Traditionally, Cisco licensing has offered a perpetual licensing model in which you buy once and keep the license through the life of the hardware. Once that hardware has been replaced, the license is obsolete, and the new hardware will need its own set of license(s). In the event you RMA the device, you’re eligible for a one time transfer of that license to the new hardware but for all intents and purposes that is the exception to the rule. This is true for all hardware.

The software features you buy on top of the hardware are licensed separately and require their own support contract. If you want to get IPS (Intrusion Prevention System) feature for your firewall, you’ll need a software license or entitlement.

This leads to a situation where one single device will have two support contracts associated to it. One for the hardware failure and the underlying operating system and another for the software support and updates you’d get specific to the IPS example above.

This perpetual method of ownership still requires you to have a support contract at all times to get the latest updates. What happens if you let the support lapse but keep the Cisco licensing? The core feature of the IPS module will continue to work as is. However, the module will stop receiving the latest threat updates leaving you more vulnerable to new threat vectors. You would also not be eligible to call Cisco support (TAC) and get assistance with the IPS software module.

Before we get into the meat of the article, if you are currently having problems with keeping track of all of your Cisco assets, we recommend having a read about Acela. Acela is a IT asset management tool built specifically for Cisco customers.

There are two models and SKU’s you’ll normally see on your order and build of material sheets; Smartnet (SNT) and Software Support Services (SWSS). At a glance, these might look quite similar but there are fundamental differences that, if not accounted for, can leave a company vulnerable to security threats or extended downtime. In this article, we’ll examine the differences.

Smartnet only applies to the hardware. Depending on the level purchased, you get anywhere from 8x5xNBD (next business day) up to 24x7x2hours replacement on that hardware. This also grants you operating system updates similar to getting Windows updates while your Smartnet is valid.

Software Support Service (SWSS) has one single purpose. To keep the software add-on features updated and eligible for support.

Now let’s revisit our earlier example with more detail to see how these apply in a real-world scenario. Let’s say you have a Cisco Firepower NGFW (Next-Gen Firewall) with AMP (Advanced Malware Protection), IPS (Intrusion Prevention System) and URL Filtering. You are up for renewal. You get a build of materials that has an SNT and SWSS SKU’s on it. You choose to buy the SNT but leave out the SWSS because you assume the hardware replacement will cover the software and could even be cheaper.

The SNT gets renewed and things seem to work as before. Two months down the road, you’re looking into the URL module to and realize it hasn’t been receiving updates for some time. You call support and provide your details. Support will now tell you that while your hardware is in coverage you are not eligible for signature updates due to the lack of SWSS (software support services). You now have to work with your Cisco team and “re-instate” coverage which is often more expensive than keeping it current.

Let’s flip the scenario. You bought SWSS but left out SNT (Smartnet). You experience a hardware failure. You call support and they’ll tell you the reverse. There’s nothing they can do with helping you replace your hardware and you’ll need to contact your Cisco Account Team to buy new hardware with new licenses attached to it. The whole SNT and SWSS cycle starts again.

The lesson here is to always ensure that your Smartnet and Software subscriptions remain in sync to avoid these scenarios that we see all too often. The larger the environment, the higher the operation overhead this creates.

There are significant challenges, especially in larger and geographically dispersed organizations, to keep your support and Cisco licensing in harmony given that growth and purchasing needs can originate from various sides of the business. Different teams and cost centres can also have their own strategies as to what they consider best practices. This leads to a lot of operational challenges and it’s not uncommon to sense dread in an organization around “renewal time.”

This is the bane of most IT and procurement teams as it requires a lot of manual inventory, reconciliation, lifecycle management and roadmap reviews. Many excel spreadsheets are passed around and many meeting hours are used up for a process that should take a fraction of the time. This continuous burden and pushback from customers force Cisco to think and innovate around the issue.

This think tank led to the formation of Cisco Enterprise Agreements.

Cisco Enterprise Agreements came to light when organizations asked for a more agile way handling their Cisco licensing needs, especially when considering that the majority of the new Cisco platforms are software-centric and are best utilised with software features enabled.

The goal of the Cisco Enterprise Agreement is twofold: reduce overall cost vs a perpetual licensing model and demonstrate a significant reduction in operational overhead.

Having said that, Cisco Enterprise Agreements only work when you have a clear overview of the used products and services. This means you’ve got some cleaning to do! Find out how in our ebook The Big Cisco Clean Up- a guide that helps you create a manageable and cost-effective Cisco environment.