Licensing Models

Smart Licensing Using Policy

Pay As You Go (PAYG) Licensing

Managed Service Licensing Agreement

MSLA in Cisco SD-WAN Controller Mode

MSLA in Autonomous Mode

Related Documents