Activating Traditional PAK Licenses on Cisco ISR4000 Routers

While Cisco has transitioned to Smart Licensing, many legacy or air-gapped environments still require the traditional Product Authorization Key (PAK) method. Use this guide to activate permanent licenses for Security (SEC), UC, or Throughput features.

1. Retrieve Device UDI

To lock a license to your hardware, you need the Unique Device Identifier (UDI). Run the following command on your router:

Router# show license udi

Note down the PID (e.g., ISR4331/K9) and the SN (Serial Number).

2. Generate the .lic File

• Log in to the Cisco License Registration Portal (LRP).
• Enter your 11-digit PAK.
• Assign the PAK to your router’s PID and SN.
• Download the generated .lic file.

3. Install the License via CLI

Transfer the license file to your router's flash memory (via USB or TFTP), then execute:

Router# license install flash:Your_License_File.lic

4. Set the Boot Level and Reload

You must manually set the technology package for the license to take effect after a reboot:

Router(config)# license boot level securityk9
Router(config)# exit
Router# write memory
Router# reload

Note: Replace securityk9 with the specific feature you are activating (e.g., uck9, throughput).

5. Verify Activation

Confirm the license status is "Active, In Use" and type is "Permanent":

Router# show license