Cisco 5580-40 - ASA Firewall Edition Hardware Installation Manual

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

Cisco ASA 5580 Hardware Installation

Guide

Text Part Number: OL-12920-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL

STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT

WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT

SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE

OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant

to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial

environment. This equipment generates, uses, and can radiate radio-frequency energy and, if not installed and used in accordance with the instruction manual, may cause

harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case users will be required

to correct the interference at their own expense.

The following information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it is not

installed in accordance with Cisco’s installation instructions, it may cause interference with radio and television reception. This equipment has been tested and found to

comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These specifications are designed to provide reasonable

protection against such interference in a residential installation. However, there is no guarantee that interference will not occur in a particular installation.

Modifying the equipment without Cisco’s written authorization may result in the equipment no longer complying with FCC requirements for Class A or Class B digital

devices. In that event, your right to use the equipment may be limited by FCC regulations, and you may be required to correct any interference to radio or television

communications at your own expense.

You can determine whether your equipment is causing interference by turning it off. If the interference stops, it was probably caused by the Cisco equipment or one of its

peripheral devices. If the equipment causes interference to radio or television reception, try to correct the interference by using one or more of the following measures:

• Turn the television or radio antenna until the interference stops.

• Move the equipment to one side or the other of the television or radio.

• Move the equipment farther away from the television or radio.

• Plug the equipment into an outlet that is on a different circuit from the television or radio. (That is, make certain the equipment and the television or radio are on circuits

controlled by different circuit breakers or fuses.)

Modifications to this product not authorized by Cisco Systems, Inc. could void the FCC approval and negate your authority to operate the product.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH

ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR

IMPLIED, INCLUDING, WITHOUT

LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF

DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,

WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO

OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this

URL:

www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership

relationship between Cisco and any other company. (1110R)

Cisco ASA 5580 Hardware Installation Guide

iii

Cisco ASA 5580 Adaptive Security Appliance Hardware Maintenance Guide

OL-12920-01

CONTENTS

About This Guide vii

Document Objectives vii

Audience vii

Installation Warnings vii

Where to Find Safety and Warning Information xi

Obtaining Documentation and Submitting a Service Request xi

CHAPTER

1 Introduction to the ASA 5580 1-1

Package Contents 1-2

Model Variants 1-2

Front and Rear Panel Overview 1-3

Front Panel 1-3

Rear Panel 1-4

Rear Panel Overview 1-5

Ethernet Port Activity Indicators 1-6

Power Supply Indicators 1-7

Internal Components 1-8

Diagnostic Panel 1-9

Network Interfaces 1-10

Built-In Management Interfaces 1-10

Expansion Slots and PCI Buses 1-10

PCI Adapters 1-11

4-Port Gigabit Ethernet Copper PCI Adapter 1-11

4-Port Gigabit Ethernet Fiber PCI Adapter 1-11

2-Port 10-Gigabit Ethernet Fiber PCI Adapter 1-11

I/O Bridges 1-12

Interface Numbering 1-13

Auto-MDI/MDIX Feature 1-13

Specifications 1-13

CHAPTER

2 Safety and Site Requirements 2-1

Safety Recommendations 2-1

Maintaining Safety with Electricity 2-1

Preventing Electrostatic Discharge Damage 2-2

Contents

iv

Cisco ASA 5580 Adaptive Security Appliance Hardware Maintenance Guide

OL-12920-01

General Site Requirements 2-2

Site Environment 2-3

Preventive Site Configuration 2-3

Power Supply Considerations 2-3

Configuring Equipment Racks 2-4

CHAPTER

3 Installing the ASA 5580 3-1

Rack-Mounting the Chassis 3-1

Connecting Interface Cables 3-9

Installing the FIPS Enclosure 3-13

Before You Begin 3-13

Overview 3-14

Installing the FIPS Enclosure 3-15

Installing the Front Shield Assembly 3-15

Installing the Rear Shield Assembly 3-18

Applying Tamper Evident Labels 3-19

CHAPTER

4 Maintenance and Upgrade Procedures 4-1

Removing and Replacing the Chassis Cover 4-1

Removing the Chassis Cover 4-2

Replacing the Chassis Cover 4-4

Accessing the Diagnostic Panel 4-4

Removing and Installing the Interface Cards 4-4

Removing the Interface Cards 4-5

Installing an Interface Cards 4-6

Removing and Installing the Power Supply 4-6

Removing the Power Supply 4-6

Installing the Power Supply 4-9

Removing and Installing Fans 4-10

Removing the Fan 4-11

Installing the Fan 4-12

Upgrading the ASA 5580-20 to an ASA 5580-40 4-13

Prerequisites 4-13

Accessing the Processor Memory Module 4-13

Installing a Processor 4-15

Troubleshooting Loose Connections 4-24

Contents

v

Cisco ASA 5580 Adaptive Security Appliance Hardware Maintenance Guide

OL-12920-01

APPENDIX

A Cable Pinouts A-1

10/100/1000BaseT Ports A-1

Console Port (RJ-45) A-2

Console RJ-45 to DB-9 Adapter A-3

SFP Fiber Ports A-4

I

NDEX

Contents

vi

Cisco ASA 5580 Adaptive Security Appliance Hardware Maintenance Guide

OL-12920-01

vii

Cisco ASA 5580 Series Adaptive Security Appliance Hardware Installation Guide

OL-12920-01

About This Guide

This preface includes the following sections:

• Document Objectives, page vii

• Audience, page vii

• Installation Warnings, page vii

• Obtaining Documentation and Submitting a Service Request, page xi

Document Objectives

This guide describes how to perform maintenance procedures on the Cisco ASA 5580.

Audience

This guide is for network administrators who install firewalls.

Installation Warnings

Be sure to read the Regulatory Compliance and Safety Information for the Cisco ASA 5580 document that

accompanied this device before installing the chassis. This document contains important safety information.

This section includes the following warnings:

• AC Power Disconnection Warning, page viii

• Jewelry Removal Warning, page viii

• Wrist Strap Warning, page viii

• Work During Lightning Activity Warning, page viii

• Installation Instructions Warning, page viii

• Chassis Warning for Rack-Mounting and Servicing, page ix

• Short-Circuit Protection Warning, page ix

• SELV Circuit Warning, page ix

• Ground Conductor Warning, page ix

viii

Cisco ASA 5580 Series Adaptive Security Appliance Hardware Installation Guide

OL-12920-01

About This Guide

• Blank Faceplates and Cover Panels Warning, page ix

• Product Disposal Warning, page ix

• Short-Circuit Protection Warning, page x

• Compliance with Local and National Electrical Codes Warning, page x

• TN Power Warning, page x

• Multiple Power Cord, page x

• Circuit Breaker (15A) Warning, page x

• Grounded Equipment Warning, page x

• Safety Cover Requirement, page x

• Faceplates and Cover Panel Requirement, page xi

AC Power Disconnection Warning

Warning

Before working on a chassis or working near power supplies, unplug the power cord on AC units.

Statement 246

Jewelry Removal Warning

Warning

Before working on equipment that is connected to power lines, remove jewelry (including rings,

necklaces, and watches). Metal objects will heat up when connected to power and ground and can

cause serious burns or weld the metal object to the terminals.

Statement 43

Wrist Strap Warning

Warning

During this procedure, wear grounding wrist straps to avoid ESD damage to the card. Do not directly

touch the backplane with your hand or any metal tool, or you could shock yourself.

Statement 94

Work During Lightning Activity Warning

Warning

Do not work on the system or connect or disconnect cables during periods of lightning activity.

Statement

1001

Installation Instructions Warning

Warning

Read the installation instructions before connecting the system to the power source.

Statement 1004

ix

Cisco ASA 5580 Series Adaptive Security Appliance Hardware Installation Guide

OL-12920-01

About This Guide

Chassis Warning for Rack-Mounting and Servicing

Warning

To prevent bodily injury when mounting or servicing this unit in a rack, you must take special

precautions to ensure that the system remains stable. The following guidelines are provided to ensure

your safety:

This unit should be mounted at the bottom of the rack if it is the only unit in the rack.When mounting

this unit in a partially filled rack, load the rack from the bottom to the top with the heaviest component at the bottom

of the rack.If the rack is provided with stabilizing devices, install the stabilizers before mounting or servicing the unit

in the rack.

Statement 1006

Short-Circuit Protection Warning

Warning

This product requires short-circuit (overcurrent) protection, to be provided as part of the building

installation. Install only in accordance with national and local wiring regulations.

Statement 1045

SELV Circuit Warning

Warning

To avoid electric shock, do not connect safety extra-low voltage (SELV) circuits to telephone-network

voltage (TNV) circuits. LAN ports contain SELV circuits, and WAN ports contain TNV circuits. Some

LAN and WAN ports both use RJ-45 connectors. Use caution when connecting cables.

Statement 1021

Ground Conductor Warning

Warning

This equipment must be grounded. Never defeat the ground conductor or operate the equipment in the

absence of a suitably installed ground conductor. Contact the appropriate electrical inspection

authority or an electrician if you are uncertain that suitable grounding is available.

Statement 1024

Blank Faceplates and Cover Panels Warning

Warning

Blank faceplates and cover panels serve three important functions: they prevent exposure to

hazardous voltages and currents inside the chassis; they contain electromagnetic interference (EMI)

that might disrupt other equipment; and they direct the flow of cooling air through the chassis. Do not

operate the system unless all cards, faceplates, front covers, and rear covers are in place.

Statement

1029

Product Disposal Warning

Warning

Ultimate disposal of this product should be handled according to all national laws and regulations.

Statement 1040

x

Cisco ASA 5580 Series Adaptive Security Appliance Hardware Installation Guide

OL-12920-01

About This Guide

Short-Circuit Protection Warning

Warning

This product requires short-circuit (overcurrent) protection, to be provided as part of the building

installation. Install only in accordance with national and local wiring regulations.

Statement 1045

Compliance with Local and National Electrical Codes Warning

Warning

Installation of the equipment must comply with local and national electrical codes.

Statement 1074

TN Power Warning

Warning

The device is designed to work with TN power systems.

Statement 19

Multiple Power Cord

Warning

This unit has more than one power cord. To reduce the risk of electric shock when servicing a unit,

disconnect the power cord of the power strip that the unit is plugged into.

Statement 137

Circuit Breaker (15A) Warning

Warning

This product relies on the building’s installation for short-circuit (overcurrent) protection. Ensure that

a fuse or circuit breaker no larger than 120

VAC, 15A U.S. (240 VAC, 10A international) is used on the

phase conductors (all current-carrying conductors).

Statement 13

Grounded Equipment Warning

Warning

This equipment is intended to be grounded. Ensure that the host is connected to earth ground during

normal use.

Statement 39

Safety Cover Requirement

Warning

The safety cover is an integral part of the product. Do not operate the unit without the safety cover

installed. Operating the unit without the cover in place will invalidate the safety approvals and pose

a risk of fire and electrical hazards.

Statement 117

xi

Cisco ASA 5580 Series Adaptive Security Appliance Hardware Installation Guide

OL-12920-01

About This Guide

Faceplates and Cover Panel Requirement

Warning

Blank faceplates and cover panels serve three important functions: they prevent exposure to

hazardous voltages and currents inside the chassis; they contain electromagnetic interference (EMI)

that might disrupt other equipment; and they direct the flow of cooling air through the chassis. Do not

operate the system unless all cards, faceplates, front covers, and rear covers are in place.

Statement

142

Where to Find Safety and Warning Information

For safety and warning information, see the Regulatory Compliance and Safety Information for the

Cisco

ASA 5580 document that accompanied the product. This document describes the international

agency compliance and safety information for the adaptive security appliance. It also includes

translations of the safety warnings.

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, submitting a service request, and gathering additional

information, see the monthly What’s

New in Cisco Product Documentation, which also lists all new and

revised Cisco

technical documentation, at:

http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html

Subscribe to the What’s New in Cisco Product Documentation as an RSS feed and set content to be

delivered directly to your desktop using a reader application. The RSS feeds are a free service. Cisco currently

supports RSS

Version 2.0.

xii

Cisco ASA 5580 Series Adaptive Security Appliance Hardware Installation Guide

OL-12920-01

About This Guide

CHAPTER

1-1

Cisco ASA 5580 Series Adaptive Security Appliance Hardware Installation Guide

OL-12920-01

1

Introduction to the ASA 5580

Read through the entire guide before beginning any of the procedures in this book.

Warning

Only trained and qualified personnel should install, replace, or service this equipment

.

Statement 49

Caution Read the safety warnings in the Regulatory Compliance and Safety Information for the Cisco ASA 5580

and follow proper safety procedures when performing these steps.

This chapter describes the product and the memory requirements and includes the following topics:

• Package Contents, page 1-2

• Model Variants, page 1-2

• Front and Rear Panel Overview, page 1-3

• Internal Components, page 1-8

• Diagnostic Panel, page 1-9

• Network Interfaces, page 1-10

• Specifications, page 1-13

1-2

Cisco ASA 5580 Series Adaptive Security Appliance Hardware Installation Guide

OL-12920-01

Chapter 1 Introduction to the ASA 5580

Package Contents

In addition to the contents shown in the figure above, the contents of the ASA 5580 package include the

rail system kit. The rail system kit contains the following items:

• Two slide assemblies

• Two chassis rails

• Four Velcro straps

• Six zip ties

• One cable management arm

• A package of miscellaneous parts (screws, and so forth)

• One cable management arm stop bracket

Model Variants

The Cisco ASA 5580 comes in two models:

• ASA 5580-20—Includes 2 processors.

• ASA 5580-40—Includes 4 processors.

The 5580-40 also includes more DRAM by default.

1 ASA 5580 Series Chassis 2 RJ-45 to DB-9 Adapter

3 2 Yellow Ethernet Cables 4 Documentationt and Software CD

5 Blue Console Cable PC Terminal Adapter

1

23456

78

Cisco ASA 5580 SERIES

Adaptive Security Appliance

UID

SYSTEM

PWR STATUS

MGMT 0

MGMT 1

Cisco ASA

Adaptive Security

Appliance

Product CD

Cisco ASA Adaptive

Security Appliance

Quick Start

Guide

Cisco ASA Adaptive

Security Appliance

Product Card

1

2

3

4

5

300012

1-3

Cisco ASA 5580 Series Adaptive Security Appliance Hardware Installation Guide

OL-12920-01

Chapter 1 Introduction to the ASA 5580

Front and Rear Panel Overview

To upgrade from the ASA 5580-20 to the ASA 5580-40, see the “Upgrading the ASA 5580-20 to an ASA

5580-40” section on page 4-13.

Front and Rear Panel Overview

This section describes the front and rear panels and includes the following topics:

• Front Panel, page 1-3

• Rear Panel, page 1-4

Front Panel

Figure 1-1 shows the front panel.

Figure 1-1 Front Panel

1 Active LED 2 System LED

3 Power Status LED 4 Management 0/0 LED

5 Management 0/1 LED 6 Power

1

2 3 456 78

241233

Cisco IPS 4270 SERIES

Intrusion Prevention Sensor

UID

SYSTEM

PWR STAT US

MG

MT 0

MGMT 1

1

2

4

3

5

6

1-4

Cisco ASA 5580 Series Adaptive Security Appliance Hardware Installation Guide

OL-12920-01

Chapter 1 Introduction to the ASA 5580

Front and Rear Panel Overview

Table 1-1 describes the front panel switches and indicators on ASA 5580.

Rear Panel

• Rear Panel Overview, page 1-5

• Ethernet Port Activity Indicators, page 1-6

• Power Supply Indicators, page 1-7

Ta b l e 1-1 Front Panel Switches and Indicators

Indicator Description

Active

1

t

1. On a standalone device, this button is always on. In Active/Standby pairs, it is on for the active unit and off for the standby

unit. In Active/Active pairs, it is on for any unit with an active failover group. Furthermore, when the system software causes

the button to light (because it is active or standalone), pushing the button does nothing. It stays lit. When the system software

causes the button to be off, pushing the button lights it. Pushing the button again will cause it to turn off again.

Indicates the Active and Standby Failover status of the chassis:

• On—Failover active

• Off—Standby Status

System indicator Indicates internal system health:

• Green—System on

• Flashing amber—System health degraded

• Flashing red—System health critical

• Off—System off

Power status indicator Indicates the power supply status:

• Green—Power supply on

• Flashing amber—Power supply health degraded

• Flashing red—Power supply health critical

• Off—Power supply off

MGMT0/0 indicator Indicates the status of the management port:

• Green—Linked to network

• Flashing green—Linked with activity on the network

• Off—No network connection

MGMT0/1 indicator Indicates the status of the management port:

• Green—Linked to network

• Flashing green—Linked with activity on the network

• Off—No network connection

Power switch and indicator Turns power on and off:

• Amber—System has AC power and is in standby mode

• Green—System has AC power and is turned on

• Off—System has no AC power

1-5

Cisco ASA 5580 Series Adaptive Security Appliance Hardware Installation Guide

OL-12920-01

Chapter 1 Introduction to the ASA 5580

Front and Rear Panel Overview

Rear Panel Overview

Figure 1-2 shows the rear panel.

Figure 1-2 Rear Panel

For more information about the network interfaces, see the “Network Interfaces” section on page 1-10.

1 Power supply 2 Interface expansion slots

3 Power supply 4 T-15 Torx screwdriver

5 USB ports 6 Reserved slot

7 Example of a populated slot 8 Reserved slot

9 Console port 10 Management ports

1

23456789

PCI-E x4

PCI-E x8 PCI-E x4 PCI-E x8 PCI-E x4 PCI-X 100 MHz

PS2

PS1

UID

MGMT0/0

MGMT0/1

CONSOLE

241226

1 3 42

5 6 8 9 107

1-6

Cisco ASA 5580 Series Adaptive Security Appliance Hardware Installation Guide

OL-12920-01

Chapter 1 Introduction to the ASA 5580

Front and Rear Panel Overview

Ethernet Port Activity Indicators

Figure 1-3 shows the activity indicators on the Ethernet ports, which has two indicators per port and the

power supply indicators.

Figure 1-3 Rear Panel LEDs

Table 1-2 describes the Ethernet port indicators. The behavior of the port indicators varies based on the

type of port—management port, port in a Gigabit Ethernet interface card, port in a 10-Gigabit Ethernet

Fiber interface card, or a port in a Gigabit Ethernet Fiber interface card.

1 Power indicator 2 Link indicator

3 Activity indicator

1

23456789

PCI-E x4

PCI-E x8 PCI-E x4 PCI-E x8 PCI-E x4 PCI-X 100 MHz

PS2

PS1

UID

MGMT0/0

MGMT0/1

241230

CONSOLE

1

2 3

Ta b l e 1-2 Ethernet Port Indicators

Indicator Description

Gigabit Ethernet Green (top): link to network

Flashing Green (top): linked with activity on the

network

Amber (bottom): Speed 1000

Green (bottom): Speed 100

Off (bottom): Speed 10

10-Gigabit Ethernet

Fiber (one LED)

Green: link to network

Flashing green: linked with activity on the network

Management port Green (right): link to network

Flashing green (left): linked with activity on the

network

1-7

Cisco ASA 5580 Series Adaptive Security Appliance Hardware Installation Guide

OL-12920-01

Chapter 1 Introduction to the ASA 5580

Front and Rear Panel Overview

Power Supply Indicators

Table 1-3 describes the power supply indicators.

Ta b l e 1-3 Power Supply Indicators

Fail Indicator 1

Amber

Power Indicator 2

Green

Description

Off Off No AC power to any power supply

Flashing Off Power supply failure (over current)

On Off No AC power to this power supply

Off Flashing • AC power present

• Standby mode

Off On Normal

1-8

Cisco ASA 5580 Series Adaptive Security Appliance Hardware Installation Guide

OL-12920-01

Chapter 1 Introduction to the ASA 5580

Internal Components

Figure 1-4 shows the internal components of the ASA 5580.

Figure 1-4 Internal Components

1, 3 Power supply 4, 5, 7 Fans

2 Interface expansion slots 6 Diagnostic panel

241974

1 3

5

7

6

4

2

Page is loading ...

Cisco 5580-40 - ASA Firewall Edition Hardware Installation Manual

This manual is also suitable for

Cisco 5580-40 - ASA Firewall Edition Hardware Installation Manual

Related papers

Other documents