Cisco ASA might fail due to a damaged resistor - Page 1
Forum section: electronics / general

author: bitwelder
author_rank: Super Contributor
timestamp: April 29, 2020, 08:20:50 am
content: Excerpt from the Cisco field notice:https://www.cisco.com/c/en/us/support/docs/field-notices/704/fn70476.html"Due to a manufacturing process issue, some ASA5508 and ASA5516 security appliances might have a damaged resistor component.""Security appliances with a damaged resistor will function normally on installation and product failures are expected to increase over time beginning after the unit has been in operation for approximately 18 months. Once the security appliance has failed the unit will no longer function, will not boot, and is not recoverable.""Cisco recommends proactive replacement for affected ASA5508 and ASA5516 security appliances. There is no workaround for this issue."Oops!

author: Ranayna
author_rank: Super Contributor
timestamp: April 29, 2020, 08:45:54 am
content: Yeah, I read about that yesterday.Again a very expensive replacement issue for Cisco. And this time they can't even blame Intel...I wonder if anyone has any details about the exact component that fails. Considering that Cisco claims that in some countries a replacement might take up to three months, even under service, the ability to repair the issue on a component level might be very much appreciated.

author: Halcyon
author_rank: Unknown
timestamp: April 29, 2020, 09:38:29 am
content: Quote from: bitwelder on April 29, 2020, 08:20:50 amWait, so the resistor can't be replaced?! Seems like a trivial job.I'm guessing there will be a fire sale on ebay in the coming weeks.

author: AndyC_772
author_rank: Super Contributor
timestamp: April 29, 2020, 09:57:32 am
content: I suspect that any "workaround" is defined as one which can be applied by an IT support technician who has no authority to open the case of the equipment, and more than likely, no board level repair skills anyway.

author: bitwelder
author_rank: Super Contributor
timestamp: April 29, 2020, 10:50:24 am
content: The Cisco note talks about a failure that would happen only 18 month (or later).What kind of issue could that be, related to a poor resistor? Degradation due to prolonged heating? Failure of the soldering joints?

author: Ranayna
author_rank: Super Contributor
timestamp: April 29, 2020, 11:39:38 am
content: Likely something in a local voltage regulator circuit. LED status is used as fault indicator in the field notice, so no total power loss. No console output at all likely means no power to the CPU.I do not think that the actual powersupply itself is affected, I would think that would be said in the field notice. Also that would be an easy fix, assuming a separated power supply module. I never encountered a cisco ASA, but those separated modules are common in networking gear.

author: tom66
author_rank: Super Contributor
timestamp: April 29, 2020, 12:40:49 pm
content: Two possibilities I can think of:- Underrated resistor in power supply that fails due to over-dissipation after some time. May be a 1-in-100 failure rate due to an unauthorised component substitution made by the manufacturer of the PSU. Common one is the current sense resistor in the primary of a switching converter. Another one I've seen is the diode-resistor-capacitor of a flyback circuit failing, usually the resistor goes open circuit, which means the snubber fails and the MOSFET pops shortly afterwards.- Sulfur contamination or mounting failure leading to a large-package resistor failing due to thermal expansion, either in the resistor itself or because it's mounted close to another hot device.The latter has bitten us before and unfortunately you only tend to find out about it once you've had units in the field for months. With large package SMD resistors (1812 or above) it's wise to be aware of any board flex which might cause resistor failure. Try to mount them only on thoroughly rigid parts of the board and away from flexing parts (e.g. with a button nearby). But also conversely be aware of mounting points on the board as assemblers can over-torque those screws and stress can be applied to the PCB there. I don't know if newer resistors or certain manufacturers/variants are more resilient to this or not.

author: amyk
author_rank: Super Contributor
timestamp: April 30, 2020, 12:26:52 am
content: Third possibility: a pullup resistor that was far too low, causing gradual damage to a pin driver.These units look like they're several k$ new, so before someone identifies the fix, there might be quite a few dead ones on the used market...

author: NiHaoMike
author_rank: Super Contributor
timestamp: April 30, 2020, 12:46:01 am
content: Are those the ones with the infamous Atom CPU that breaks down in about 18 months?

author: Halcyon
author_rank: Unknown
timestamp: April 30, 2020, 02:36:55 am
content: Sounds like Cisco should be stepping up and doing a recall on those. It's unreasonable for a router of that type and price to only last 2 years. They certainly wouldn't get away with it under the "Reasonably durable" clause under Australian Consumer Law.

author: amyk
author_rank: Super Contributor
timestamp: April 30, 2020, 02:55:18 am
content: Quote from: NiHaoMike on April 30, 2020, 12:46:01 amNo, that wasa NAS.

author: rdl
author_rank: Super Contributor
timestamp: April 30, 2020, 03:31:20 am
content: That was a bug that caused an on chip clock to stop working. It affected the Atom C2000 (Avoton and Rangeley) devices. I think it was cleared up some time ago.Quote from: NiHaoMike on April 30, 2020, 12:46:01 am

author: Monkeh
author_rank: Super Contributor
timestamp: April 30, 2020, 04:11:20 am
content: Quote from: amyk on April 30, 2020, 02:55:18 amNo, that was every single product with an Atom C2000 prior to the discovery of the flaw. Which included a lot of Cisco equipment.It's vaguely possible this is a case of a failed workaround for that fault.

author: bitwelder
author_rank: Super Contributor
timestamp: April 30, 2020, 05:50:17 am
content: Actually yes, both ASA 5508 and 5516 were listed in the Cisco FN for that CPU clock bug.https://www.cisco.com/c/en/us/support/docs/field-notices/642/fn64228.htmlAlso in that case it was "Might Fail After 18 Months or Longer"