Cisco licensing is the set of terms under which Cisco Systems, Inc. grants rights to its software, cloud services and subscription offers across networking, security, collaboration, observability and Splunk. One contract, the Cisco General Terms, governs access to and use of “Cisco Offers” and incorporates the Supplemental Terms, Offer Descriptions and Service Descriptions that apply to an Order.[1] The General Terms replaced Cisco’s End User License Agreement with effect from 2024-02-05, and Cisco lists its current legal documents on its Customer Contract Experience page.[2]
The grant is a non-exclusive licence to use Software and a right to use Subscription Offers “for Your direct benefit”, in accordance with the Order. These Use Rights are non-transferable except as the Cisco Transfer Policies allow.[1] What a customer may deploy is therefore set by three things together: the quantity and meter on the Order, the Offer Description that defines the meter, and the Smart Account where the entitlement is delivered. For a software asset manager, the Smart Account is the main source of entitlement data, and the Offer Description is the main source of counting rules.
Editions
Cisco’s licensing guide names two licensing models, subscription (a right to use for the term) and perpetual (indefinite, typically locked to the device). Customers buy either transactionally, à la carte, or through a Software Buying Program such as the Enterprise Agreement.[4] Cisco publishes no public price list. The main portfolios are licensed as follows:
| Portfolio | Main offers | How it is licensed | Deeper article |
|---|---|---|---|
| Campus networking | Catalyst 9000 switches, wireless, SD-WAN routers | Perpetual Network Stack licence plus a 3, 5 or 7-year Cisco DNA or Catalyst subscription per device, or unified licences in the Cisco Networking Subscription[11][12] | Cisco Catalyst and Networking Subscription licensing |
| Firewalls | Secure Firewall Threat Defense on appliances and virtual (FTDv) | Per managed device and per feature (Essentials, IPS, Malware Defense, URL, Carrier); FTDv performance tiers[14] | Cisco Secure Firewall and Duo licensing |
| Identity and access | Duo, Identity Services Engine (ISE), Secure Client | Per user (Duo); active endpoints (ISE); Unique Users or concurrent connections (Secure Client)[15][16] | same, and Cisco software subscription and Flex Plan licensing |
| Cloud security | Umbrella, Secure Access, Secure Connect, security suites | Per Covered User, with Offer-specific limits[17] | Cisco software subscription and Flex Plan licensing |
| Collaboration | Webex, Unified Communications Manager, Collaboration Flex Plan | Named User, Active User, Deployed Knowledge Worker or shared meetings[9][10] | same |
| Meraki | Cloud-managed MX, MS, MR and other devices | A cloud licence for every device, under subscription, co-termination or per-device models[20] | same |
| Splunk | Splunk Enterprise, Splunk Cloud Platform, security and observability products | Daily Indexing Volume, vCPU or Splunk Virtual Compute, plus product-specific units[18] | Splunk licensing under Cisco |
Metrics
Cisco’s purchase meters are the Unit or Meter names printed in Offer Descriptions and the Enterprise Agreement Portfolio Features documents. Smart Licensing, Smart Licensing Using Policy (SLP), Product Activation Keys (PAK) and Cisco Smart Software Manager (CSSM) are delivery and activation mechanisms, not meters.[4] The catalog holds each meter under Cisco’s own name. Examples:
- Networking: Catalyst Subscription (per device), WAN Essentials, WAN Advantage and Switch Node. Essentials and Advantage are feature tiers of a meter, not separate meters.
- Security: Endpoint Session for ISE in the Enterprise Agreement, ISE Subscription (active endpoint), the firewall feature licences such as FTD Threat (IPS), the Duo user license, Covered User and Unique Users.
- Collaboration: Named User, Active User, Deployed Knowledge Worker and the Webex Calling licence types.
- Splunk: Daily Indexing Volume, Splunk Virtual Compute (SVC) and vCPU, which appear in the Enterprise Agreement as Splunk Ingest, Splunk Workload and Splunk vCPU.
Cisco publishes no conversion between Named User, Knowledge Worker, Active User, Employee Count and Ports, and no conversion between Splunk ingest and compute meters.[10][18] The full list of rows is in Cisco software subscription and Flex Plan licensing.
Counting / floors
Smart Accounts. Purchased licences are deposited in a Smart Account, which can be divided into Virtual Accounts. Only devices registered to a Virtual Account can consume the licences assigned to it, so a shortfall in one Virtual Account is not cured by spare licences in another until they are transferred.[4][22] Under classic Smart Licensing a pool that does not cover use is “Out of compliance”, and after 90 days product functionality may be limited.[4] Under SLP most licences are unenforced: the software does not block an unlicensed feature, but usage is reported to CSSM in Resource Utilization Measurement reports.[5] See Cisco Smart Licensing, Smart Accounts and Smart Licensing Using Policy.
Devices. A Catalyst 9300 cannot be bought without a Network Stack licence and a DNA or Catalyst subscription, and the subscription tier must match the Network Stack tier.[11] A Secure Firewall needs “a license for each feature used” on each managed device, and each member of a high-availability pair or cluster must carry the same feature licences.[14]
Users and capacity. The Collaboration portfolio of the Enterprise Agreement must cover all Knowledge Workers, with a minimum of 250.[8] Splunk Enterprise volume licences and infrastructure (vCPU) licences cannot be stacked together.[18] Splunk Enterprise stacks below 100 GB a day have search disabled after 45 warnings in a rolling 60 days.[19]
Trials. If no trial period is specified, a Trial Offer may be used for 60 days, and it may not be used in production unless Cisco agrees in writing.[1]
Support and term
Most Cisco software subscriptions include support. Catalyst software subscriptions include 24x7 TAC access and software updates.[23] The Cisco Networking Subscription includes support equal to Cisco Support Basic without hardware replacement, and a new subscription has a standard minimum term of 36 months, with later additions co-termed to the same renewal date.[12]
At the end of a Use Term, or on termination of an Order, Cisco stops providing Services and the customer must Return the applicable Cisco Offers, except those whose title has passed to the customer.[1] In practice many products keep running after expiry. Catalyst switches can fall back to their perpetual Network Stack licence, and switching under the Networking Subscription shows “no enforcement” on the device.[11][12] Continued operation is not the same as a licence.
Virtualization & partitioning
Cisco has no general partitioning policy. Most meters count devices, users or capacity, so virtualization matters only for virtual appliances. Threat Defense Virtual licences are tied to a performance tier that sets a throughput and VPN session limit, and any FTDv licence can be used on any supported vCPU and memory configuration.[22] ISE needs a Virtual Machine licence for each virtual or cloud-deployed node.[16] For Splunk Enterprise infrastructure licences, “Each virtual CPU is equivalent to a distinct hardware thread of execution in a physical CPU core”.[18]
The General Terms also limit hardware moves. Customers may not use software on second-hand or refurbished Cisco devices, or move software licensed for a specific device to a different device, unless Cisco authorizes it or the Transfer Policies allow it.[1]
Cloud / BYOL
Many Cisco offers are cloud services with no customer-hosted option, including Duo, Umbrella, Webex and Splunk Cloud Platform. Customer-hosted software can be taken to public clouds where the product supports it: Threat Defense Virtual licences can be used on AWS and Azure, and ISE cloud nodes use the Virtual Machine licence.[22][16] The licensing guide notes that Smart Licensing may be used only in the country of purchase.[4]
For air-gapped networks, devices can report through an on-premises CSSM server or a license reservation. Under SLP a new Specific License Reservation cannot be requested, because “the notion of ‘reservation’ does not apply”.[5]
Programs
| Program | What it does | Catalog row |
|---|---|---|
| Cisco Enterprise Agreement 3.0 | Portfolio-wide buying program with Suites, True Forward, a 115% Growth Allowance after the first six months and Value Shift | Enterprise Agreement |
| Collaboration Flex Plan | Collaboration buying models: named user, active user, enterprise agreement and shared meetings | Collaboration Flex Plan |
| Cisco Networking Subscription | Unified Switching, Wireless and WAN licences co-termed in one subscription | Cisco Networking Subscription |
| Splunk Cloud Flex | Reallocation of Splunk spend across the portfolio | Splunk Cloud Flex |
| Duo self-service | Card purchases of Duo editions | Duo self-service subscription |
Under the Enterprise Agreement, if consumption of a Suite exceeds 105% of the initial entitlement in the first six months, Cisco may start a True Forward at the next quarterly anniversary. After six months, customers may consume up to 115% of the initial entitlement of a Suite without additional fees.[7] Full Commit Suites are trued forward annually and Partial Commit Suites quarterly.[6] The licensing guide also lists the Managed Service License Agreement and the Service Provider Networking Agreement as Software Buying Programs.[4] The Cisco Enterprise Agreement is unrelated to the Microsoft program of the same name.
Audit and compliance
The General Terms require customers to keep reasonable records of their use of Cisco Offers. Cisco and its auditors, under written confidentiality obligations, may access those records, “including books, systems, and accounts”, on 30 days’ notice. Cisco may give that notice no more than once in any 12-month period and conducts audits during normal business hours. Underpaid fees revealed by the verification must be paid within 30 days.[1] Customers must also pay their Approved Source for additional consumption of a Subscription Offer or under a Buying Program, and Orders are non-cancellable to the extent the law allows.[1]
Much of Cisco’s compliance data comes from the products themselves: CSSM compares reported usage with Smart Account entitlements, and the Enterprise Agreement True Forward compares consumption with entitlement.[4][7] Splunk states the same principle for its products: a licence that is not technically enforced can still be exceeded in breach of contract (see Splunk licensing under Cisco). Cisco’s best-known software dispute concerned copyright in its command-line interface rather than licence compliance: see Cisco Systems, Inc. v. Arista Networks, Inc..
Recent licensing changes
- 2024-02-05. The Cisco General Terms replaced the End User License Agreement. Changes to the General Terms apply only to offers ordered or renewed after the change.[1][2]
- 2024-01-24. Cisco Enterprise Agreement 3.0 Program Terms published.[6]
- 2024-03-18. Cisco completed the acquisition of Splunk; Splunk products keep their own capacity document.[21][18]
- 2025-02-14. The Collaboration Flex Plan Buying Program Offer Description set Deployed Knowledge Worker as the Flex Plan meter in the Enterprise Agreement.[9]
- 2025-08-19. DNA Premier was no longer available for new SD-WAN contracts, with renewals and additions allowed until 2026-08-19.[3]
- Cisco Networking Subscription. Unified licences for switching, wireless and WAN, managed in the Meraki Dashboard or CSSM, now sit beside the older DNA and Catalyst subscriptions.[12]
Deal details are on the acquisitions page.
Guides
The articles on Cisco licensing, in reading order:
- Cisco Smart Licensing, Smart Accounts and Smart Licensing Using Policy: where entitlements live and how usage reaches Cisco.
- Cisco software subscription and Flex Plan licensing: the meters in Offer Descriptions, the Enterprise Agreement and Collaboration Flex Plan.
- Cisco Catalyst and Networking Subscription licensing: Network Stack, DNA and Catalyst tiers, and unified licences.
- Cisco Secure Firewall and Duo licensing: per-device firewall features, FTDv tiers and Duo editions.
- Splunk licensing under Cisco: ingest, workload and product-specific capacity, and enforcement.
Out of scope
- Hardware, warranties and hardware support contracts, which are hardware asset management.
- List prices, discounts and private price books.
- The Cisco Transfer Policies and Software Support Services terms, which were not retrieved for this page.
- Webex, AppDynamics and ThousandEyes counting detail, which is in Cisco software subscription and Flex Plan licensing.