Does Cisco DNA force a private network onto the internet?

Quick Take

Quick Take: Buying DNA does not put your switch on the public internet. Forwarding stays on the private network. Usage reporting, if you do it, is a file you carry to a workstation. Catalyst Center, if you deploy it, sits in your own room and can run air-gapped.

Published 2026-09-29. This page is for operators whose standard is a private network.

For a China enterprise RFQ, TAOHAN issues a dated quote. Any channel price on that quote is pending confirmation. A 13% VAT special fapiao can be issued with the invoice. If the site will not use Catalyst Center or SD-Access, buy DNA Essentials for 3 years and do not renew. SD-WAN controller mode must renew. C9600 and C8500 have no Essentials tier.

A subscription is not an internet circuit

Quick Answer: Cisco DNA is a term license, not a requirement that the switch open a session to the public internet. Smart Licensing Using Policy on Catalyst 9000 has an official topology with no connectivity to CSSM. The chassis forwards frames whether or not that file ever leaves the building.

People mix up three different networks. The first is your production network, where users and servers live. The second is a license-report file that Cisco asks you to upload from some workstation that can reach Cisco. The third is Catalyst Center, an appliance you would place in your own equipment room if you wanted DNA features at all.

None of those three says "stretch a cable from the closet switch to the internet." The switch can sit at 0 hours of direct contact with Cisco and still forward. The 9800 air-gap note shows the same idea on wireless: set transport off, save the usage report, and move the file from a workstation. An example on that page uses a 30-day reporting push interval. After a factory reset, wait at least 1 hour before you generate the report. Those are admin chores, not a path through your firewall for user traffic.

Three columns: traffic, the file, the controller

Quick Answer: Traffic stays on the private network. The usage file moves from a workstation, not from the switch. Catalyst Center, if you want it, is installed in your room and Cisco documents an air-gap mode. Cloud features inside the subscription do not work in that mode.

If you will never deploy Catalyst Center, do not install it. Then there is no new session from your network to Cisco for DNA features, because those features are not turned on. If you do deploy Catalyst Center inside the private network, use the air-gap guide. Cisco's offer description says air-gap mode drops the cloud features that may have been part of the subscription. An air-gap software update on Catalyst Center can take longer than 6 hours. Plan the window. Do not read that as "the access switch must be online."

Meraki dashboard management is a different product choice. Devices in that mode talk to the Cisco cloud. Do not use that sentence to describe a campus switch that is only carrying a DNA term.

How to keep the switch off the internet

Quick Answer: Turn license transport off on the Catalyst 9000, export the usage file if your policy wants a report, and upload that file from a workstation. Leave the switch on the private network. Skip Catalyst Center entirely when nobody will use it.

1. Step 1. Confirm the platform is a Catalyst 9000 or 9800 that uses Smart Licensing Using Policy, not a Meraki-cloud device.
2. Step 2. On the switch or controller, disable smart license transport so it does not call out.
3. Step 3. If you must report usage, save the report to a file and move that file with a workstation.
4. Step 4. Import the acknowledgement the same way. Do not open the switch to the internet to "make DNA work."

Skipping the upload does not stop forwarding. Cisco still describes reporting as part of the policy, so your security team should know a file may leave on a workstation. That is a controlled export. It is not a standing tunnel from the closet.

Typical scenario: a plant network with no browse path

Quick Answer: A typical scenario is a plant or branch where policy forbids the switch from resolving public names. The DNA term is still on the purchase order. Operators leave transport off, keep forwarding local, and never deploy Catalyst Center. Users see no change, because DNA features were never the path their traffic used.

Label this as a typical scenario. Nobody is asked to punch a hole for "license phone-home" on the production VLAN. If leadership later wants Assurance, that is a project to install Catalyst Center in the room, still without putting access switches on the internet, and they should expect cloud features to stay off while air-gap mode is on.

The fear that "DNA means we must join the internet" comes from older call-home habits and from Meraki. Read the platform name on the faceplate before you accept that fear. A Catalyst 9000 with transport off is still a Catalyst 9000.

What this page does not decide

Quick Answer: Essentials versus Advantage is a buying choice, and deleting the subscription is not allowed here. The only split on this page is the license you buy versus the internet circuit you do not have to build. Buying the term and connecting the switch are different jobs.

You can run a fully private forwarding plane and still have been required to buy a term when the hardware was ordered. That commercial rule lives on the buying page. Here, the operator question has a short answer: the switch does not need a public path to keep passing your traffic.

If a design document says "DNA license — therefore firewall opening to Cisco," send it back. Ask which of the three columns they mean. Most of the time they mean the usage file, and the switch itself can stay dark to the internet for 0 hours of direct sessions across the whole term.

FAQ

References

Quick Answer: Cisco documents a no-connectivity Smart Licensing topology for Catalyst 9000, an air-gap path for the 9800, and an air-gap mode for Catalyst Center. Use those three pages. A Meraki cloud dashboard is a different product and is not this answer.

• Smart Licensing Using Policy for Catalyst 9000 — no connectivity to CSSM
• Offline air-gapped licensing on Catalyst 9800 — transport off and a usage file
• Catalyst Center air-gap deployment guide — updates without the Cisco cloud

Key Takeaway

Related