Cisco DNA licenses do not pay for active ports

Paying for Cisco DNA does not keep a switch's ports powered on. In a typical Catalyst 9000 purchase, an organization receives two different rights: a perpetual Network license for the switch's own features and a term-based Cisco DNA or Cisco Catalyst subscription for centralized management, automation, analytics, and related services. When both items sit in one bill of materials, people easily mistake them for a single annual license.

That mistake produces two bad budgets. In the first, the organization does not renew even though the network depends on SD-Access and Assurance. In the second, it budgets for something close to another purchase of the base features every year, even though it has already paid for the perpetual Network tier. A sound calculation starts with three entries for each SKU, not with a percentage of the hardware price: the Network tier, the subscription tier, and the exact end date.

One shipment contains two different rights

On Catalyst 9000, the base Network Essentials or Network Advantage tier is perpetual, while the DNA Essentials or DNA Advantage add-on has a term. Current Cisco materials also use the names Catalyst Essentials, Catalyst Advantage, and newer unified switching offers. The commercial package name may change, but the entitlement type column matters for the calculation: perpetual means an ongoing right, while subscription or term means a right with a fixed end date.

The Cisco Catalyst 9000 Licensing White Paper separates these items explicitly. It lists Network Essentials and Network Advantage as mandatory one-time perpetual purchases, and Cisco DNA Essentials and Cisco DNA Advantage as mandatory subscriptions for 3, 5, or 7 years with the initial order. A new Catalyst 9000 therefore cannot usually be bought with a bare operating system, but that does not turn all of IOS XE into rented software.

The Network Essentials plus DNA Essentials pair is not available for every model. For example, the documentation specifies Network Advantage and DNA Advantage for Catalyst 9600. Compatible combinations, port counts, and platform identifiers are built into the SKU, so a buyer cannot copy a subscription price from a 24-port model to a 48-port model or from one series to another.

A contract should separate four concepts that procurement teams often mix together:

• the right to use Network features;
• the term-based right to DNA or Catalyst features;
• software and technical support;
• entitlement management through a Smart Account.

These are separate accounting objects. A Smart Account displays rights but does not create them, and a service contract does not replace a feature subscription.

A specification should make that distinction visible without asking an account manager to decode it. The hardware line answers what physical equipment will be delivered. The Network line records the permanent feature tier. The term subscription line states the duration and quantity. Support should have its own line, or the document should identify the subscription SKU that includes it. If all four items are rolled into one system price, finance cannot distinguish the one-time component from the renewable one and will receive an invoice several years later that nobody can verify.

Changing names creates another trap. An older project may use Cisco DNA Advantage while a new quote contains Catalyst Advantage or Switching Advantage under another subscription model. A shared word such as Advantage does not guarantee the same contents. During a migration, compare entitlements and features line by line, record any credit for unused term, and only then align the dates. Otherwise, a supposed naming update quietly changes support or management rights.

Switching does not disappear when the subscription ends

A switch with a valid perpetual Network license continues to perform the functions allowed by that tier after DNA expires. It should not shut down its ports at midnight, delete VLANs, or stop routing solely because the subscription date passed. In Configuring Licenses on Cisco Catalyst 9000 Series Switches, Cisco says that after the add-on license is deactivated and the device is reloaded, the switch continues operating with base-license capabilities.

The wording needs to be exact. “The hardware continues to work” does not mean “the entire current architecture remains licensed.” If a configuration or operating process depends on term-tier capabilities, the right to those capabilities ends. In IOS XE releases with Smart Licensing Using Policy, many entitlements have Enforcement type: NOT ENFORCED. The device may not block a feature technically, but the absence of a software lock does not extend the contractual right to use it.

A lab test that moves the date forward and sees traffic still flowing therefore creates false confidence. It answers a question about the behavior of one IOS XE image, but it says nothing about the organization's right to use a DNA feature, receive related updates, or ask for support. An audit looks at the order, Smart Account, offer terms, and actual license consumption.

Without renewal, plan only for the features that the matrix assigns to the purchased Network tier. Everything else must either be renewed or removed from service in advance and tested after a reload. Treat that transition as a network change, not an accounting note.

The most troublesome failure may not affect ordinary packet forwarding. The network can keep serving users while the team can no longer bring a new switch online with the same automated process, Assurance no longer provides the familiar diagnostics, and a group-policy change needs another procedure. During a quiet week that may appear manageable. During a mass replacement after an outage, the team discovers that its recovery procedure depended on the expired subscription. Testing must therefore cover operational and recovery tasks, not only a ping between two VLANs.

Do not confuse subscription expiry with the end of hardware support either. Hardware warranty, replacement service, the right to contact TAC, IOS XE updates, and Catalyst Center support can each have a different basis and date. Cisco has changed the support contents of different commercial offers over time. Use the order line and the service description, not a broad statement that “DNA includes support.”

The perpetual tier defines the minimum capability

Network Essentials and Network Advantage define the features that remain on the device without an active DNA subscription. According to Cisco's matrix, the base capabilities include Layer 2 switching, routed access, QoS, 802.1X, first-hop security mechanisms, and some routing protocols. The exact set depends on the series, model, and IOS XE release, so a short list in a quote does not replace the Cisco Switching Licensing Feature Matrix and Cisco Feature Navigator.

The difference between Essentials and Advantage is substantial. Advantage is required for a broader range of routing, segmentation, and features that Essentials does not cover. An error in the initial order outlives the subscription itself: if an organization bought Network Essentials, the end of DNA Advantage does not leave it with Network Advantage by default.

Before buying, create a table with three columns: used feature, required tier, and device. Enter technologies that are actually enabled, not a wish list for later: dynamic routing protocols, VRFs, encryption, telemetry, programmable interfaces, fabric, and centralized policy. For each row, the engineer should identify the document and version used to confirm the tier.

Pay particular attention to features that Cisco moved between tiers over time or enabled in particular IOS XE releases. An old partner slide may say a feature requires DNA Advantage while the current matrix assigns it to Network Advantage, or the current material may add a platform restriction. A five-year budget cannot rest on a presentation without a version number.

If that review shows the network uses only the perpetual feature set, declining renewal may be technically possible. The organization must still decide separately how it will handle support, updates, and management. Do not hide those expenses under the word “license.”

Also compare the tier the device actually consumes with the tier the organization bought. After an RMA replacement, a Smart Account migration, or a manual license-level change, these values sometimes diverge. The configuration may require Advantage while the order contains Essentials, or the pool may hold entitlements while the device reports into a different Virtual Account. Fixing that mismatch before expiry is usually an administrative task. After expiry and a change of staff, it becomes a separate project involving procurement and support.

For a long lifecycle, store a snapshot of the matrix with the design documentation. It does not replace the current matrix, but it explains the basis for the architects' decision at purchase time. When IOS XE is upgraded, the engineer repeats the review and records any change. That record can show that a tier increase comes from a new feature rather than a more expensive package left in the budget out of habit.

The subscription pays for centralized workflows

Organizations buy DNA Essentials and Advantage for functions beyond local switch configuration. Essentials generally covers basic automation, Plug and Play, centralized management, inventory, image management, and basic monitoring through Cisco Catalyst Center. Advantage adds more complex use cases, including SD-Access, segmentation policy, advanced Assurance, and analytics. The exact contents depend on the active offer and release.

When the term ends, the organization loses the right to use subscription capabilities for the relevant number of devices. In practice, the risk is most visible in four places:

• Catalyst Center reports expired entitlements and no longer has a current entitlement to manage those devices;
• deployment and operations automation, Assurance, and subscription analytics are no longer covered by a license;
• SD-Access and related policy use cases cannot be treated as lawfully renewed merely because an existing fabric still forwards packets;
• software support, updates, or cloud entitlements included in the offer end under the terms of the specific SKU.

Not every item will necessarily turn off with one command at the same second. Catalyst Center, a cloud service, and IOS XE itself behave differently. An answer such as “Assurance will stop working” is too broad without a release number and subscription type. The precise statement is that the right ends, the management interface records the expiry, and the technical restriction must be checked in the guide for the installed version.

Cisco publishes a separate switching subscription matrix. It associates Network with manual management and WebUI, while DNA or a Catalyst subscription covers automation through Catalyst Center. That boundary is more useful than a marketing list: if daily operations depend on the controller, renewal belongs in the network operating model.

Measure that dependency by operations. Identify who creates templates, deploys images, supplies network settings to new devices, changes fabric policy, and investigates client complaints. If the team performs these actions through Catalyst Center, the subscription pays for a production process. If the controller is only an attractive inventory screen, reconsider the tier. The presence of an installed server proves nothing by itself.

Cloud entitlements need separate care. Some Advantage packages have included limited rights to related services, such as ThousandEyes tests, but the allowance and rules depended on the offer generation. Do not carry such a right to another model or term from memory. Either confirm it in the current matrix with the relevant unit count or budget it as a separate purchase. This prevents a plan from relying on a feature that “used to be included” but is absent from the new SKU.

Smart Licensing records consumption, it does not sell access

Smart Licensing and a DNA subscription answer different questions. The subscription determines which features were purchased and until what date. Smart Licensing Using Policy collects information about the entitlements a device consumes, associates them with a Smart Account, and sets reporting rules.

On Catalyst 9000 with IOS XE 17.3.2 and later, Cisco uses Smart Licensing Using Policy. The model supports a direct connection to Cisco Smart Software Manager, operation through Cisco Smart Licensing Utility, or local infrastructure for isolated networks. A lack of permanent internet access does not by itself mean there is no license, but the organization must configure a supported route for reports and acknowledgments.

An engineer can quickly see both tiers on the switch:

Device# show license summary
License Usage:
  License                 Entitlement Tag               Count Status
  network-advantage       (C9300-48 Network Advan...)       1 IN USE
  dna-advantage           (C9300-48 DNA Advantage)          1 IN USE

This output shape comes from Cisco's command reference. It shows consumption but does not replace checking the term in Cisco Smart Software Manager. Use show license usage and show license status for detail; in the Smart Account, compare the quantity, Start Date, Expiration Date, order, and Virtual Account.

The IN USE status means the device is declaring an entitlement. It does not prove that the pool contains an unexpired right. Likewise, NOT ENFORCED describes the enforcement mechanism on the device, not a free mode. I have seen plenty of registers where a green CLI status was taken as proof of a paid term even though the date was visible only to the owner of another Virtual Account.

For an isolated network, the task is more than stating that internet access is forbidden. The architect selects a Cisco-supported method for moving the usage report, assigns an owner for export and acknowledgment, sets a schedule, and checks the ACK log. If reports move manually, put the procedure in the operating runbook and test it after an IOS XE upgrade. A broken accounting channel should not be discovered at the same time as a renewal request.

A Smart Account also needs role redundancy. The organization needs at least two active administrators, a clear Virtual Account structure, and a corporate address for alerts. Rights registered to an employee's personal address or held in a supplier's account may formally exist, but the customer does not control them. Correct ownership during acceptance while the order number and delivery team remain available.

The term does not start at network commissioning

Calculate the end date from the Subscription Start Date, not installation, an internal acceptance document, or the switch's first registration. Cisco's Catalyst FAQ says the start can be delayed by no more than 60 days from the order leaving the fulfillment center. Terms can vary by offer, so the date in the order and Smart Account takes precedence over an engineer's assumption.

This creates a common gap in projects with long logistics. A batch ships in March, reaches the warehouse in May, installation finishes in August, and production begins in October. If nobody arranged a delay, several months of the subscription have elapsed before Catalyst Center sees the first switch.

Record four dates for every order line: shipment, subscription start, subscription end, and planned commissioning. The difference between the second and fourth shows the unused period. For partial deliveries, do not assign the entire batch an assumed anniversary until the supplier has confirmed co-term or date alignment.

The initial Catalyst 9000 order normally uses a term of 3, 5, or 7 years. Cisco allows a one-year option at renewal, but that does not mean a new switch can always be purchased with a one-year subscription. In practice, a longer term reduces the risk of a budget gap, while a short renewal creates an opportunity to leave an unnecessary tier. Choose according to architecture and replacement schedule, not a desire for the smallest line price.

At acceptance, I require an export with the actual Start Date and Expiration Date. A certificate or invoice without those fields does not prove how much useful term remains.

Do not calculate the date by simply adding three calendar years to the contract signature. The start may be tied to order fulfillment, while co-term intentionally aligns the end of several lines. A new license added in the middle of a shared term may be sold for a shorter period until the common anniversary. Its price should correspond to that period. Store both system dates in the register and use the formula only as a check, never as a replacement for Cisco's data.

If delivery is split into stages, repeat the start condition for every stage. The phrase “five-year subscription” without calendar dates is insufficient because the first and last batches may receive different numbers of useful months. Tender documents should require the supplier to disclose start, end, and the compensation mechanism for equipment delays to the extent the vendor's offer permits it.

Build the annual budget from the net term price

For internal budgeting, the annual DNA cost equals the discounted subscription line price divided by the number of months in the term and multiplied by 12. That is a management allocation, not a promise of an annual invoice. The supplier may bill the entire amount upfront, while tax, currency, and payment terms change the cash schedule.

A working formula for a batch is:

Annual burden = total net prices of term SKUs / term in years + separate support + allowance for currency and tax

Suppose an organization buys 40 switches with three-year DNA Essentials and 8 switches with five-year DNA Advantage. The calculation uses the two actual prices from the quote, not an average price “per switch.” Divide the first group by 3 and the second by 5, then add only services that are not already included in the selected SKUs. No currency amounts appear here deliberately: a price without model, port count, country, discount, and quote date is misleading.

The register should have one row per commercial SKU even if finance only wants to see a site total. Use at least these columns:

• site, model, serial number, and physical device quantity;
• Network tier and its perpetual status;
• subscription tier, SKU, start, and end;
• Smart Account, Virtual Account, and renewal owner;
• net term price, currency, tax, and budget payment year.

Do not automatically count a stack as one logical switch. Licensing normally counts physical members and corresponding entitlements, which is visible in the Count field from show license usage. The same applies to standby equipment: if a spare switch is powered on and consumes a right, it cannot disappear from the budget.

For TCO, add internal work that changes with the selected tier. Catalyst Center needs operations, backups, upgrades, and team skills. Declining the subscription, on the other hand, can increase manual configuration and recovery time. Those hours are not in the license SKU, but comparing the options without them is misleading. A cheap tier with constant manual changes can cost more than the subscription, while an expensive tier without active automation remains wasted spending.

Budget renewal through scenarios. The base case keeps the current quantity and tier, the growth case adds an approved batch, and the exit case removes devices due for retirement before renewal. Apply the finance team's expected exchange rate and tax rules to each. Do not mechanically index an old price: a new offer model, a different term, and a changed discount can create a larger difference than the inflation factor.

Renewal should follow the actual architecture

Renewing every license at its previous tier is convenient for a seller but not always necessary for the network. At 120 to 180 days before expiry, the engineer should compare real use cases with the current matrix. If a site no longer uses Catalyst Center, SD-Access, or subscription analytics, consider a lower tier or removal of the add-on after proper deactivation. If the controller manages configurations and policy every day, saving on the subscription causes an unplanned redesign of operations.

The popular advice “do not renew because the ports will stay up” is wrong for two reasons. It ignores the contractual right to subscription features and the process dependency on Catalyst Center. The opposite claim, “without DNA the switch becomes a brick,” is also wrong because the perpetual Network stack remains.

Before deciding not to renew, run a controlled test on a device with the same model and IOS XE version. The engineer records the active license level, exports the configuration, compares features with the matrix, deactivates the add-on according to Cisco's guide, and performs the required reload. The test then covers routing, access, 802.1X, telemetry, image management, and emergency procedures. One successful packet transfer is not enough.

For a mixed estate, align renewal dates with the budget cycle when commercial terms allow co-term. The alignment must not consume a paid remainder without a credit. Cisco describes the ability to align dates and add licenses to an existing subscription in newer Cisco Networking Subscription models; an order still needs an explicit start date, end date, and calculation for unused term.

As a vendor-neutral system integrator, GSE.kz can connect an infrastructure delivery project with the broader operating and support plan instead of leaving the license register as an invoice attachment. The customer's architect should still own the final tier decision.

Record renewal decisions by site, not as one sentence for the entire estate. A campus using SD-Access may retain Advantage, a small branch may move to Essentials, and a standalone site may remain on perpetual Network with suitable support. That division works only with correct device accounting and compatible tiers. It creates more register rows, but the organization pays for active use cases rather than a shared name across every branch.

An exit plan must exist before declining the subscription. It identifies the replacement for templates, the fallback deployment method, image source, client diagnostics, policy management, and the owner of manual operations. If any mandatory process has no replacement, the exit is not ready. A one-year renewal can then be a reasonable price for an orderly migration, not a pointless delay.

Acceptance ends with three-way reconciliation

Licenses are accepted when the order, Smart Account, and actual device consumption match. Hardware in a warehouse and a PDF from the supplier do not prove that. The most expensive error appears three years later: an entitlement sits in the wrong Virtual Account, the term started too early, and the employee with access has left.

Put a five-action check in the acceptance record:

1. Match models, port counts, quantity, and term of every term SKU against the commercial order.
2. Open the Smart Account and record the Start Date, Expiration Date, Virtual Account, and available administrators.
3. Run show license summary, show license usage, and show license status on a sample of each device type.
4. Compare Count with the physical quantity, including stack members, spares, and replaced serial numbers.
5. Set a budget-owner reminder at least 180 days out and another technical review at 120 days.

Cisco Smart Software Manager can send expiry alerts, but notifications reach only people with correct access and preferences. Email does not replace an entry in the corporate calendar and contract register.

Budget the complete term line for the mandatory initial period of a new batch, even if the financial model displays an average annual cost. Create a separate renewal forecast for the architectural life of the site. If switches will be replaced after four years, a seven-year subscription needs an explicit justification. If the fabric must run for seven years, a three-year purchase with no renewal line simply moves a known expense into somebody else's budget.

A good specification answers one simple question without the supplier's help: which function is paid perpetually, which is paid until a stated date, and who will make the decision before that date. Until it does, the batch price is not complete.