Cisco ASA might fail due to a damaged resistor

[bitwelder]

Excerpt from the Cisco field notice:
https://www.cisco.com/c/en/us/support/docs/field-notices/704/fn70476.html

"Due to a manufacturing process issue, some ASA5508 and ASA5516 security appliances might have a damaged resistor component."

"Security appliances with a damaged resistor will function normally on installation and product failures are expected to increase over time beginning after the unit has been in operation for approximately 18 months. Once the security appliance has failed the unit will no longer function, will not boot, and is not recoverable."

"Cisco recommends proactive replacement for affected ASA5508 and ASA5516 security appliances. There is no workaround for this issue."


Oops!

[Ranayna]

Yeah, I read about that yesterday.
Again a very expensive replacement issue for Cisco. And this time they can't even blame Intel...

I wonder if anyone has any details about the exact component that fails. Considering that Cisco claims that in some countries a replacement might take up to three months, even under service, the ability to repair the issue on a component level might be very much appreciated.

[Halcyon]

There is no workaround for this issue.

Wait, so the resistor can't be replaced?! Seems like a trivial job.

I'm guessing there will be a fire sale on ebay in the coming weeks.

[AndyC_772]

I suspect that any "workaround" is defined as one which can be applied by an IT support technician who has no authority to open the case of the equipment, and more than likely, no board level repair skills anyway.

[bitwelder]

The Cisco note talks about a failure that would happen only 18 month (or later).
What kind of issue could that be, related to a poor resistor?  Degradation due to prolonged heating? Failure of the soldering joints?

[Ranayna]

Likely something in a local voltage regulator circuit. LED status is used as fault indicator in the field notice, so no total power loss. No console output at all likely means no power to the CPU.

I do not think that the actual powersupply itself is affected, I would think that would be said in the field notice. Also that would be an easy fix, assuming a separated power supply module. I never encountered a cisco ASA, but those separated modules are common in networking gear.

[tom66]

Two possibilities I can think of:
- Underrated resistor in power supply that fails due to over-dissipation after some time.  May be a 1-in-100 failure rate due to an unauthorised component substitution made by the manufacturer of the PSU. Common one is the current sense resistor in the primary of a switching converter. Another one I've seen is the diode-resistor-capacitor of a flyback circuit failing, usually the resistor goes open circuit, which means the snubber fails and the MOSFET pops shortly afterwards.

- Sulfur contamination or mounting failure leading to a large-package resistor failing due to thermal expansion, either in the resistor itself or because it's mounted close to another hot device.

The latter has bitten us before and unfortunately you only tend to find out about it once you've had units in the field for months.  With large package SMD resistors (1812 or above) it's wise to be aware of any board flex which might cause resistor failure. Try to mount them only on thoroughly rigid parts of the board  and away from flexing parts (e.g. with a button nearby).  But also conversely be aware of mounting points on the board as assemblers can over-torque those screws and stress can be applied to the PCB there.  I don't know if newer resistors or certain manufacturers/variants are more resilient to this or not.

[amyk]

Third possibility: a pullup resistor that was far too low, causing gradual damage to a pin driver.

These units look like they're several k$ new, so before someone identifies the fix, there might be quite a few dead ones on the used market...

[NiHaoMike]

Are those the ones with the infamous Atom CPU that breaks down in about 18 months?

[Halcyon]

Sounds like Cisco should be stepping up and doing a recall on those. It's unreasonable for a router of that type and price to only last 2 years. They certainly wouldn't get away with it under the "Reasonably durable" clause under Australian Consumer Law.

[amyk]

Are those the ones with the infamous Atom CPU that breaks down in about 18 months?

No, that was a NAS.

[rdl]

That was a bug that caused an on chip clock to stop working. It affected the Atom C2000 (Avoton and Rangeley) devices. I think it was cleared up some time ago.

Are those the ones with the infamous Atom CPU that breaks down in about 18 months?

[Monkeh]

Are those the ones with the infamous Atom CPU that breaks down in about 18 months?

No, that was a NAS.

No, that was every single product with an Atom C2000 prior to the discovery of the flaw. Which included a lot of Cisco equipment.

It's vaguely possible this is a case of a failed workaround for that fault.

[bitwelder]

Actually yes, both ASA 5508 and 5516 were listed in the Cisco FN for that CPU clock bug.
https://www.cisco.com/c/en/us/support/docs/field-notices/642/fn64228.html

Also in that case it was "Might Fail After 18 Months or Longer"