Cisco ASA 5585-X User manual

CHAPTER
4-1
Cisco ASA 5585-X Adaptive Security Appliance Hardware Installation Guide
OL-22567-02
4
Maintenance and Upgrade Procedures
This chapter describes maintenance and upgrade procedures, and includes the following sections:
•Removing and Installing SSPs, page 4-1
•Removing and Installing SSP Hard Disk Drives, page 4-4
•Installing and Removing Cisco ASA 5585-X Network I/O Modules, page 4-5
•Removing and Installing the Power Supply Module, page 4-11
•Removing and Installing the Fan Module, page 4-27
•Installing a Slide Rail Kit, page 4-29
•Installing and Removing a Slide-mounted Chassis, page 4-30
•Mounting the Chassis Using a Fixed Rack Mount, page 4-39
•Installing the Cable Management Brackets, page 4-41
•Troubleshooting Loose Connections, page 4-43
Removing and Installing SSPs
The ASA 5585-X comes with a core Security Services Processor (SSP) already installed (SSP-10,
SSP-20, SSP-40, or SSP-60). You can install an additional SSP (core SSP, IPS SSP, ASA CX SSP, or
FirePOWER SSP) in slot 1.
For a matrix describing which module configurations are allowed, see the ASA Module Compatibility
table.
Note Feature limitations may apply to dual SSPs. Refer to your configuration guide for more information.
The add-on SSP will not run without the core SSP installed. The add-on SSP must be installed in the
upper slot (slot 1), with the core SSP in the bottom slot (slot 0). You must power off the ASA 5585-X to
remove and install SSPs; the SSPs are not hot-swappable.

4-2
Cisco ASA 5585-X Adaptive Security Appliance Hardware Installation Guide
OL-22567-02
Chapter 4 Maintenance and Upgrade Procedures
Removing and Installing SSPs
To install and remove an add-on SSP in the ASA 5585-X, follow these steps:
Step 1 If you are replacing an existing SSP, shut it down first by entering the following CLI command;
otherwise continue with Step 3:
asa# hw-module module 1 shutdown
Shutdown module in slot 1? [confirm]
Note The core SSP resides in slot 0 (the bottom slot) while any additional SSP resides in slot 1 (the
top slot).
Step 2 Press Enter to confirm.
Step 3 Save the running config before powering off the ASA 5585-X or the configuration will be lost. Enter the
following CLI command:
asa# write memory
If you are using a management application such as ASDM or CSM to manage this ASA 5585-X, you
also can use that application to save the configuration.
Step 4 Power off the ASA 5585-X.
Step 5 Remove the power cable from the ASA 5585-X.
Step 6 If you are installing an add-on SSP for the fist time, loosen the captive screws on the upper left and right
of the slot tray (slot 1), and remove it. Store it in a safe place for future use. If you are replacing an
existing SSP, continue with Step 10.
Caution You must install slot trays in all empty slots to maintain the proper air flow. This also prevents EMI,
which can disrupt other equipment.
Step 7 On the front panel of the ASA 5585-X, loosen the captive screws from either the top slot (for the add-on
SSP), or bottom slot (for the core SSP).
1Slot tray
PWR
BOOT
ALARM
ACT
VPN
PS1
HDD1
PS0
HDD0
USB
RESET
0
SFP1 SFP0 1
01234567 MGMT
0
1
AUX CO NS OLE
254861
1

4-3
Cisco ASA 5585-X Adaptive Security Appliance Hardware Installation Guide
OL-22567-02
Chapter 4 Maintenance and Upgrade Procedures
Removing and Installing SSPs
Step 8 Grasp the ejection levers at the left and right bottom of the module slot and pull them out.
Step 9 Grasp the sides of the module and pull it all the way out of the chassis.
Step 10 Install the new module by lining it up with the slot. first ensuring the ejection levers are extended.
Step 11 Slide the module into the slot until it is seated and then push the ejection levers into place.
Step 12 Insert and tighten the captive screws.
Step 13 Reconnect the power cable to the ASA 5585-X.
Step 14 Power on the ASA 5585-X.
Step 15 Press Enter to confirm.
Step 16 Verify that the PWR indicator on the front panel is green.
1Module 2Ejection levers
1Module 2Ejection levers
PWR
BOOT
ALARM
ACT
VPN
PS1
HDD1
PS0
HDD0
USB
RESET
0
SFP1 SFP0 1
01234567 MGMT
0
1
AUX CONSOLE
253902
PWR
BOOT
ALARM
ACT
VPN
PS1
HDD1
PS0
HDD0
USB
RESET
0
SFP1 SFP0 101234567 MGMT
0
1
AUX CONSOLE
2
2
1
PWR
BOOT
ALARM
ACT
VPN
PS1
HDD1
PS0
HDD0
USB
RESET
0
SFP1 SFP0 1
01234567 MGMT
0
1
AUX CO NS OLE
253903
PWR
BOOT
ALARM
ACT
VPN
PS1
HDD1
PS0
HDD0
USB
RESET
0
SFP1 SFP0 101234567 MGMT
0
1
AUX CONSOLE
2
2
1

4-4
Cisco ASA 5585-X Adaptive Security Appliance Hardware Installation Guide
OL-22567-02
Chapter 4 Maintenance and Upgrade Procedures
Removing and Installing SSP Hard Disk Drives
Removing and Installing SSP Hard Disk Drives
The CX or FirePOWER SSP resides in slot 1 (the top slot) of the Cisco ASA 5585-X. The SSP includes
two hard disk drives in a RAID 1 configuration. If one of the hard disk drives fails, you can remove and
install a replacement.
Note Make sure that you replace the SSP hard disk drives with Cisco-approved hard disk drives.
Each hard disk drive is hot-swappable. The hard disk drive resides in a carrier, which you install into the
SSP’s hard disk drive bay. You can use the hard disk drive with an AC or DC power supply. Each hard
disk drive is shipped in a carrier, as shown in Figure 4-1.
Figure 4-1 SSP Hard Disk Drive in Carrier
Caution Make sure that you replace the failed hard disk drive as soon as possible; otherwise, if the remaining
hard disk drive fails, all data is lost.
To remove and install a hard disk drive in the SSP, follow these steps:
Step 1 From the front panel of the SSP, remove the hard disk drive by pressing the button on the right side of
the bay until the locking lever is released. Pull out the hard disk drive.
Step 2 On the front panel of the SSP, line up the hard disk drive carrier with the hard disk drive bay and push it
in until it is seated. Push the locking lever into place.
332634
PWR
BOOT
ALARM
ACT
VPN
PS1
HDD1
PS0
HDD0
USB
RESET
0
SFP1 SFP0 1
01234567 MGMT
0
1
AUX CO NS OLE
332632
PWR
BOOT
ALARM
ACT
VPN
PS1
HDD1
PS0
HDD0
USB
RESET
0
SFP1 SFP0 101234567 MGMT
0
1
AUX CONSOLE

4-5
Cisco ASA 5585-X Adaptive Security Appliance Hardware Installation Guide
OL-22567-02
Chapter 4 Maintenance and Upgrade Procedures
Installing and Removing Cisco ASA 5585-X Network I/O Modules
Step 3 On the front panel of the SSP, ensure the HDD1 (left hard disk drive) and HDD0 (right hard disk drive)
indicators are flashing green to indicate that the drives are active.
Installing and Removing Cisco ASA 5585-X Network I/O
Modules
The ASA 5585-X comes with a core Security Services Processor (SSP-10, SSP-20, SSP-40, or SSP-60)
already installed in slot 0. You can install one or two of the following optional network I/O modules in
slot 1, which you divide into two slots using the accompanying slot divider:
•Cisco ASA 5585-X 4-port 10-G Network I/O Module
•Cisco ASA 5585-X 8-port 10-G Network I/O Module
•Cisco ASA 5585-X 20-port 1-G Network I/O Module
The network I/O module is not hot-swappable, so you must power off the ASA 5585-X before installing
or removing the module. You must have a Phillips head screwdriver to install the slot divider that divides
slot 1 into two bays.
The ports are numbered right to left, with port 0 being the far right port and the far left port is either port
3, 7, or 19 depending on whether you have a 4-, 8-, or 20-port module. The 20-port numbers go from top
to bottom, and right to left. For slot 1 (top right slot), the interface is named TenGigabitEthernet 1/0
through TenGigabitEthernet 1/3. For slot 2 (top left slot) the interface is named TenGigabitEthernet 2/0
through TenGigabitEthernet 2/7.
PWR
BOOT
ALARM
ACT
VPN
PS1
HDD1
PS0
HDD0
USB
RESET
0
SFP1 SFP0 101234567 MGMT
0
1
AUX CONSOLE
332633
PWR
BOOT
ALARM
ACT
VPN
PS1
HDD1
PS0
HDD0
USB
RESET
0
SFP1 SFP0 101234567 MGMT
0
1
AUX CONSOLE

4-6
Cisco ASA 5585-X Adaptive Security Appliance Hardware Installation Guide
OL-22567-02
Chapter 4 Maintenance and Upgrade Procedures
Installing and Removing Cisco ASA 5585-X Network I/O Modules
Figure 4-2 shows the port numbering for the 4-port network I/O module.
Figure 4-2 4-Port Network I/O Module Port Numbering
Figure 4-3 shows the port numbering for the 8-port network I/O module.
Figure 4-3 8-Port Network I/O Module Port Numbering
1TenGigabitEthernet 00 through 03
2
310
Cisco ASA 4-Port 10GE Network Module
STATUS
EJECT
PWR
1
332446
1TenGigabitEthernet 00 through 07
2
310
6
754
STATUS
EJECT
PWR
Cisco ASA 8-Port 10GE Network Module
1
332447

4-7
Cisco ASA 5585-X Adaptive Security Appliance Hardware Installation Guide
OL-22567-02
Chapter 4 Maintenance and Upgrade Procedures
Installing and Removing Cisco ASA 5585-X Network I/O Modules
Figure 4-4 shows the port numbering for the 20-port network I/O module. For slot 0, the interface is
named GigabitEthernet 0/0 through GigabitEthernet 0/19.
Figure 4-4 20-Port Network I/O Module Port Numbering
Caution Be sure the ASA software version installed on your ASA 5585-X supports the network I/O modules and
the accompanying SFP/SFP+ transceivers. Refer to Cisco ASA Compatibility for more information.
Table 4-1 lists the SFP/SFP+ transceiver modules supported by the ASA 5585-X.
1GigabitEthernet 00 through 07 2GigabitEthernet 08 through 19
8
9
10
11
12
13
14
15
16
17
18
19 6
74
52
30
1
Cisco ASA 5585-X 20-Port GE Module
PWR STATUS
EJECT
1
2
332446
Table 4-1 SFP/SFP+ Transceiver Modules
1G SFP Module
GLC-SX-MM 1000 Base-SX SFP module
GLC-SX-MMD 1000BASE-SX short wavelength, with DOM
GLC-LH-SM 1000 Base-LX/LH SFP module
GLC-LH-SMD 1000BASE-LX/LH long-wavelength, with DOM
GLC-EX-SMD 1000 Base-EX SFP module, SMF, 1310nm, DOM
GLC-T 1000BASE-T standard
10G SFP+ Module
SFP-10G-ER 10G ER SFP+ module
SFP-10G-SR 10G SR SFP+ module
SFP-10G-LRM 10G LRM SFP+ module
SFP-10G-LR 10G LR SFP+ module
SFP-H10GB-ACU7M 10GBASE-CU SFP+ Cable 7 Meter, active
SFP-H10GB-ACU10M 10GBASE-CU SFP+ Cable 10 Meter, active

4-8
Cisco ASA 5585-X Adaptive Security Appliance Hardware Installation Guide
OL-22567-02
Chapter 4 Maintenance and Upgrade Procedures
Installing and Removing Cisco ASA 5585-X Network I/O Modules
Note These SFP+ modules require ASA 8.2.5 or later: SFP-10G-LRM, SFP-10G-LR, SFP-H10GB-CU1M,
SFP-H10GB-CU3M, and SFP-H10GB-CU5M.
Note Only SFP/SFP+ transceiver modules certified by Cisco are supported on the ASA 5585-X.
Caution Protect your SFP/SFP+ transceivers by inserting clean dust plugs into the SFP/SFP+ modules after
extracting cables from them. Be sure to clean the surfaces of the fiber-optic cables before you plug
them back into the optical bores of another SFP/SFP+ module. Avoid getting dust and other
contaminants into the optical bores of your SFP/SFP+ modules. The cables do not operate correctly
when obstructed with dust.
Warning Because invisible laser radiation may be emitted from the aperture of the port when no cable is
connected, avoid exposure to laser radiation and do not stare into open apertures. Statement 70
To install a 4-, 8-, or 20-port network I/O module and related SFP/SFP+ transceivers into the
ASA 5585-X:
Step 1 Power off the security appliance.
Caution Network I/O modules are not hot-swappable.
Step 2 Locate a grounding strap, and fasten it to your wrist so that it contacts bare skin. Attach the other end to
the chassis.
Step 3 Loosen the captive screws on the upper left and right of the top slot tray (slot 1), and remove it
(Figure 4-5). Store it in a safe place for future use.
Caution You must install slot covers on all empty slots to maintain the proper air flow. This also prevents EMI,
which can disrupt other equipment.
SFP-H10GB-CU1M 10GBASE-CU SFP+ cable 1 meter, passive
SFP-H10GB-CU3M 10GBASE-CU SFP+ cable 3 meter, passive
SFP-H10GB-CU5M 10GBASE-CU SFP+ cable 5 meter, passive
Table 4-1 SFP/SFP+ Transceiver Modules (continued)
1G SFP Module

4-9
Cisco ASA 5585-X Adaptive Security Appliance Hardware Installation Guide
OL-22567-02
Chapter 4 Maintenance and Upgrade Procedures
Installing and Removing Cisco ASA 5585-X Network I/O Modules
Figure 4-5 Removing the Empty Slot Tray
Step 4 Install the slot divider in the middle of slot 1 by lining up the groove on the top of the slot divider with
the inside track on the top of the security appliance and sliding it in until it is seated. Tighten the captive
screw with a Phillips head screwdriver (Figure 4-6).
Figure 4-6 Installing the Slot Divider
Step 5 Install a network I/O module by lining it up with either the left or the right bay of slot 1, making sure
the ejection levers are extended (Figure 4-7 and Figure 4-8 on page 4-10).
1Empty slot tray
PWR
BOOT
ALARM
ACT
VPN
PS1
HDD1
PS0
HDD0
USB
RESET
0
SFP1 SFP0 1
01234567 MGMT
0
1
AUX CONSOLE
254861
1
1Slot divider with captive screw
PWR
BOOT
ALARM
ACT
VPN
PS1
HDD1
PS0
HDD0
USB
RESET
0
SFP1 SFP0 1
01234567 MGMT
0
1
AUX CO NS OLE
331652
1

4-10
Cisco ASA 5585-X Adaptive Security Appliance Hardware Installation Guide
OL-22567-02
Chapter 4 Maintenance and Upgrade Procedures
Installing and Removing Cisco ASA 5585-X Network I/O Modules
Figure 4-7 Installing a 4- or 8-Port 10-G Network I/O Module
Figure 4-8 Installing a 20-Port 1-G Network I/O Module
Step 6 Slide the network module into the slot until it is seated and push the ejection levers back into place.
Step 7 With your fingers, tighten the captive thumb screws.
Step 8 If you are installing only one network I/O module, install a slot cover on the empty slot bay to protect it.
Caution You must install slot covers on all empty slots to maintain the proper air flow. This also prevents EMI,
which can disrupt other equipment.
Step 9 Install a SFP/SFP+ transceiver by aligning it with the I/O module port and sliding it into the port slot
until it locks into position (Figure 4-9).
Caution Do not remove the optical port plugs from the SFP/SFP+ until you are ready to connect the cabling.
14- or 8-port 10-G network module 2Ejection levers
3Slot 2 left bay 4Slot 1 right bay
PWR
BOOT
ALARM
ACT
VPN
PS1
HDD1
PS0
HDD0
USB
RESET
0
SFP1 SFP0 10123
4
567 MGMT
0
1
AUX CONSOLE
331651
1
2
4
2
3
120-port 1-G network I/O module 2Ejection levers
3Slot 2 left bay 4Slot 1 right bay
PWR
BOOT
ALARM
ACT
VPN
PS1
HDD1
PS0
HDD0
USB
RESET
0
SFP1 SFP0 101234567 MGMT
0
1
AUX CONSOLE
331867
1
24
23