Cisco ASA 5506-X

Cisco · firewall, 8 ports 1 Gb/s, fanless desktop chassis · Cisco ASA 5506-X

what it is

A firewall from the Cisco ASA 5500-X family in a desktop chassis, passively cooled — no fan. According to the Cisco installation guide (Hardware Installation Guide 5506-X) there are no connectors or LEDs on the front: all ports are on the rear panel, and the Power, Status, Active (and the wLAN LED, unused in this model) LEDs sit on the top edge next to the rear panel.

On the rear, from the left: the external power supply jack (12 V), eight 10/100/1000 ports (in the system GigabitEthernet1/1–1/8), the management port (Management1/1), below it the RJ-45 console, next to it the mini-USB console, a USB-A port, the Reset button and the Kensington lock slot.

The unit we checked (show inventory, show version): Atom C2000 processor, 4 cores at 1.25 GHz, 4 GB RAM, 8 GB flash memory and an SSD in an internal slot (Micron M600 according to the SNMP reading; the Cisco data sheet lists 50 GB mSATA — the firewall itself does not show the capacity). Temperatures in operation, without load: processor 47 °C, accelerator 39 °C, chassis 47 °C; all fifteen voltages from show environment within limits.

console

The mini-USB console appears on the computer as a serial port and runs at 9600 b/s, 8N1. The factory configuration lets you into privileged mode without a password.

a reset does not clear everything

Restoring the factory configuration (with the button or with configure factory-default and write memory) leaves two things on the device that are worth checking on a second-hand unit:

• RSA key pairs generated by the previous owner — show crypto key mypubkey rsa shows them with their names, and crypto key zeroize rsa label NAZWA removes them;
• the FirePOWER software module (sfr) with its own administrator account and its own management address — it has a separate logical disk and a firewall reset does not touch it.

A module that is not in use is removed with sw-module module sfr shutdown, and after it goes to the Down state, sw-module module sfr uninstall. On the unit we checked this freed approx. 3.2 GB on disk0:, and show module then shows "No Image Present". The uninstall command is accepted only once the module is already stopped.

license

The license is an activation key tied to the serial number from show activation-key, which differs from the number on the label on the chassis — write it down before any reset. The Base license on the unit we checked: 5 VLANs, no operation in a failover pair (failover disabled), 3DES/AES encryption enabled, AnyConnect Premium for 2 users.

firmware

According to the Cisco upgrade guide (ASA Upgrade Guide — Planning) version 9.16 is the last one for the 5506-X (the same for the 5508-X and 5516-X). From version 9.5 you can go to 9.16 without an intermediate version. 9.16 releases from 9.16(3.19) onward require ASDM version 7.18(1.152) or later. The system image has the form asa…-lfbff-k8.SPA — the asa…-k8.bin images of the older 5510/5520 models do not fit it.

what we read from it

Over SNMPv3 with authentication and encryption (SHA, AES-128), from the management port:

• processor load and memory usage;
• status and traffic of each interface on 64-bit counters, including broadcast and multicast packets;
• component inventory (ENTITY-MIB) with the serial numbers of the chassis and the SSD;
• system name and release, and uptime.

what a full SNMP scan showed

A one-time scan of the whole tree (version 9.5(2), approx. 1800 objects) showed more than the above: three temperature sensors with thresholds (processor, accelerator, chassis), the current and peak connection counts, failover pair status, buffer blocks, VPN sessions (remote access and IPsec) and the address translation table (NAT-MIB).

what to watch out for

• The SNMP agent in 9.5(2) loops the walk. In the vacmSecurityToGroup table a GETNEXT request returns the same identifier over and over. A tool that does not check whether the identifier increases never finishes the tree walk.
• The community name sits in the identifiers. The SNMP access and target tables (VACM, SNMP-TARGET) are indexed by the community name written as character codes — a saved raw tree walk reveals it, even though it does not appear in any value.
• Only a configured host can poll. Each receiver must have its own snmp-server host … poll entry; without it the firewall does not respond at all.

what we cannot read

• Supply voltages — show environment shows fifteen channels, over SNMP there are none.
• The environment branches known from Catalyst (CISCO-ENVMON-MIB, CISCO-ENTITY-SENSOR-MIB sensors) and the host resources table (HOST-RESOURCES-MIB) — in this model they are empty.

full parameter list

A full parameter list for this model is not here yet — the ones described above are those we have read and verified. A missing list does not mean the device exposes nothing more.