Introducing the Cisco ASA 5585-X
This chapter describes the Cisco ASA 5585-X and includes the following sections:
- Product Overview
- Chassis Features
- Specifications
- Memory Configurations
- Power Supply Module Requirements
- SFP/SFP+ Modules
Note
Read through the entire guide before beginning any of the installation procedures.
Warning Only trained and qualified personnel should install, replace, or service this equipment. Statement 49
Read the safety warnings in the
Regulatory Compliance and Safety Information for the Cisco ASA 5585-X Adaptive Security Appliance document and follow proper safety procedures when performing the steps in this guide.
Product Overview
The ASA 5585-X adaptive security appliance featuring MultiScale™ is a two-rack-unit (2RU), two-slot chassis. Supporting one of the highest performance-density firewalls on the market, the design of the ASA 5585-X provides high scalability not only in terms of throughput, but also high connection speed and maximum connections. Connection speed and maximum connection requirements are growing much faster than throughput in most customer data center networks. The capabilities of the ASA 5585-X help you simultaneously meet scalability challenges in throughput, connection capacity, and connection speed in the data center.
In addition to world-class performance, the ASA 5585-X deploys encrypted traffic inspection, port density (up to 20 interfaces depending on the model), and feature performance matching; that is, performance parity between firewall and IPS functions.
Note Dual firewall mode is only supported in certain versions of ASA software. For more information, refer to the Cisco ASA Compatibility document found at this URL:
http://www.cisco.com/en/US/docs/security/asa/compatibility/asamatrx.html
All ASA 5585-X series adaptive security appliances ship with a core Security Services Processor (SSP); you can install an additional core SSP, IPS SSP, CX SSP, or FirePOWER SSP, or up to two network modules. You must have the core SSP to run the other modules. The core SSP resides in slot 0 (the bottom slot).
The ASA 5585-X is available with four core SSP versions:
- ASA 5585-X with Security Services Processor-10
- ASA 5585-X with Security Services Processor-20
- ASA 5585-X with Security Services Processor-40
- ASA 5585-X with Security Services Processor-60
Starting with ASA version 5.4.0.1, there is support for mixed level SSPs.
Note For the SSP40/60 combination, you might see an error message that this combination is not supported. You can ignore the message.
For a matrix describing which module configurations are allowed, see the ASA Module Compatibility table.
Each ASA 5585-X chassis accommodates up to two AC power supply modules, each of which contains an integrated fan; you can alternatively install a fan module in the second bay. Optional redundant, hot-swappable power supply modules are available, as well as hot-swappable fan modules in case of a fan failure.
The core SSP provides environmental monitoring, which tracks the operational status of the fan and power supply modules. In addition, it tracks the temperatures of the CPUs and the ambient temperature of the system.
Note Online insertion and removal (OIR) of SSPs and network modules is not supported at this time. Small form-factor pluggable (SFP/SFP+) transceiver, power-supply module, and fan module OIR is supported.
The ASA software supports Cisco Adaptive Security Device Manager (ASDM), which delivers world-class security management and monitoring through an intuitive, easy-to-use web-based management interface. Bundled with the adaptive security appliance, ASDM accelerates adaptive security appliance deployment with intelligent wizards, robust administration tools, and versatile monitoring services that complement the advanced integrated security and networking features offered by the adaptive security appliance. Its secure, web-based design enables anytime, anywhere access to adaptive security appliances.
The ASA 5585-X SSP-10 provides firewall and VPN support, and 10 interfaces (two SFP/SFP+ and eight copper Gigabit Ethernet). The SSP-10 has one power supply module and one fan module. You can replace the fan module with another power supply module for a redundant power supply configuration. The SSP-10 has one CPU, three DIMM modules, one embedded crypto-accelerator, and one dual-port 10-GB uplink for the SFP/SFP+ interfaces.
The ASA 5585-X SSP-20 provides firewall and VPN support, and 10 interfaces (two SFP/SFP+ and eight copper Gigabit Ethernet). The SSP-20 has one power supply module and one fan module. You can replace the fan module with another power supply module for a redundant power supply configuration. The SSP-20 has one CPU, six DIMM modules, two embedded crypto-accelerators, and one dual-port 10-GB uplink for the SFP/SFP+ interfaces.
The ASA 5585-X SSP-40 provides firewall and VPN support, and 10 interfaces (four SFP/SFP+ and six copper Gigabit Ethernet). The SSP-40 has one power supply module and one fan module. You can replace the fan module with another power supply module for a redundant power supply configuration. The SSP-40 has two CPUs, six DIMM modules, three embedded crypto-accelerators, and two dual-port 10-GB uplinks for the SFP/SFP+ interfaces.
The ASA 5585-X SSP-60 provides firewall and VPN support, and 10 interfaces (four SFP/SFP+ and six copper Gigabit Ethernet). The SSP-60 ships with two power supply modules; however, the SSP-60 can function with only one power supply module. Although the SSP-60 with an additional SSP can also operate with only one power supply module, we recommend that you install two power supply modules for extended reliability since the power supply modules operate in load-sharing mode. If one fails in this configuration, the other power supply module can still handle the full load until the failed power supply module is replaced. The SSP-60 has two CPUs, 12 DIMM modules, four embedded crypto-accelerators, and two dual-port 10-GB uplinks for the SFP/SFP+ interfaces.
If you remove a power supply or fan module, replace it immediately to prevent disruption of service.
You optionally can install an additional core SSP, an IPS SSP, a CX SSP, or a FirePOWER SSP in the upper slot (slot 1). For a matrix describing which module configurations are allowed, see the ASA Module Compatibility table.
Note Feature limitations may apply to dual SSPs. Refer to your configuration guide for more information.
Chassis Features
This section describes the ASA 5585-X chassis features and indicators.
Grounding Lug
Figure 1-1 shows the grounding lug on the rear of the chassis.
Figure 1-1 ASA 5585-X Chassis, Rear View
|
|
|
Figure 1-2 shows the front view of the ASA 5585-X SSP-10 with an IPS SSP-10 in the top slot. The appearance with one of the other available SSP-10 and SSP-20 modules in the top slot is very similar. All port numbers are numbered from right to left beginning with 0.
Front Panel: ASA 5585-X SSP-10 With Add-on SSP-10
Figure 1-2 ASA 5585-X SSP-10 With IPS SSP-10, Front Panel View
|
|
|
||
|
|
|
Reserved hard-disk drive bays in bottom slot; add-on module hard-disk drives in top slot1 |
|
|
|
TenGigabitEthernet 0/9 (core SSP in slot 0) |
TenGigabitEthernet 0/8 (core SSP in slot 0) |
|
|
|
GigabitEthernet 0/0 through 0/7(core SSP in slot 0) |
Management 0/1 (core SSP in slot 0) |
|
|
|
Management 0/0 (SSP in slot 0) |
||
|
|
|||
|
|
Auxiliary port (RJ45)2 |
||
|
|
Eject3 |
Front Panel: ASA 5585-X SSP-40 With Add-on SSP-40
Figure 1-3 shows the front view of ASA 5585-X SSP-40 with an IPS SSP-40 in the top slot. The appearance with one of the other available SSP-40 and SSP-60 modules in the top slot is very similar.
Figure 1-3 ASA 5585-X SSP-40 With IPS SSP-40, Front Panel View
|
|
|||
|
|
Reserved bays for hard-disk drives4 |
||
|
|
TenGigabitEthernet 0/9 (core SSP in slot 0) |
TenGigabitEthernet 0/8 (core SSP in slot 0) |
|
|
|
TenGigabitEthernet 0/7 (core SSP in slot 0) |
TenGigabitEthernet 0/6 (core SSP in slot 0) |
|
|
|
GigabitEthernet 0/0 through 0/5 (core SSP in slot 0) |
Management 0/1 (core SSP in slot 0) |
|
|
|
Management 0/0 (core SSP in slot 0) |
||
|
|
|||
|
|
Auxiliary port (RJ45)5 |
||
|
|
Eject6 |
Front Panel: Ethernet Port Indicator Lights
Table 1-1 describes the Ethernet port indicator lights.
|
|
|
|---|---|
10-Gigabit Ethernet Fiber (SFP+)/1-Gigabit Ethernet Fiber (SFP) |
– – – – |
|
7.Rate of flashing is proportional to the percentage of number of packets or bytes received. |
Front Panel Indicator Lights
Figure 1-4 shows the front panel indicator lights.
Figure 1-4 ASA 5585-X Front Panel Lights
Table 1-2 describes the front panel indicator lights on the ASA 5585-X.
|
|
|
|
|---|---|---|
|
|
||
|
|
||
|
|
Major failure of hardware component or software module, temperature over the limit, power out of tolerance, or time to remove the module.8 |
|
|
|
||
|
|
||
|
|
||
|
|
||
|
|
Indicates activity on the first hard-disk drive:9 |
|
|
|
|
9.The hard-disk drives are only supported on the ASA CX and FirePOWER SSPs. |
Back Panel: ASA 5585-X
Figure 1-5 shows the back panel features.
Figure 1-5 ASA 5585-X Back Panel Features
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
Back Panel: Power Supply and Fan Modules
Figure 1-6 shows the power supply module indicator lights.
Figure 1-6 ASA 5585-X Power Supply Module and Fan Module Indicator Lights
Table 1-3 describes the power supply module and fan module indicator lights.
|
|
|
|
|---|---|---|
|
|
||
|
|
||
|
|
|
|
10.The power supply module has three output voltages—3.3V, 12V, and 50V. |
Specifications
Table 1-4 lists the specifications for the ASA 5585-X.
Memory Configurations
The ASA 5585-X has up to six DIMM modules per CPU; DIMM population is platform-dependent. Table 1-5 shows the memory configurations.
|
|
|
|
|---|---|---|
Note The add-on core SSP, IPS SSP, CX SSP, or FirePOWER SSP must be of the same designation level as the originally installed SSP model. For example, if you have the ASA 5585-X SSP-10, you can only install another core SSP-10, an IPS SSP-10, a CX SSP-10, or a FirePOWER SSP-10.
Power Supply Module Requirements
Table 1-6 lists the power supply module requirements for the AC and DC power supply modules.
SFP/SFP+ Modules
The SFP/SFP+ module is a hot-swappable optical interface that plugs into the SFP/SFP+ ports and provides Gigabit Ethernet connectivity. The SFP and SFP+ modules are optional and not included with the ASA 5585-X; you can purchase them separately. For 1-Gb connectivity, you need the SFP; for 10-Gb connectivity, you need the SFP+. The two ports are the same, but you can only use 10-Gb with lower-model SSPs if you buy the appropriate license; otherwise, the ports are restricted to 1-Gb. The ports are always 10-Gb-enabled for higher-model SSPs (level 40 and above). The interfaces are called TenGigabitEthernet 0/ x for the core SSP, and TenGigabitEthernet 1/ x for the add-on SSP, whether they are 10-Gb-enabled or not.
Table 1-7 lists the SFP/SFP+ modules that the ASA 5585-X supports.
|
|
|
|---|---|
|
|
|
Feedback