Allen-Bradley Stratix 5950 User manual

Stratix 5950 Security Appliance
Catalog Numbers 1783-SAD4T0SBK9, 1783-SAD4T0SPK9, 1783-SAD2T2SBK9, 1783-SAD2T2SPK9
User Manual
Original Instructions

Important User Information
Read this document and the documents listed in the additional resources section about installation, configuration, and
operation of this equipment before you install, configure, operate, or maintain this product. Users are required to
familiarize themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws,
and standards.
Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are
required to be carried out by suitably trained personnel in accordance with applicable code of practice.
If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may
be impaired.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from
the use or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or
liability for actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or
software described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation,
Inc., is prohibited
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
Labels may also be on or inside the equipment to provide specific precautions.
WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous
environment, which may lead to personal injury or death, property damage, or economic loss.
ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property
damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.
IMPORTANT Identifies information that is critical for successful application and understanding of the product.
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous
voltage may be present.
BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may
reach dangerous temperatures.
ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to
potential Arc Flash. Arc Flash will cause severe injury or death.Wear proper Personal Protective Equipment (PPE). Follow ALL
Regulatory requirements for safe work practices and for Personal Protective Equipment (PPE).

Rockwell Automation Publication 1783-UM010C-EN-P - June 2019 3
Table of Contents
Preface
Summary of Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Chapter 1
About the Security Appliance Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Hardware Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Status Indicators. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Installation of the Security Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Express Setup Button . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Small Form Factor Pluggable (SFP) Modules . . . . . . . . . . . . . . . . . . . . 17
Memory and Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
SD Card. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
USB Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Management Ethernet Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Console Port. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Alarm Ports. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
CLI Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Temperature Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Software Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Chapter 2
Industrial Firewall Use Cases Industrial Firewall Technology Overview. . . . . . . . . . . . . . . . . . . . . . . . 21
Logical Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Network Protection (Adaptive Security Appliance) . . . . . . . . . . . . . . 23
Intrusion Prevention and Detection (FirePOWER). . . . . . . . . . . . . . 25
Machine/Skid Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Transparent Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Routed Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Redundant Star Cell/Area Zone Protection . . . . . . . . . . . . . . . . . . . . . 28
Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Ring Cell/Area Zone Protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Cell/Area Zone Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Time Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Chapter 3
Configure the Security Appliance Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Ethernet Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Device Setup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Startup Wizard. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

4Rockwell Automation Publication 1783-UM010C-EN-P - June 2019
Table of Contents
Configure FirePOWER Administrative Settings . . . . . . . . . . . . . 49
Configure the HTTPS Certificate Information . . . . . . . . . . . . . . 51
Configure a Test Policy to Block CIP Administrative Traffic . . . . . 53
Single Policy Restriction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Configure a Test Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Add a Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Update Real Time Eventing View. . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Change Device from Monitor Mode to Full Blocking Config. . 65
Configure SPAN Port Monitoring Settings . . . . . . . . . . . . . . . . . . 67
Change the IP Address of the Communication Module. . . . . . . 68
Configure Precision Time Protocol (PTP) . . . . . . . . . . . . . . . . . . . . . . 71
Chapter 4
Monitor the Security Appliance Status Indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Chapter 5
Centralized Management Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
FireSIGHT Management Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Cisco Security Manager (CSM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Management Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Integration of New Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Centralized Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Chapter 6
Hardware Bypass Power Failure of the System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Enable the Hardware Bypass by Using CLI Commands . . . . . . . . . . 81
Default State of the Hardware Bypass . . . . . . . . . . . . . . . . . . . . . . . 82
ASA CLI Commands for Hardware Bypass . . . . . . . . . . . . . . . . . . . . . 82
Limitations of Hardware Bypass . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Hardware Bypass CLI. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Chapter 7
CIP Inspection CIP Preprocessor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
CIP Access Control Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
CIP Access Control Policy Rule Limitations . . . . . . . . . . . . . . . . . 89
CIP Intrusion Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Chapter 8
Firewall Modes Industrial Firewall Deployment Considerations. . . . . . . . . . . . . . . . . . 92
Inline Transparent Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Inline Transparent Monitor-only Mode . . . . . . . . . . . . . . . . . . . . . 94
Inline Routed Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Passive Monitor-only Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Deployment Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Industrial Firewall Use Cases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Machine/Skid Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

Rockwell Automation Publication 1783-UM010C-EN-P - June 2019 5
Table of Contents
Redundant Star Cell/Area Zone Protection. . . . . . . . . . . . . . . . . . 99
Ring Cell/Area Zone Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
Cell/Area Zone Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Chapter 9
Updating the Device Updating ASDM Software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Updating ASA Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Back Up Controls License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Install the SFR 6.4.0 Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Chapter 10
Troubleshoot Obtain the Current Running Software Versions . . . . . . . . . . . . . . . . 117
Reset the Device to Factory Defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Uninstall an Old SFR Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Reinstall an SFR Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Install the SFR 5.4.1.2 Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Install the SFR 5.4.1.4 Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Install SFR 5.4.1.6 Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Final Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

6Rockwell Automation Publication 1783-UM010C-EN-P - June 2019
Table of Contents
Notes:

Rockwell Automation Publication 1783-UM010C-EN-P - June 2019 7
Preface
The Stratix® 5950 Security Appliance User Manual provides a product
overview and explains how to connect and configure the security appliance.
This manual is intended for people who have a high level of technical ability.
Experience with Cisco software is not a prerequisite.
This manual describes the appliance and pertinent features for the
out-of-the-box Converged Plantwide Ethernet (CPwE) architecture
configuration scenarios. Common Rockwell Automation® use cases include:
• Inline Transparent Mode
• Inline Transparent Monitor-only Mode
•Inline Routed Mode
• Passive Monitor-only Mode
This publication describes the embedded software features and tools to
configure and manage the security appliance. In addition, this publication
provides information to help you resolve basic security configuration and
network issues.
This manual assumes that you understand the following:
• Local area network (LAN) switch fundamentals
• Concepts and terminology of the Ethernet protocol and local area
networking
• Proficient with CLI command-line programming language
This manual is intended for users of the appliance. We assume that you are
familiar with the procedures in the Stratix 5950 Security Appliance
Installation Instructions, publication 1783-IN002.
The publication, Deploying Industrial Firewalls within a Converged Plantwide
Ethernet Architecture Design and Implementation Guide, provides detailed
information about CPwE.
Subject mater authorities at Cisco and Rockwell Automation® developed a
collection of tested and validated architectures known as CPwE. Rockwell
Automation follows the Cisco Validated Design (CVD) program. The content
of CPwE is relevant to both Operational Technology (OT) and Informational
Technology (IT) disciplines and consists of documented architectures, proven
approaches, guidance, and configuration settings. CPwE architectures help
manufacturers with design and deployment of a scalable, robust, secure, and
future-ready, plant-wide industrial network infrastructure. CPwE also helps
manufacturers to achieve the benefits of cost reductions by using proven
designs, which can help lead to quicker deployment of new technology with
reduced risk.
Read and understand this manual and CPwE before using the products.
Consult your Rockwell Automation representative if you have any questions
or comments.

8Rockwell Automation Publication 1783-UM010C-EN-P - June 2019
Preface
Download firmware, associated files, and access product release notes from the
Product Compatibility and Download Center (PCDC) at:
http://www.rockwellautomation.com/rockwellautomation/support/pcdc.page
The Cisco Firewall and Firepower manuals provide detailed instructions,
including the following topics.
• Cisco ASA software and hardware compatibility and requirements
• Cisco ASA series documentation
•Cisco Security Manager
• FirePOWER System, Cisco SSL Appliance, and FireAMP
Links to these manuals are available in Additional Resources on page 8.
Summary of Changes This manual contains new and updated information.
Additional Resources These documents contain additional information concerning related products
from Rockwell Automation.
Topic Page
Single Policy Restriction 53
Configure Precision Time Protocol (PTP) 71
CIP Access Control Policy Rule Limitations 60, 89
Updating the Device 103
Resource Description
Stratix 5950 Security Appliance Installation Instructions, publication 1783-IN002 Provides detailed specifications and information that is
related to installation of the security appliance.
Stratix Ethernet Device Specifications Technical Data, publication 1783-TD001 Provides specification information for Stratix switches and
appliances.
Industrial AutomationWiring and Grounding Guidelines, publication 1770-4.1 Provides general guidelines for installing a Rockwell
Automation industrial system.
Deploying Industrial Firewalls within a Converged Plantwide Ethernet Architecture Design and Implementation
Guides
Provides detailed information about Converged Plantwide
Ethernet (CPwE).
Product Certifications website, http://www.rockwellautomation.com/global/certification/overview.page Provides declarations of conformity, certificates, and other
certification details.
ASA and ASDM documentation
http://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html
http://www.cisco.com/c/en/us/td/docs/security/asa/roadmap/asaroadmap.html
Lists the Cisco ASA software and hardware compatibility and
requirements.
Describes the available Cisco ASA series documentation and
provides links to access the documentation online.
CSM Documentation
http://www.cisco.com/c/en/us/support/security/security-manager/products-documentation-roadmaps-list.html
Lists Cisco Security Manager documentation roadmaps.
FireSIGHT Documentation
http://www.cisco.com/c/en/us/td/docs/security/firesight/roadmap/firesight-roadmap.html
Describes the available Firepower System documentation,
including legacy FireSIGHT System and Firepower 3D System
documentation, Cisco SSL Appliance documentation, and
FireAMP documentation and provides links to access the
documentation.

Rockwell Automation Publication 1783-UM010C-EN-P - June 2019 9
Preface
You can view or download publications at
http://www.rockwellautomation.com/global/literature-library/overview.page.
To order paper copies of technical documentation, contact your local
Allen-Bradley distributor or Rockwell Automation sales representative.

10 Rockwell Automation Publication 1783-UM010C-EN-P - June 2019
Preface
Notes:

Rockwell Automation Publication 1783-UM010C-EN-P - June 2019 11
Chapter 1
About the Security Appliance
Overview The Stratix® 5950 Security Appliance is a DIN Rail-mounted ruggedized,
64-bit industrial product that provides firewall, threat defense, and VPN
services. A DIN Rail is a standard metal rail that is widely used for mounting
circuit breakers and industrial control equipment inside equipment racks.
The Stratix 5950 Security Appliance is low power, fan-less, with a dedicated
Gigabit Ethernet management port.
The Stratix 5950 Security Appliance comes with Cisco ASA firewall
protection, which is combined with industry-leading Firepower threat
protection. The security appliance has firewall images pre-installed with
appropriate licenses.
Table 1 - License Descriptions
License Attribute 1783-SAD4T0SBK9 Copper 1783-SAD4T0SPK9 Copper 1783-SAD2T2SBK9 Fiber 1783-SAD2T2SPK9 Fiber
4x10/100/1000 Base T xx
2x10/100/1000 Base T xx
Management port xxxx
Base License xx
2x1GbE SFP Base License xx
ASA SW xxxx
FirePOWER and App Control xxxx
K9(1) xxxx
TA License(2) xxxx
VPN for SSL(3) xx
Clientless SSL(4) xx
IPSec(5) xx
Supports 3DES/AES(6) xxxx
(1) A web-based filtering technology that provides automatic updates when you need a robust, real-time solution.
(2) Helps provide increased control and protection during system updates.
(3) Allows for the creation of a secure, encrypted connection without requiring specialized software on an end user’s computer.
(4) Helps deliver secure access to preconfigured network resources on a corporate network with an SSL-enabled web browser.
(5) IPSec is a standard set of protocols that provides data security at the IP packet level.
(6) Encryption standards that offer additional layers of data security.

12 Rockwell Automation Publication 1783-UM010C-EN-P - June 2019
Chapter 1 About the Security Appliance
Hardware Features The following are the hardware features of the Stratix 5950 Security Appliance.
• Dedicated management-only Gigabit Ethernet port
• Mini-USB and RJ45 Console port
• Bypass Relay (only available on copper ports). Bypass relay is used when
there is a loss of power or under software control.
• ±12V DC…48V DC Rated (9.6V DC…60V DC Maximum) redundant
power inputs with 20-12 AWG screw cage terminals
• Cisco ASA firewall protection, which is combined with
industry-leading Firepower threat protection
• Two external USB-A ports for addition of memory cards, security
tokens, modems, or other USB 2.0-compliant devices
• Two alarm inputs
• Fault relay outputs
• DIN Rail mounts incorporated into the chassis
• Fan-less design
•Industrial temperature SDHC card
•Secure boot support
For complete information on how to install the security appliance, see the
Stratix 5950 Security Appliance Installation Instructions,
publication 1783-IN002.

Rockwell Automation Publication 1783-UM010C-EN-P - June 2019 13
About the Security Appliance Chapter 1
Figure 1 - Stratix 5959 Security Appliance Copper
Figure 2 - Stratix 5950 Security Appliance Fiber
32593-M
32604-M

14 Rockwell Automation Publication 1783-UM010C-EN-P - June 2019
Chapter 1 About the Security Appliance
Figure 3 - Stratix 5950 Security Appliance Fiber Front Panel
Item Description Item Description
1 Express Setup pinhole Access 8 DC Power connection B
2 Console, Management 9 RJ45 10/100/100 BaseT Connectors 1 & 2
3 EIP ModStatus 10 On the Stratix 5950 Fiber SKU, the SFP sockets.
4 Console connector (RJ45) 11 SD Card Slot
5 Console connector (mini-USB) 12 Alarm Connectors
6 USB connectors 13 Grounding point
7 DC Power connection A 14 Alarm
32592-M
1783-SAD2T2S
®
1
7
9
6
4
3
8
14
13
12
11
10
5
2

Rockwell Automation Publication 1783-UM010C-EN-P - June 2019 15
About the Security Appliance Chapter 1
Figure 4 - Stratix 5950 Security Appliance Copper Front Panel
Status Indicators
For complete information about the Stratix 5950 security appliance status
indicators, see Status Indicators on page 73.
Item Description Item Description
1 Express Setup pinhole Access 8 DC Power connection B
2 Console, Management 9 RJ45 10/100/100 BaseT Connectors 1&2
3 EIP ModStatus 10 On the Stratix 5950 Copper SKU, the RJ45 10/100/100
BaseT Connectors 3&4
4 Console connector (RJ45) 11 SD Card Slot
5 Console connector (mini-USB) 12 Alarm Connectors
6 USB connectors 13 Grounding point
7 DC Power connection A 14 Alarm
1783-SAD4T0S
®
1
7
9
6
4
3
8
14
13
12
11
10
5
2

16 Rockwell Automation Publication 1783-UM010C-EN-P - June 2019
Chapter 1 About the Security Appliance
Installation of the Security
Appliance
To install the Stratix 5950 Security Appliance, follow the introductions in the
Stratix 5950 Security Appliance Installation Instructions,
publication 1783-IN002.
Express Setup Button Express Setup resets the security appliance ASA configuration to the default
configuration set by the factory.
To restore the security appliance configuration to the default configuration set
by the factory, follow these steps.
1. Use a standard-size #1 paper clip with wire gauge 0.033 inches or smaller
and
2. Press the Express Setup button after the device is fully booted.
When depressed, the push button follows these actions.
• Depressed 0 to < 3 seconds or > 15 seconds — No action is taken.
• Depressed > 3 seconds < 15 seconds —
The appliance automatically restarts when the button is pushed. After
restart, the unit runs the original factory default configuration.
The FirePOWER module is NOT reset to Factory Default with the Express
Setup button pressed for >3 seconds and < 15 seconds.
TIP The new configuration does not take effect until after the system restarts.
The system boots with the original factory default configuration, including
ROMMON variables.The administrator can disable this feature via ASA CLI so
that no action is taken when the push button is depressed.

Rockwell Automation Publication 1783-UM010C-EN-P - June 2019 17
About the Security Appliance Chapter 1
Power Supply The Stratix 5950 security appliance comes with redundant external power
connector. The connector supports 12 - 48V DC. The connectors are Molex
5.00 mm Pitch Eurostyle Horizontal Plug, with Retention Screws.
The power supply does not support reverse polarity, but does have reverse
polarity protection. If you reverse + & - connections, the system does not
power on and there is no damage.
The + terminal always has to be greater than the - terminal for the system to
operate. The difference is in the system grounding scheme that is used.
The Stratix 5950 security appliance supports three basic schemes:
• Isolated DC in, neither + nor - terminal is tied to chassis GND
• Positive DC in, negative (-) terminal is tied to chassis GND
• Negative DC in, positive (+) terminal is tied to chassis GND
Small Form Factor Pluggable
(SFP) Modules
Memory and Storage The Stratix 5950 security appliance has 8 GB of DRAM. It also has two
storage devices, a 50 GB SSD and a 15 GB update device. All memory
components are factory default and not upgradeable by the end user.
SD Card The Stratix 5950 security appliance has an SD card slot as shown in
Figure 3 on page 14. The SD card lets you have easy access to updates, copy
logs, and crash-dumps. You can copy anything from the ASA file-system
(disk0) to the SD card. One, blank SD card (1 GB) is shipped with the
appliance.
USB Ports The Stratix 5950 security appliance has two externally accessible Type-A USB
(4-pin) connectors. Each USB port supports output of 5 volts power and up to
a maximum of 500 mA.
TIP To confirm uninterrupted operation, the redundant power connections must
be connected to independently separated power sources.
Table 2 - Small Form Factor Pluggable (SFP) Modules
SFP P/N Catalog Description Purchased CISCO P/N Cisco Catalog
PN-27874 1783-SFP100FX A 100FX SFP Fiber Transceiver PN-29262 GLC-FE-100FX-RGD
PN-27875 1783-SFP100LX A 100LX SFP Fiber Transceiver PN-29249 GLC-FE-100LX-RGD
PN-27876 1783-SFP1GSX A 1000SX SFP Fiber Transceiver PN-29264 GLC-SX-MM-RGD
PN-27877 1783-SFP1GLX A 1000LX SFP FiberTransceiver PN-29265 GLC-LX-SM-RGD

18 Rockwell Automation Publication 1783-UM010C-EN-P - June 2019
Chapter 1 About the Security Appliance
Management Ethernet Port A management-only 10/100/1000 BaseT Ethernet port is provided. This port
is the only port that is able to configure the device for initial setup of the
system. This port is Management1/1 in the ASA configuration.
Console Port You can configure the Stratix 5950 security appliance through a web interface,
or through the console port. The console port is either an RJ45 or a Mini USB
connector. You can use the Rockwell Automation USB to RJ45 console cable
(part number 9300-USBCBL-CNSL).
The default configuration settings for the RJ45 console port are:
9600 baud, 8 data bits, no parity, 1 stop bit, no flow control.
If the USB Console Port is active, by default, the console switches from RJ45
to USB when the USB cable is detected. The USB Console Port is active when
a cable is inserted and remote personal computer drivers are enabled. When
both ports are connected, the Mini USB console port is used.
This table shows the pinouts for the CON/AUX RJ45 connector.
Table 3 - Pinouts for the CON/AUX RJ45 Connector
Pin Signal Direction
1DTR Output
23.3 Output
3TXD Output
4GND
5GND
6RXD Input
7- NC
8- NC
IMPORTANT The console port does not support a remote dial-in modem.

Rockwell Automation Publication 1783-UM010C-EN-P - June 2019 19
About the Security Appliance Chapter 1
Alarm Ports The Stratix 5950 security appliance has alarm ports as shown in Figure 1 on
page 13. There are two conditions that can generate an alarm:
• When dual power supply is configured, and there is a failed or missing
power supply.
• When the CPU temperature is in critical condition below -40 °C or
above 105 °C (below -40 °F or above 221 °F)
When either condition is met, the alarm status indicator turns red, and a syslog
message and SNMP trap is triggered.
The Stratix 5950 security appliance has alarm relay contacts that can be used
for an external alert system. The alarm condition of a missing/failed power
supply, when ‘power-supply dual’ is configured, triggers Alarm Relay output.
This alarm condition also sets the alarm output status indicator to solid RED
and sends out a syslog message.
Power Supply The CLI command to configure dual power supplies is power-supply
dual. When set, the system expects to see both power supplies functioning
properly.
CLI Commands
stratix5950(config)# power-supply dual
This command informs ASA that system administration expects dual
power-supply functioning. If any of the power supplies fails, alarm
events can be triggered.
stratix5950(config)# no power-supply dual
(default)
This command informs ASA that system administration does not
expect dual power-supply (either one or two power supplies that are
functional are acceptable).
IMPORTANT When configured for dual power supply, and a failure occurs, the Alarm Out
status indicator turns red. The alarm relay is also energized. A syslog
message is generated:
Syslog: %ASA-1-735006: Power Supply Unit Redundancy Lost
When configured for dual power supply, and a failure recovers, the Alarm
Out status indicator turns off. A syslog message is generated:
Syslog: %ASA-1-735005: Power Supply Unit Redundancy OK

20 Rockwell Automation Publication 1783-UM010C-EN-P - June 2019
Chapter 1 About the Security Appliance
Temperature Sensor The operating system monitors the CPU temperature when it is running.
• If the CPU temperature is in a critical condition, below -40 °C or above
+105 °C (below -40 °F or above +221 °F) the Alarm Out status
indicator turns red.
• When the CPU temperature returns to a normal condition, the Alarm
Out status indicator turns off.
The critical range of temperature is not configurable. It is hard-coded as below
-40° C or above +105 °C (below -40 °F or above +221 °F).
Software Features The following software features support the hardware.
• Software based on ASA version 9.12.0 and FirePOWER 6.4.0 supports
the Stratix 5950 security appliance hardware platform.
• The software provides Firewall, Network Address Translation (NAT),
VPN, and intrusion prevention system (IPS) features
• ASDM Bundled Version 7.12.1 (including ASA FirePOWER)
• CSM version 4.11 and FireSIGHT Management Center version 5.4.1.6
• Windows 10 is not supported.
TIP The Stratix 5950 security appliance is a joint technology
collaboration with Cisco. You can leverage the CSM and FireSIGHT
Management Center Cisco software bundles with this device.