Cisco ASA 5500-X Hardware Installation Guide
Maintenance and Upgrade Procedures for the ASA 5500-X
Downloads: This chapterpdf (PDF - 6.12MB) The complete bookPDF (PDF - 16.34MB) | Feedback

Table of Contents

Maintenance and Upgrade Procedures for theASA 5500-X

Removing and Replacing the Chassis Cover

Removing the Chassis Cover

Replacing the Chassis Cover

Installing an Expansion I/O Card

Installing an I/O Card in the Cisco ASA 5512-X, 5515-X, and 5525-X Chassis

Installing an I/O Card in the Cisco ASA 5545-X and 5555-X Chassis

Installing and Removing SFP Modules

Installing an SFP Module

Removing the SFP Module

Removing and Installing the Power Supply

Removing and Installing the AC Power Supply

Installing the DC Input Power

Removing and Installing the DC Power Supply

Installing and Removing A Solid State Drive for An SSP

Installation Scenarios

Installing and Removing SSDs

Maintenance and Upgrade Procedures for the ASA 5500-X

Before performing any of the procedures described in this chapter, be sure to read the Regulatory Compliance and Safety Information for the Cisco ASA 5500-X Series document at:

http://www.cisco.com/c/en/us/td/docs/security/asa/hw/regulatory/compliance/asa5500x_rcsi.html

This chapter includes the following sections:

Removing and Replacing the Chassis Cover

This section describes how to remove and replace the chassis cover, and includes the following topics:

Removing the Chassis Cover

To remove the chassis cover, perform the following steps.


Step 1 Power off the chassis.


Warning Before working on a system that has an On/Off switch, turn OFF the power and unplug the power cord. Statement 1


Step 2 Turn the thumbscrew on the front of the chassis. See Figure 4-1. You may need to use a screwdriver if the screw is too tight.


Note Removing the chassis cover does not affect your Cisco warranty. Upgrading the ASA does not require any special tools and does not create any radio frequency leaks.


Figure 4-1 Removing the Chassis Cover

 

 

1

Thumbscrew

Step 3 Remove the chassis cover by placing your hand on top of the chassis lid, pressing down firmly, and pushing the cover toward the rear of the chassis. (See Figure 4-1.)

Step 4 Place the cover in a safe place.


 

Replacing the Chassis Cover


Caution Do not operate the ASA without the chassis cover installed. The chassis cover protects the internal components, prevents electrical shorts, and provides proper air-flow for cooling the electronic components.

To replace the chassis cover, perform the following steps.


Step 1 Place the chassis on a secure surface with the front panel facing you.

Step 2 Lower the front of the chassis cover onto the chassis, slide it forward until it fits into place, and tighten the thumbscrew to secure the chassis cover. (See Figure 4-2.)

Figure 4-2 Replacing the Chassis Cover

 

 

 

1

Thumbscrew

Step 3 Re-install the chassis on a rack.

Step 4 Re-install the network interface cables.

Step 5 Power on the chassis.


 

Installing an Expansion I/O Card

You can add or replace an expansion I/O card in the ASA 5500-X series appliances. These cards provide six additional GigabitEthernet copper or small form-factor pluggable (SFP) ports. This section includes the following topics:

Installing an I/O Card in the Cisco ASA 5512-X, 5515-X, and 5525-X Chassis

To remove an existing I/O card and install a new one, perform the following steps.


Step 1 Power off the chassis, remove the power cable from the chassis, and remove the chassis from the rack.

Step 2 Locate a grounding strap, and fasten it to your wrist so that it contacts bare skin. Attach the other end to the chassis. See the “Preventing Electrostatic Discharge Damage” section for more information.

Step 3 With a Phillips head screwdriver, loosen the captive installation screw on the rear of the chassis.

Step 4 Remove the chassis cover by placing your hand on top of the chassis lid, pressing down firmly, and pushing the cover toward the rear of the chassis.

Step 5 Determine the location of the I/O card. (See Figure 4-3.) If you are adding a new card to the expansion slot for the first time, go to Step 9.

Figure 4-3 I/O Card Location

 

 

1

I/O Card holder

2

Power supply


Caution You must disconnect the blue Regex flexible circuit connector from the motherboard before removing the I/O card from the chassis. The copper-colored Regex flexible circuit can break during the I/O card removal or installation process, so handle it with care.

Step 6 To expose the blue connector of the Regex flexible circuit, push down on the center of the green connector clamp, and lift the right end of the clamp to release the lock. (See Figure 4-4.)

Figure 4-4 Removing the Connector Clamp

 

 

Step 7 Disconnect the blue Regex cable connector from the motherboard by lifting carefully but firmly. (See Figure 4-5.)

Figure 4-5 Removing the Regex Cable Connector

 

 

Step 8 Lift the I/O card out of the chassis with both hands by placing an index finger into each of the card cover vents and placing your thumbs on the edge of the card cover. (See Figure 4-6.) Use firm upward pressure and a gentle rocking motion, as the card is firmly seated.


Caution Keep hands clear of all electronics underneath the card cover.

Figure 4-6 Lift the I/O Card Upward to Release it

 

 

1

Index finger placement

2

Thumb placement

Step 9 Insert the new I/O card into the chassis. (See Figure 4-7.) The I/O card fits properly if the following criteria are met:

a. The PCIe bus is properly inserted on the motherboard.

b. The small black plastic guide slides all the way into the chassis.

c. The two hooks on the assembly plug into the two slots on the edge of the chassis.

Figure 4-7 Installing the I/O Card

 

 

Step 10 Connect the blue connector end of the Regex ribbon cable to the motherboard, and close the green tab.

Step 11 Install the chassis cover, and replace the chassis in the rack.

Step 12 Install the power cable.

Step 13 For newer ASAs, the power turns on automatically when you plug in the power cable; do not press the power button on the front panel.

For earlier ASAs, press the power button.

The LEDs will blink when traffic begins to pass.


 

Installing an I/O Card in the Cisco ASA 5545-X and 5555-X Chassis

To remove an existing I/O card in an ASA 5545-X or 5555-X chassis, and install a new one, follow these steps.


Step 1 Power off the chassis, remove the power cable from the chassis, and remove the chassis from the rack.

Step 2 Locate a grounding strap, and fasten it to your wrist so that it contacts bare skin. Attach the other end to the chassis. See the “Preventing Electrostatic Discharge Damage” section for more information.

Step 3 With your fingers, loosen the captive installation screw on the rear of the chassis.

Step 4 Remove the chassis cover by placing your hand on top of the chassis lid, pressing down firmly, and pushing the cover toward the rear of the chassis.

Step 5 Determine the location of the I/O card. (See Figure 4-8.) If you are adding a new card to the expansion slot for the first time, go to Step 9.

Figure 4-8 I/O Card Location

 

 

1

I/O Card holder

2

Power supply


Note You must disconnect the blue Regex flexible circuit connector from the motherboard before removing the I/O card from the chassis. The copper-colored Regex flexible circuit can break during the I/O card removal or installation process, so handle it with care.


Step 6 To expose the blue connector on the end of the Regex flexible circuit, push down on the center of the green connector clamp, and lift the end of the clamp to release the lock. (See Figure 4-9.)

Figure 4-9 Removing the Connector Clamp

 

Step 7 Disconnect the blue connector from the board by lifting carefully but firmly. (See Figure 4-10.)

Figure 4-10 Removing the Regex Cable Connector

 

Step 8 Lift the I/O card out of the chassis with both hands by placing an index finger into each of the card cover vents and placing a thumb on the edge of the card cover. (See Figure 4-11.) Use firm upward pressure and a gentle rocking motion, as the card is firmly seated.

Figure 4-11 Lift the I/O Card Upward to Release it

 

 

1

Index finger placement

2

Thumb placement

Step 9 Insert the new I/O card into the chassis. (See Figure 4-12.) The I/O card holder fits properly if the following criteria are met:

a. The PCIe bus is properly inserted on the motherboard.

b. The small black plastic guide slides all the way into the chassis.

c. The two hooks on the assembly plug into the two slots on the edge of the chassis.

Figure 4-12 Inserting a New I/O Card

 

Step 10 Carefully feed the flexible Regex circuit into the yellow channel on the chassis side (see Figure 4-13), and connect the blue Regex cable connector end to the motherboard.

Figure 4-13 Feeding Regex Flexible Circuit through Channel and Connecting

 

Step 11 Close the green connector clamp.

Step 12 Install the chassis cover, and replace the chassis in the rack.

Step 13 Install the power cable, and restore power to the chassis. The LEDs will blink when traffic begins to pass.


 

Installing and Removing SFP Modules

The ASA uses a small form-factor pluggable (SFP) module to establish Gigabit Ethernet connections; this module is a hot-swappable input/output device that plugs into available SFP ports. Table 4-1 lists the supported SFP modules.

 

Table 4-1 Supported SFP Modules

SFP Module
Type of Connection
Cisco Part Number

1000BASE-LX/LH

Fiber-optic

GLC-LH-SM=

1000BASE-SX

Fiber-optic

GLC-SX-MM=

The 1000BASE-LX/LH and 1000BASE-SX SFP modules are used to establish fiber-optic connections. Use fiber-optic cables with LC connectors to connect to an SFP module. The SFP modules support 850 to 1550 nm nominal wavelengths. The cables must not exceed the required cable length for reliable communications. Table 4-2 lists the cable length requirements.

 

Table 4-2 Cabling Requirements for Fiber-Optic SFP Modules

SFP Module
62.5/125 micron Multimode 850 nm Fiber
50/125 micron Multimode 850 nm Fiber
62.5/125 micron Multimode 1310 nm Fiber
50/125 micron Multimode 1310 nm Fiber
9/125 micron Single-mode 1310 nm Fiber

LX/LH

550 m at
500 Mhz-km

550 m at
400 Mhz-km

10 km

SX

275 m at
200 Mhz-km

550 m at
500 Mhz-km

Use only Cisco certified SFP modules on the ASA. Each SFP module has an internal serial EEPROM that is encoded with security information. This encoding provides a way for Cisco to identify and validate that the SFP module meets the requirements for the ASA.

This section describes how to install and remove SFP modules in the ASA to provide optical GigabitEthernet connectivity, and it includes the following topics:


Caution Protect your SFP modules by inserting clean dust plugs into the SFPs after the cables are extracted from them. Be sure to clean the optic surfaces of the fiber cables before you plug them back into the optical bores of another SFP module. Avoid getting dust and other contaminants into the optical bores of your SFP modules. The optics do not operate correctly when obstructed with dust.


Warning Because invisible laser radiation may be emitted from the aperture of the port when no cable is connected, avoid exposure to laser radiation and do not stare into open apertures. Statement 70


Installing an SFP Module

To install an SFP module, perform the following steps.


Step 1 Align the SFP module with the port, and slide the SFP module into the port slot until it locks into position, as shown in Figure 4-14.

Figure 4-14 Installing an SFP Module

 

 

1

Optical port plug

2

SFP port slot

3

SFP module

Step 2 Remove the optical port plug, and then connect the network cable to the SFP module.


Caution Do not remove the optical port plugs from the SFP until you are ready to connect the cabling.

Step 3 Connect the other end of the cable to your network.


 

Removing the SFP Module

SFP modules use various latch designs to secure the SFP modules in the SFP ports. The following list includes the different module design types:

  • Mylar Tab Module
  • Actuator/Button SFP Module
  • Bale-Clasp SFP Module
  • Plastic Collar Module

NoteLatch designs are not linked to SFP model or technology types. For information about SFP models and technology types, see the label on the side of your SFP. Latch designs are not linked to SFP model or technology types. For information about SFP models and technology types, see the label on the side of your SFP.


To remove the SFP module, perform the following steps.


Step 1 Disconnect all cables from the SFP.


Warning Because invisible laser radiation may be emitted from the aperture of the port when no cable is connected, avoid exposure to laser radiation and do not stare into open apertures. Statement 70



Caution Do not pull on the cabling in an attempt to remove the SFP.

Step 2 Disconnect your particular SFP latch, as shown in Figure 4-15.

Figure 4-15 Disconnecting SFP Latch Mechanisms

 

 

1

Mylar tab

2

Actuator/Button

3

Bale-clasp

4

Plastic collar

Step 3 Grasp the SFP on both sides, and remove it from the port.


 

Removing and Installing the Power Supply

This section describes how to remove and install power supply modules, and includes the following topics:

Removing and Installing the AC Power Supply

This procedure applies only to the appliances with a removable AC power supply (ASA 5545-X and ASA 5555-X). If only one power supply is installed, make sure that it is installed in slot 0 (left slot) and that slot 1 (right slot) is covered with a slot cover


Caution If you remove a power supply, replace it immediately to prevent disruption of service.


Caution If the appliance is subjected to environmental overheating, it shuts down and you must manually power cycle it to turn it on again.


Warning This unit has more than one power supply connection; all connections must be removed completely to completely remove power from the unit. Statement 102



Warning This product relies on the building’s installation for short-circuit (overcurrent) protection. Ensure that the protective device is rated not greater than: 120 VAC, 20A U.S. (240 VAC, 10A international). Statement 1005


To remove and install an AC power supply, follow these steps:


Step 1 If you are adding an additional power supply, from the back of the appliance, push the lever on the slot cover to the left to release it, grasp the handle of the slot cover and pull it away from the chassis. (See Figure 4-16.) Save the slot cover for future use. Continue with Step 3.

Figure 4-16 Removing the Slot Cover

 

Step 2 If you are replacing a power supply, follow these steps:

a. Power off the appliance.

b. From the back panel of the appliance, unplug the power supply cable.

c. Push the lever on the power supply to the left and remove the power supply by grasping the handle and then pulling the power supply away from the chassis while supporting it from beneath with the other hand. (See Figure 4-17.)

Figure 4-17 Removing the AC Power Supply

 

Step 3 Install the new power supply by aligning it with the power supply bay and pushing it into place until it is seated while supporting it from beneath with the other hand. (See Figure 4-18.)

Figure 4-18 Installing the AC Power Supply

 

Step 4 Connect the power cable. If you are installing two power supplies for a redundant configuration, plug each one into a power source (we recommend a UPS).

Step 5 Power on the appliance if you powered it off to replace the only power supply.

Step 6 Check the PS0 and PS1 indicators on the front panel to make sure they are green. On the back panel of the appliance, make sure the power supply indicator on the bottom of each installed power supply is green. (See Figure 4-19.)

Figure 4-19 Back Power Supply Indicators

 


 

Installing the DC Input Power


Warning The covers are an integral part of the safety design of the product. Do not operate the unit without the covers installed. Statement 1077



Warning When you install the unit, the ground connection must always be made first and disconnected last. Statement 1046



Warning Before performing any of the following procedures, ensure that power is removed from the DC circuit. Statement 1003



Warning Only trained and qualified personnel should be allowed to install, replace, or service this equipment. Statement 1030



Warning This product relies on the building’s installation for short-circuit (overcurrent) protection. Ensure that the protective device is rated not greater than: 80 VAC, 20A. Statement 1005


The ASA ships with either one or two DC power supplies installed in the chassis, depending on the configuration ordered. You must connect the power supply wires. This section describes how to install the DC power supply ground leads and input power leads to the appliance DC input power supply. Before you begin, read these important notices:

  • The color coding of the DC input power supply leads depends on the color coding of the DC power source at your site. Typically, green or green/yellow is used for ground (GND), black is used for –48 V on the negative (–) terminal, and red is used for RTN on the positive (+) terminal. Ensure that the lead color coding you choose for the DC input power supply matches the lead color coding used at the DC power source.
  • Make sure that the chassis ground is connected on the chassis before you begin installing the DC power supply. See “Preventing Electrostatic Discharge Damage” section for more information.

Figure 4-20 shows the back panel of the ASA 5512-X, ASA 5515-X, and ASA 5525-X with the DC power supply.

Figure 4-20 ASA 5512-X, ASA 5515-X, and ASA 5525-X Back Panel

 

 

1

Fixed fan

2

Fixed DC power supply

Figure 4-21 shows the back panel of the ASA 5545-X and ASA 5555-X with two DC power supplies.

Figure 4-21 ASA 5545-X and ASA 5555-X Back Panel

 


NoteIf only one power supply is installed, make sure that it is installed in slot 0 (left slot) and that slot 1 (right slot) is covered with a slot cover. If only one power supply is installed, make sure that it is installed in slot 0 (left slot) and that slot 1 (right slot) is covered with a slot cover.


To connect the DC power supply on the appliance, follow these steps:


Step 1 Make sure that the chassis ground is connected on the chassis before you begin installing the DC power supply.

Step 2 Turn off the circuit breaker to the power supply.

Step 3 From the front of the appliance, verify that the power switch is in the Standby position.

Step 4 Move the circuit-breaker switch handle to the Off position, and apply tape to hold it in the Off position.

Step 5 Use a 10 gauge wire-stripping tool to strip each of the three wires coming from the DC input power source. Strip the wires to 0.27 inch (7 mm) + 0.02 inch (0.5 mm). Do not strip more than the recommended length of wire because doing so could leave the wire exposed from the DC power supply connection. (See Figure 4-22.)

Figure 4-22 Stripping the DC Input Power Source Wire

 

 

1

We recommend that you strip the wire to 0.27 inch (7 mm).

 


Warning An exposed wire lead from a DC input power source can conduct harmful levels of electricity. Be sure that no exposed portion of the DC input power source wire extends from the terminal block plug. Statement 122


Step 6 Identify the positive, negative, and ground feed positions for the DC power supply connection. The recommended wiring sequence is as follows (see Figure 4-23):

  • Ground lead wire (middle)
  • Positive (+) lead wire (left)
  • Negative (–) lead wire (right)

Figure 4-23 Color-coded Wires

 

1

Negative (–) lead wire

2

Ground lead wire

3

Positive (+) lead wire

 

 

Figure 4-24 shows the DC power supply with lead wires.

Figure 4-24 DC Power Supply with Lead Wires

 

Step 7 Insert the exposed end of one of the ground wires into the inlet on the DC power supply. After you push in the wires, they are held in place with a spring, which makes the physical contact. Make sure that you cannot see any wire lead. Only wires with insulation should extend from the DC power supply.

Step 8 Repeat Step 7 for the remaining two DC input power source wires: the positive lead wire and the negative lead wire.

 

Step 9 Use a tie wrap to secure the wires coming from the power supply to the rack so that the wires cannot be pulled from the power supply by casual contact. Make sure the tie wrap allows for some slack in the ground wire. Figure 4-25 shows the DC power supply with the wires inserted and the tie wrap secured.

Figure 4-25 Complete DC Secure Tie Wrap

 

1

Lead wires secured with a tie wrap

 

 

Step 10 Remove the tape (if any) from the circuit breaker switch handle, and move the circuit breaker switch handle to the On position. The power supply indicators light up when power is supplied to the appliance.


 

Removing and Installing the DC Power Supply


NoteThis procedure applies only to the appliances with a removable DC power supply (ASA 5545-X and ASA 5555-X). This procedure applies only to the appliances with a removable DC power supply (ASA 5545-X and ASA 5555-X).


To remove and install a DC power supply, perform the following steps:


Step 1 Make sure that the chassis ground is connected on the chassis before you begin installing the DC power supply, as described in “Preventing Electrostatic Discharge Damage” section.

Step 2 Turn off the circuit breaker to the power supply.

Step 3 At the back of the appliance, move the power switch into the Standby position.

Step 4 Move the circuit-breaker switch handle to the Off position, and apply tape to hold it in the Off position.

Step 5 If you are adding an additional power supply, from the back of the appliance, push the lever on the slot cover to the left to release it, grasp the handle of the slot cover, and pull it away from the chassis. (See Figure 4-26.) Save the slot cover for future use. Continue with Step 7.

Figure 4-26 Removing the Slot Cover

 

Step 6 If you are replacing a power supply, follow these steps:

a. Remove the wires from the DC power supply by inserting a small flat-head screwdriver into the square hole above each wire to relieve the spring pressure, and then gently pull the wire out of the power supply. (See Figure 4-27.)

Figure 4-27 Removing the Wires from the DC Power Supply

 

b. Push the locking lever on the power supply to the left and remove the power supply by grasping the handle and then pulling the power supply out of the chassis while supporting it from beneath with the other hand. (See Figure 4-28.)

Figure 4-28 Removing the DC Power Supply

 

Step 7 Install the new power supply by lining it up with the power supply bay and pushing it into place until it is seated while supporting it from beneath with the other hand. (See Figure 4-29.)

Figure 4-29 Installing the DC Power Supply

 

Step 8 To connect the DC input power source wires, see Step 5 though Step 10 in Installing the DC Input Power.


 

Installing and Removing A Solid State Drive for An SSP

An Solid State Drive (SSD) is required for use with the ASA CX and FirePOWER Security Services Processor (SSP) modules. You can install one SSD in the ASA 5512-X, ASA 5515-X and ASA 5525-X. You can install two SSDs in a RAID 1 configuration in the ASA 5545-X and ASA 5555-X. Only Cisco SSDs are supported.

This section describes how to install and remove the Solid State Drive (SSD) in the ASA 5500-X series security appliances, and contains the following topics:

Installation Scenarios


Caution Be sure to replace a failed SSD as soon as possible to avoid data loss. Removal of all SSDs shuts down the SSP service.

You may need to install, remove, or replace a SSD in your 5500-X series ASA under the following conditions:

  • If the drive fails in the single-drive models, or both drives fail simultaneously in the dual-drive models, you need to replace the drives. The SSP shuts down when this happens, so SSP features are not available as part of the recovery process. You must reload the ASA and then re-image the SSP.
  • If a single drive fails in the dual-drive model, you can hot-swap the failed drive. In this case, SSP does not shut down and you do not need to reload the ASA.
  • If you want to replace a drive that is still functioning, back up and gracefully shut down the SSP before replacing the drive. You must then reload the ASA and then re-image the SSP.
  • If you are adding the SSP to an existing ASA for the first time, after you have installed the SSD in the ASA, you must reload the ASA, and then re-image the SSP.

Installing and Removing SSDs

The SSD is hot-swappable. The SSD resides in a carrier, which you install into the drive bay. You can use the SSD with an AC or DC power supply.


NoteWhen you install an SSD for the first time, you must reload the ASA and then re-image the installed SSP. When you install an SSD for the first time, you must reload the ASA and then re-image the installed SSP.


Figure 4-30 shows the SSD in its carrier.

Figure 4-30 SSD in Carrier

 

To install and remove SSDs in the ASA 5500-X series, follow these steps.


Step 1 If you need to remove an old drive, on the front panel of the ASA, remove the SSD by pressing the button on the right side of the bay until the locking lever is released. Pull out the SSD.

Figure 4-31 shows the ASA 5512/5515/5525-X models with one SSD. Figure 4-32 shows the ASA 5545/5555-X with two SSDs.

Figure 4-31 Removing the SSD from the ASA 5512/5515/5525-X

 

Figure 4-32 Removing an SSD from the ASA 5545-X and ASA 5555-X

 

Step 2 To install an SSD, on the front panel of the appliance, line up the SSD carrier with the SSD bay and push it in until it is seated. Push the locking lever into place.

Figure 4-33 shows the ASA 5512/5515/5525-X models, while Figure 4-34 shows the ASA 5545/5555-X models.

Figure 4-33 Installing an SSD in the ASA 5512/5515/5525-X

 

Figure 4-34 Installing an SSD in the ASA 5545-X and ASA 5555-X

 

Step 3 On the front panel of the ASA, make sure the HDD1 (top SSD) and HDD0 (bottom SSD) indicators are solid green to indicate that the SSDs are now active.

Step 4 If you replaced the drive in the ASA 5512-X, ASA 5515-X, or ASA 5525-X, you need to re-install the SSP using appropriate boot image. For more information, refer to the list of ASA-related Quick Start guides on cisco.com:
http://www.cisco.com/c/en/us/support/security/asa-5500-series-next-generation-firewalls/products-installation-guides-list.html

If you replaced the drives in the ASA 5545-X and ASA 5555-X, the ASA rebuilds the data on the SSD because it is in RAID1 configuration.