License Management
This section discusses the procedure for managing CloudEOS license files.
Pay-As-You-Go (payg) in Cloud
This section discusses verifying the Pay-As-You-Go (payg) instance installed on the CloudEOS router products on various supported public platforms.
Overview
Pay-As-You-Go (payg) uses a software consumption model supported by various public cloud providers that charges the consumer based on usage. Another software consumption model on public cloud providers uses Bring-your-own License (BYOL). Each vendor publishes its product on the public cloud and imposes a license requirement for the real usage of its product, and you must obtain the BYOL from the vendor to use the product in the public cloud.
License Verification
Use the following commands to verify the Software forwarding Engine (SFE) and IPsec licenses installed in the payg mode for the CloudEOS router.
Example show output for SFE
router# show platform sfe licensing Licensing Information --------------------- License TC created: no Number of throttled interfaces: 0
router# show platform sfe licensing Licensing Information --------------------- License TC created: yes Number of throttled interfaces: 1 Interfaces throttled: Ethernet1: 80 Mbps"
Example Show Output for IPsec
router# show ip sec connection ! No valid IPsec license found. IPsec is disabled.
router# show ip sec connection Tunnel Source Dest Status Uptime Input Output Rekey Time Tunnel63 1.0.0.1 1.0.0.2 Established 22 minutes 0 bytes 0 bytes 34 minutes If no valid certificate is installed, it displays configured IPsec connections.
Troubleshooting payg Licensing
Use the $curl command to verify if an aws or Azure instance supports payg. Execute the command in the Bash mode.
payg support for aws
- To retrieve the instance identity document, use the following command from your running instance:
[switch]$ curl http://169.254.169.254/latest/dynamic/instance-identity/document { "accountId" : "083837402522", "architecture" : "x86_64", "availabilityZone" : "us-west-1b", "billingProducts" : null, "devpayProductCodes" : null, "marketplaceProductCodes" : [ "cdcwmm26cap8fqlnkwuqte405" ], "imageId" : "ami-017900c328c2edfbe", "instanceId" : "i-058ebba29bd475e8b", "instanceType" : "c5.xlarge", "kernelId" : null, "pendingTime" : "2020-05-01T06:53:42Z", "privateIp" : "11.0.4.101", "ramdiskId" : null, "region" : "us-west-1", "version" : "2017-09-30" }
payg support for Azure
Use the command in the following example verifies if an Azure instance supports payg.
Metadata displaying the SKU on an Azure Instance
[switch]$ curl -H Metadata:true "http://169.254.169.254/metadata/instance/compute?api-version=2017-08-01"
{"location":"westus",
"name":"adhip-test",
"offer":"cloudeos-router-payg",
"osType":"Linux",
"placementGroupId":"",
"platformFaultDomain":"0",
"platformUpdateDomain":"0",
"publisher":"arista-networks",
"resourceGroupName":"adhip2",
"sku":"cloudeos-4_23_0-payg",
"subscriptionId":"ba0583bb-4130-4d7b-bfe4-0c7597857323",
"tags":"","version":"4.23.0",
"vmId":"c23a7526-44c5-43af-bcf5-8b2419105393",
"vmSize":"Standard_D4_v3"
$
payg support for Google Cloud Platform (GCP)
The Arista CloudEOS instance requires network connectivity and DNS resolution to use the GCP metadata server,
metadata.google.internal
, for various services, including license validation. Normally, the CloudEOS instance automatically configures the default route and GCP DNS server,
169.254.169.254
, using DHCP during the initial instance start up. However, to ensure the instance can access the DNS server and reach the GCP metadata server properly, use the following command, and verify that the license ID matches 3403635045915687054 for the payg image.
router# bash curl http://metadata.google.internal/computeMetadata/v1/instance/licenses/0/id -H "Metadata-Flavor:Google" 3403635045915687054
The following CloudEOS commands allow licensing to bypass the DNS and network connectivity issues due to a custom DHCP and DNS setup:
cloudeos-router-payg-router-vm# ip host metadata.google.internal 169.254.169.254 cloudeos-router-payg-router-vmr# ip route 169.254.169.254/32 Ethernet1 default_vpc_router
The default_vpc_router uses the second address in the primary IP range for the Ethernet 1 subnet. for example, the default VPC router uses the IPv4 address,
10.1.2.1
, in the
10.1.2.0/24
subnet belonging to Ethernet1 in GCP.
However, note that other features require access to the GCP Web APIs, such as CloudHA, may still have issues with your DNS and DHCP setup unless carefully planned. If you use your DNS and DHCP servers, please review the details here .
Bring-Your-Own-License (BYOL) in Cloud and On Premises
License files for the CloudEOS router
CloudEOS router license files unlock performance limitations and enable IPSec.
Installing License Files
Import license files using the CLI. Contact your local SE for assistance with obtaining a license. Use the license import command to download a license file. Save the file to
/mnt/flash/
directory or a server. Your license files have a similar format to the following example licenses:
router# license import flash:veosLic-1.json router# license import flash:IPSecLic-1.json
As a second option, import license files using HTTP. The following output displays the structure of the import of license files:
http://www.mylicense.com/license.json
Verifying Installed License Files
Use the show license command to display details regarding the active licenses and device-specific information needed for licensing.
router# show license Customer name: Arista Test Customer System Serial number: 6FF552005130CB93A1048182A0FE585C System MAC address: 5254.0062.ab2e Domain name: Unknown Platform: CloudEOS-KVM License feature: IPSec License parameter: None Count: 1 Start: 2018-01-31 00:43:31 Expiration: 2026-12-30 16:00:00 Active: yes License feature: CloudEOS - Virtualized EOS Throughput: Not Throttled Count: 1 Start: 2018-01-31 00:42:48 Expiration: 2026-12-30 16:00:00 Active: yes
Updating License Files (Optional)
The license update command forces the system to evaluate the license files currently in the license store.
switch# license update
Obtaining and Installing Soft Expirations
Obtain license files from Arista that extend the time you can use a certain feature without limitations. The license for the feature may be expired, but the feature continues to work until the grace period, as mentioned in the license file, lapses.
for example, with a license file as displayed, customers can continue to use without any limitations for ten days beyond the expiry date.
{
"LicenseFileVersion": "1.0",
"CustomerName": "Arista Test Customer",
"LicenseSerialNumber": "ARISTA-TEST-DAYSPAST1",
"Signature": {
"SigningCertPEM": "-----BEGIN CERTIFICATE-----7brkfssZDrRIatxKEkv6Oc
\nh4kXO2mvvMJxQDf7VvGXEC3fSRURLwPz//6JMx942iOKsES8ZT9nT2q9MxJXfInn\n3EcKGmPWKQR4n2qH
fmq6sfk2eFBUYIrZBm9RUbVbyLZLCOv2KxJ7FFZ9LV1jp5An\nAyHLJUMQqqw/kvUUvUq1bI/PtEOlNc9Ndt
/3yeh+HByzIw8/f+gjKkUjQpVncuqS\nkFotBPNNj/LjbQD40R/tJ0z/8sPXCGJuo4mE9s/MwnWmkAHxpZyC
ccMBlNp3LkJk\nFHcsVb36Vclv5XWDe5AxU+0sQjEB4LGP7nYo8wjjvSZIpYXRiAmDRGuAGi/W/W3F\n6hEQ
661JK4KPJvoQsMqYaO/TkZPIXEAdgEDkmj0=\n-----END CERTIFICATE-----\n",
"Hash": "f076d2cac1eac2a8261915e0b2ce4cb547e9c98bda070d001140daf3c3bd3694",
"Signature": "304502201ca6fab964d8a3aade43d306232fcf52b9503fc22f4552
d58fb5a95e1b9e13e6022100dff97ad4f37389b55887f0ec06c9ef29d55a75e668e4da654deaf8037633a9bd"
},
"Features": {
"veos": [
{
"Count": 1,
"Value": "",
"Valid": {
"NotBefore": "2000-01-01T00:00:00Z",
"NotAfter": "2001-01-01T00:00:00Z"
},
"BehaviorModifier": {
"DaysAllowedPastExpiration": 10
}
}
]
},
"BindingInfo": {
"SystemMAC": "",
"DomainAddress": "",
"SerialNumber": "2BC6A772072B04BED43DCCF8777F036F"
}
}
--
Additional Licensing Show Commands
Use the following commands to verify the validity of a license file, the expiration date, installed license files, and any relevant information regarding a license. The show license commands do not list features unlocked by external license files.
Use the show license files command to display all information related to the installed active licenses.
router# show license files
License name: 2017.11.02.08.23.23.053684_IPSecLic-1yr.json
Contents:
{
"BindingInfo": {
"DomainAddress": "",
"SerialNumber": "C3F3580316A92EE8D97DB70C967EAAA4",
"SystemMAC": "02:9c:a8:a5:51:5a"
},
"CustomerName": "Arista Test",
"Features": {
"IPSec": [
{
"Count": 1,
"Valid": {
"NotAfter": "2018-12-31T00:00:00Z",
"NotBefore": "2017-11-02T15:21:22Z"
},
"Value": ""
}
]
},
(truncated)
}
License name: 2017.11.03.12.27.24.016515_veosLic-1234.json
Contents:
{
"BindingInfo": {
"DomainAddress": "",
"SerialNumber": "C3F3580316A92EE8D97DB70C967EAAA4",
"SystemMAC": ""
},
"CustomerName": "Arista Test",
"Features": {
"CloudEOS": [
{
"Count": 1,
"Valid": {
"NotAfter": "2025-12-31T00:00:00Z",
"NotBefore": "2020-11-02T00:00:00Z"
},
"Value": ""
}
]
},
"LicenseFileVersion": "1.0",
(truncated)
END CERTIFICATE-----\n"
The show license expired command displays the same information as the show license command but only displays expired license files.
router# show license expired System Serial number: 2BC6A772072B04BED43DCCF8777F036F System MAC address: 06:1b:8a:48:8d:0c Domain name: Unknown License feature: IPSec License parameter: None Count: 1 Start: 2017-10-05 21:49:13 Expiration: 2017-10-09 17:00:00 Active: expired License feature: CloudEOS - Virtualized EOS License parameter: None Count: 1 Start: 2017-10-05 21:47:34 Expiration: 2017-10-09 17:00:00 Active: expired
The show license all command displays all active or expired license files, or unactivated license files.
router# show license all System Serial number: 2BC6A772072B04BED43DCCF8777F036F System MAC address: 06:1b:8a:48:8d:0c Domain name: Unknown License feature: IPSec License parameter: None Count: 1 Start: 2017-12-30 16:00:00 Expiration: 2018-12-30 16:00:00 Active: in future License parameter: None Count: 1 Start: 2017-09-18 13:56:45 Expiration: 2017-12-30 16:00:00 Active: yes License parameter: None Count: 1 Start: 2017-10-05 21:49:13 Expiration: 2017-10-09 17:00:00 Active: expired License feature: CloudEOS - Virtualized EOS License parameter: None Count: 1 Start: 2017-10-08 17:00:00 Expiration: 2017-12-30 16:00:00 Active: yes License parameter: None Count: 1 Start: 2017-12-30 16:00:00 Expiration: 2018-12-30 16:00:00 Active: in future License parameter: None Count: 1 Start: 2017-10-05 21:47:34 Expiration: 2017-10-09 17:00:00 Active: expired
