Cisco Firepower 4110 User manual

Installation, Maintenance, and Upgrade
•Install, Remove, and Replace the Network Module, on page 1
•Remove and Replace the Fan Module, on page 4
•Remove and Replace the SSD, on page 6
•Remove and Replace the Power Supply Module, on page 9
•Connect the DC Power Supply Module, on page 13
•Secure the Power Cord on the AC Power Supply Module, on page 19
•Install the FIPS Opacity Shield, on page 22
Install, Remove, and Replace the Network Module
Hot Swapping
Starting with FXOS 2.3.1, the Firepower 10-Gb and 40-Gb network modules (without hardware bypass
support) support hot swapping, but you must hot swap with an identical network module, that is, a network
module with the same PID. See Product ID Numbers for the network module PIDs. You must bring the
network module offline using the appropriate CLI commands before removing the network module from
the chassis so that all network module configuration is saved. See the “Taking a Network Module Offline
or Online” topic in the Security Module/Engine Management chapter in the Cisco FXOS Firepower
Chassis Manager Configuration Guide.
We do not recommend that you remove the network module without bringing it properly offline using
the appropriate CLI commands.
Caution
You must have ROMMON 1.0.10 or later on the Supervisor to support hot swapping. For the ROMMON
upgrade procedure, see the "Firmware Upgrade" topic in the Image Management chapter in the Cisco
FXOS Firepower Chassis Manager Configuration Guide for your software version.
Note
To remove and replace the network modules that do not currently support hot swapping, power off the
chassis, replace the network module, and then power the chassis back on.
Acknowledgment is necessary if you decommission and physically remove a network module and do
not replace it, or if you replace it with another PID. See the "Acknowledging a Security Module/Engine”
Installation, Maintenance, and Upgrade
1

topic in the Security Module/Engine Management chapter in the Cisco FXOS Firepower Chassis Manager
Configuration Guide.
Safety Warnings
Take note of the following component replacement safety warnings:
Statement 1028—More Than One Power Supply
This unit might have more than one power supply connection. To reduce risk of electric shock, remove
all connections to de-energize the unit.
Warning
Statement 1030—Equipment Installation
Only trained and qualified personnel should be allowed to install, replace, or service this equipment.
Warning
Statement 1073—No User-Serviceable Parts
There are no serviceable parts inside. To avoid risk of electric shock, do not open.
Warning
Statement 1089—Instructed and Skilled Person Definitions
An instructed person is someone who has been instructed and trained by a skilled person and takes the
necessary precautions when working with equipment.
A skilled person or qualified personnel is someone who has training or experience in the equipment
technology and understands potential hazards when working with equipment.
Warning
Statement 1090—Installation by Skilled Person
Only a skilled person should be allowed to install, replace, or service this equipment. See statement 1089
for the definition of a skilled person.
Warning
Statement 1091—Installation by an Instructed Person
Only an instructed person or skilled person should be allowed to install, replace, or service this equipment.
See statement 1089 for the definition of an instructed or skilled person.
Warning
Installation, Maintenance, and Upgrade
2
Installation, Maintenance, and Upgrade
Install, Remove, and Replace the Network Module

This procedure describes how to install a network module into an empty slot that has never contained a network
module, and how to remove an installed network module and replace it with another network module.
Step 1 To install a new network module for the first time into an empty slot, do the following:
a) Power down the chassis by moving the power switch to the OFF position.
See Rear Panel for more information about the power switch.
b) Follow Steps 4 through 7 to install the new network module.
c) Power on the chassis by moving the power switch to the ON position.
The state for the new network module is OIR Failed.
d) To change the status of the network module to Online, reboot the chassis. See the "Rebooting the Firepower 4100/9300
Chassis" topic in the System Administration chapter in the FXOS Configuration Guide for your software version.
Step 2 To remove and replace an existing network module, do one of the following:
a) Save your configuration.
b) Power down the chassis by moving the power switch to the OFF position (if removing a network module that does
not support hot swapping).
See Rear Panel for more information about the power switch.
c) Bring the network module offline using the appropriate CLI command (if removing a network module that supports
hot swapping). All network module configuration is saved. See the “Taking a Network Module Offline or Online”
topic in the Security Module/Engine Management chapter in the FXOS Configuration Guide for your software version.
d) Continue with Step 3.
Step 3 To remove a network module from the chassis, loosen the captive screw on the lower left side of the network module
and pull out the handle that is connected to the screw. This mechanically ejects the network module from the slot.
Figure 1: Remove the Network Module
Installation, Maintenance, and Upgrade
3
Installation, Maintenance, and Upgrade
Install, Remove, and Replace the Network Module

If the slot is to remain empty, install a blank faceplate to ensure proper airflow and to keep dust out of the chassis;
otherwise, install another network module.
Step 4 To replace a network module, hold the network module in front of the network module slot on the right of the chassis
and pull the network module handle out.
Step 5 Slide the network module into the slot and push it firmly into place until the handle is flush with the front of the network
module.
Step 6 Tighten the captive screw on the lower left side of the network module.
Step 7 Do one of the following:
a) Power up the chassis so that the new network module is recognized (if the new network module does not support hot
swapping).
b) Bring the new network module online using the appropriate CLI command (if the new network module supports hot
swapping). The saved network module configuration is automatically reapplied when the network module is back
online.
If you install a network module that is a different PID than the original network module, the saved
configuration is deleted and the default configuration is applied. You must enter the acknowledge command
to confirm the network module PID change:
Note
What to do next
Follow the procedures in the FXOS Configuration Guide to connect to the network module and make sure
that it has been discovered correctly by the Firepower 4100.
Remove and Replace the Fan Module
You can remove and replace fan modules while the system is running. The air flow moves from front to back.
If you remove a fan or a fan fails, the other fans operate at full speed, which can be noisy.
The system supports operation with a single fan failure (N+1 fan redundancy), but do not run the system for
an extended amount of time without all fan modules installed. Keep removal and replacement time at three
minutes. Remove and replace one fan module at a time.
Note
Safety Warnings
Take note of the following component replacement safety warnings:
Installation, Maintenance, and Upgrade
4
Installation, Maintenance, and Upgrade
Remove and Replace the Fan Module

Statement 1028—More Than One Power Supply
This unit might have more than one power supply connection. To reduce risk of electric shock, remove
all connections to de-energize the unit.
Warning
Statement 1030—Equipment Installation
Only trained and qualified personnel should be allowed to install, replace, or service this equipment.
Warning
Statement 1073—No User-Serviceable Parts
There are no serviceable parts inside. To avoid risk of electric shock, do not open.
Warning
Statement 1089—Instructed and Skilled Person Definitions
An instructed person is someone who has been instructed and trained by a skilled person and takes the
necessary precautions when working with equipment.
A skilled person or qualified personnel is someone who has training or experience in the equipment
technology and understands potential hazards when working with equipment.
Warning
Statement 1090—Installation by Skilled Person
Only a skilled person should be allowed to install, replace, or service this equipment. See statement 1089
for the definition of a skilled person.
Warning
Statement 1091—Installation by an Instructed Person
Only an instructed person or skilled person should be allowed to install, replace, or service this equipment.
See statement 1089 for the definition of an instructed or skilled person.
Warning
Step 1 To remove a fan module, face the rear of the chassis, and grasp the handle of the fan module.
Step 2 Squeeze the handle to disengage the latches on the left and right of the fan module.
Step 3 Pull the fan module out of the chassis.
Installation, Maintenance, and Upgrade
5
Installation, Maintenance, and Upgrade
Remove and Replace the Fan Module

Figure 2: Remove the Fan Module
Step 4 To replace a fan module, hold the fan module in front of the fan slot.
Step 5 Push the fan module into the chassis until it is properly seated and the latches snap into place.
If the system is powered on, listen for the fans. You should immediately hear the fans operating. If you do not hear the
fans, make sure the fan module is inserted completely into the chassis and the faceplate is flush with the outside surface
of the chassis.
Step 6 Verify that the fan is operational by checking the fan module LED. See Front Panel LEDs for a description of the fan
LEDs.
Remove and Replace the SSD
Although the hardware supports removing and replacing SSDs while the system is running, the software does
not currently support hot swapping. You must power down the chassis to remove and replace SSDs.
If your Firepower 4100 is running Firepower Threat Defense software, we recommend that you upgrade to
the latest version to take advantage of software updates that enhance SSD management performance and
longevity.
Note
You storage SSD must be installed in slot 1 and must be present. Only an optional MSP can be installed in
the second SSD slot (SSD slot 2). The MSP stores threat detection results for use in future analysis. It supports
Installation, Maintenance, and Upgrade
6
Installation, Maintenance, and Upgrade
Remove and Replace the SSD

the Advanced Malware Protection software feature. The MSP is supported beginning in FXOS 2.0.1. It is
used as both storage and as the Malware application repository. RAID is not supported.
Do not switch the two SSDs. The storage SSD must be installed in slot 1. The optional MSP SSD must be
installed in slot 2. If you remove it and install it in slot 1, all stored file capture data is lost.
Caution
Safety Warnings
Take note of the following component replacement safety warnings:
Statement 1028—More Than One Power Supply
This unit might have more than one power supply connection. To reduce risk of electric shock, remove
all connections to de-energize the unit.
Warning
Statement 1030—Equipment Installation
Only trained and qualified personnel should be allowed to install, replace, or service this equipment.
Warning
Statement 1073—No User-Serviceable Parts
There are no serviceable parts inside. To avoid risk of electric shock, do not open.
Warning
Statement 1089—Instructed and Skilled Person Definitions
An instructed person is someone who has been instructed and trained by a skilled person and takes the
necessary precautions when working with equipment.
A skilled person or qualified personnel is someone who has training or experience in the equipment
technology and understands potential hazards when working with equipment.
Warning
Statement 1090—Installation by Skilled Person
Only a skilled person should be allowed to install, replace, or service this equipment. See statement 1089
for the definition of a skilled person.
Warning
Installation, Maintenance, and Upgrade
7
Installation, Maintenance, and Upgrade
Remove and Replace the SSD

Statement 1091—Installation by an Instructed Person
Only an instructed person or skilled person should be allowed to install, replace, or service this equipment.
See statement 1089 for the definition of an instructed or skilled person.
Warning
Step 1 Save your configuration.
Step 2 Power down the chassis by moving the power switch to the OFF position. See Features for more information about the
power switch.
Step 3 To remove an SSD, face the front of the chassis, loosen the two captive screws on the SSD, and gently pull it out of slot
1 of the chassis.
Figure 3: Remove the SSD
Step 4 To replace the SSD, make sure the power switch is still in the OFF position, and then hold the SSD in front of slot 1 and
push it in gently until it is seated.
Step 5 To install the MSP SSD, make sure the power switch is still in the OFF position and then remove the blank faceplate in
slot 2 by loosening the captive screws on either side of the faceplate.
Step 6 Hold the MSP SSD in front of slot 2 and push it in gently until it is seated.
Do not switch the two SSDs. Only the optional MSP SSD can be installed in slot 2. If you remove it and install
it in slot 1, all stored file capture data is lost.
Caution
Step 7 Tighten the captive screws on either side of the SSD.
Step 8 Verify that the SSD is operational by checking the SSD LED. See Front Panel LEDs for a description of the fan LEDs.
Installation, Maintenance, and Upgrade
8
Installation, Maintenance, and Upgrade
Remove and Replace the SSD

Remove and Replace the Power Supply Module
You can remove and replace power supply modules while the system is running.
Safety Warnings
Take note of the following power and component removal safety warnings:
Statement 347—Failure to Secure the Expansion Module
To reduce the risk of electric shock, secure the modules with the provided screws.
Warning
Statement 1003—DC Power Disconnection
Before performing any of the following procedures, ensure that power is removed from the DC circuit.
Warning
Statement 1005—Circuit Breaker
This product relies on the building’s installation for short-circuit (overcurrent) protection. To reduce risk
of electric shock or fire, ensure that the protective device is rated not greater than:
AC: 20A
DC: 40A
Warning
Statement 1017—Restricted Area
This unit is intended for installation in restricted access areas. Only skilled, instructed, or qualified
personnel can access a restricted access area.
Warning
Statement 1018—Supply Circuit
To reduce risk of electric shock and fire, take care when connecting units to the supply circuit so that
wiring is not overloaded.
Warning
Statement 1022—Disconnect Device
To reduce risk of electric shock and fire, you must incorporate a readily accessible two-poled disconnect
device in the fixed wiring.
Warning
Installation, Maintenance, and Upgrade
9
Installation, Maintenance, and Upgrade
Remove and Replace the Power Supply Module

Statement 1025—Use Copper Conductors Only
To reduce risk of fire, use copper conductors only.
Warning
Statement 1028—More Than One Power Supply
This unit might have more than one power supply connection. To reduce risk of electric shock, remove
all connections to de-energize the unit.
Warning
Statement 1029—Blank Faceplates and Cover Panels
Blank faceplates and cover panels serve three important functions: they reduce the risk of electric shock
and fire, they contain electromagnetic interference (EMI) that might disrupt other equipment, and they
direct the flow of cooling air through the chassis. Do not operate the system unless all cards, faceplates,
front covers, and rear covers are in place.
Warning
Statement 1030—Equipment Installation
Only trained and qualified personnel should be allowed to install, replace, or service this equipment.
Warning
Statement 1073—No User-Serviceable Parts
There are no serviceable parts inside. To avoid risk of electric shock, do not open.
Warning
Statement 1046—Installing or Replacing the Unit
To reduce risk of electric shock, when installing or replacing the unit, the ground connection must always
be made first and disconnected last.
Warning
Installation, Maintenance, and Upgrade
10
Installation, Maintenance, and Upgrade
Remove and Replace the Power Supply Module

Statement 1089—Instructed and Skilled Person Definitions
An instructed person is someone who has been instructed and trained by a skilled person and takes the
necessary precautions when working with equipment.
A skilled person or qualified personnel is someone who has training or experience in the equipment
technology and understands potential hazards when working with equipment.
Warning
Statement 1090—Installation by Skilled Person
Only a skilled person should be allowed to install, replace, or service this equipment. See statement 1089
for the definition of a skilled person.
Warning
Statement 1091—Installation by an Instructed Person
Only an instructed person or skilled person should be allowed to install, replace, or service this equipment.
See statement 1089 for the definition of an instructed or skilled person.
Warning
Step 1 To remove a power supply module, face the back of the chassis and grasp the handle.
Step 2 Press the latch found on the lower right of the power supply to disengage the power supply.
Step 3 Place your other hand under the power supply module to support it while you slide it out of the chassis.
Installation, Maintenance, and Upgrade
11
Installation, Maintenance, and Upgrade
Remove and Replace the Power Supply Module

Figure 4: Remove the Power Supply Module
If the slot is to remain empty, install a blank faceplate to ensure proper airflow and to keep dust out of the chassis;
otherwise, install another power supply module.
Step 4 To replace a power supply module, hold the power supply module with both hands and slide it into the power supply
module bay.
Step 5 Push in the power supply module gently until you hear the latch engage and it is seated. Verify the power supply module
is operating correctly by checking the power supply module LED. See Power Supply Modules for a description of the
power supply module LEDs.
Installation, Maintenance, and Upgrade
12
Installation, Maintenance, and Upgrade
Remove and Replace the Power Supply Module

Connect the DC Power Supply Module
This procedure describes how to install the DC power supply input power leads to the Firepower 4100 DC
input power supply on the rear PDU of the chassis.
Before You Begin
• The color coding of the DC input power supply leads depends on the color coding of the DC power
source at your site. Make sure that the lead color coding you choose for the DC input power supply
matches the lead color coding used at the DC power source and verify that the power source is
connected to the negative (–) terminal and to the positive (+) terminal on the power supply.
• For DC input power cables, the wire gauge is based on the National Electrical Code (NEC) and
local codes for 26 amp service at nominal DC input voltage (–40/–72 VDC). One pair of cable leads,
source DC (–) and source DC return (+), are required for each power distribution unit (PDU). These
cables are available from any commercial cable vendor. All DC input power cables for the chassis
should be 10 gauge wire and cable lengths should match within 10 percent of deviation.
• Tools needed:
• Phillips head screwdriver
• 10-mm wrench or socket
• Connectors and wire for the DC circuit or circuits
Each DC input power cable is terminated at the PDU by a cable lug, as shown in the following figure.
DC input power cables must be connected to the PDU terminal studs in the proper positive (+) and
negative (–) polarity. In some cases, the DC cable leads are labeled, which is a relatively safe indication
of the polarity. However, you must verify the polarity by measuring the voltage between the DC cable
leads. When making the measurement, the positive (+) lead and the negative (–) lead must always match
the (+) and (–) labels on the power distribution unit.
Note
Figure 5: DC Input Power Cable Lug
To avoid hazardous conditions, all components in the area where DC input power is accessible must be
properly insulated. Therefore, before installing the DC cable lugs, be sure to insulate the lugs according
to the manufacturer's instructions
Note
Installation, Maintenance, and Upgrade
13
Installation, Maintenance, and Upgrade
Connect the DC Power Supply Module

Safety Warnings
Take note of the following power and component removal safety warnings:
Statement 347—Failure to Secure the Expansion Module
To reduce the risk of electric shock, secure the modules with the provided screws.
Warning
Statement 1003—DC Power Disconnection
Before performing any of the following procedures, ensure that power is removed from the DC circuit.
Warning
Statement 1005—Circuit Breaker
This product relies on the building’s installation for short-circuit (overcurrent) protection. To reduce risk
of electric shock or fire, ensure that the protective device is rated not greater than:
AC: 20A
DC: 40A
Warning
Statement 1017—Restricted Area
This unit is intended for installation in restricted access areas. Only skilled, instructed, or qualified
personnel can access a restricted access area.
Warning
Statement 1018—Supply Circuit
To reduce risk of electric shock and fire, take care when connecting units to the supply circuit so that
wiring is not overloaded.
Warning
Statement 1022—Disconnect Device
To reduce risk of electric shock and fire, you must incorporate a readily accessible two-poled disconnect
device in the fixed wiring.
Warning
Statement 1025—Use Copper Conductors Only
To reduce risk of fire, use copper conductors only.
Warning
Installation, Maintenance, and Upgrade
14
Installation, Maintenance, and Upgrade
Connect the DC Power Supply Module

Statement 1028—More Than One Power Supply
This unit might have more than one power supply connection. To reduce risk of electric shock, remove
all connections to de-energize the unit.
Warning
Statement 1029—Blank Faceplates and Cover Panels
Blank faceplates and cover panels serve three important functions: they reduce the risk of electric shock
and fire, they contain electromagnetic interference (EMI) that might disrupt other equipment, and they
direct the flow of cooling air through the chassis. Do not operate the system unless all cards, faceplates,
front covers, and rear covers are in place.
Warning
Statement 1030—Equipment Installation
Only trained and qualified personnel should be allowed to install, replace, or service this equipment.
Warning
Statement 1073—No User-Serviceable Parts
There are no serviceable parts inside. To avoid risk of electric shock, do not open.
Warning
Statement 1046—Installing or Replacing the Unit
To reduce risk of electric shock, when installing or replacing the unit, the ground connection must always
be made first and disconnected last.
Warning
Statement 1089—Instructed and Skilled Person Definitions
An instructed person is someone who has been instructed and trained by a skilled person and takes the
necessary precautions when working with equipment.
A skilled person or qualified personnel is someone who has training or experience in the equipment
technology and understands potential hazards when working with equipment.
Warning
Installation, Maintenance, and Upgrade
15
Installation, Maintenance, and Upgrade
Connect the DC Power Supply Module

Statement 1090—Installation by Skilled Person
Only a skilled person should be allowed to install, replace, or service this equipment. See statement 1089
for the definition of a skilled person.
Warning
Statement 1091—Installation by an Instructed Person
Only an instructed person or skilled person should be allowed to install, replace, or service this equipment.
See statement 1089 for the definition of an instructed or skilled person.
Warning
Step 1 Install the DC power supply module in the chassis and make note of the bay number so you can connect the wiring to
the correct terminals on the DC power supply module at the rear of the chassis. See Remove and Replace the Power
Supply Module, on page 9 for the procedure.
Step 2 Verify that the power is off to the DC circuit on the power supply module that you are installing.
Step 3 Make sure that all site power and grounding requirements have been met.
Step 4 To remove the plastic cover from the terminal block, insert a flat screw driver on the side of the plastic cover and pry
it off.
Figure 6: Remove the Plastic Cover
Step 5 To prevent any contact with metal lead on the ground wire and the plastic cover, you must wrap the positive and negative
lead cables with sleeving. Insulate the lug with shrink sleeving for each lead wire if using noninsulated crimp terminals.
Sleeving is not required for insulated terminals.
Step 6 Remove the two M5 screws.
Installation, Maintenance, and Upgrade
16
Installation, Maintenance, and Upgrade
Connect the DC Power Supply Module

Figure 7: Remove the M5 Screws
Step 7 For easier cable management, insert the negative lead cable first. Replace the grounding lug with the cable in the
following order—wire terminal, then the screw with the captive washer.
Figure 8: Insert the Cables
Step 8 Tighten the M5 screw with the captive washer to the recommended torque of 5 in-lbs for the positive stud and wire.
Secure the wires coming in from the terminal block so that they cannot be disturbed by casual contact.
Installation, Maintenance, and Upgrade
17
Installation, Maintenance, and Upgrade
Connect the DC Power Supply Module

Figure 9: Tighten the M5 Screws
Step 9 Replace the terminal block plastic cover. The plastic cover is slotted and keyed to fit correctly over the terminal block.
This cover should always be in place when power is applied to the terminals.
Figure 10: Replace the Plastic Cover
Installation, Maintenance, and Upgrade
18
Installation, Maintenance, and Upgrade
Connect the DC Power Supply Module

Step 10 Set the DC disconnect switch in the circuit to ON. In a system with multiple power supplies, connect each power supply
to a separate DC power source. In the event of a power source failure, if the second source is still available, it can
maintain system operation.
Step 11 Verify power supply operation by checking the power supply LED on the front of the chassis. See Front Panel LEDs
for a description of the LEDs.
Secure the Power Cord on the AC Power Supply Module
Tie Wrap and Clamp
To secure the power supply module against accidental removal and thus prevent disrupting system
performance, use the tie wrap and clamp provided in the accessories kit that ships with your Firepower
4100. There are two different tie wrap and clamp combinations to be used with either the Flextronics or
Artesyn power supply module.
To verify which power supply module you have, look at the vendor name on the top of the power supply
module. If you cannot remove the power supply module, you can count the number of full hexagonal
vent holes on the front of the power supply module in the row directly next to the word 'FAIL.' Flextronics
has five holes and Artesyn has four holes.
The black tie wrap is used with the Flextronics power supply module and the off-white tie wrap is used
with the Artesyn power supply module. The black clamp works with both. See the figures below.
Safety Warnings
Take note of the following component replacement safety warnings:
Statement 1028—More Than One Power Supply
This unit might have more than one power supply connection. To reduce risk of electric shock, remove
all connections to de-energize the unit.
Warning
Statement 1030—Equipment Installation
Only trained and qualified personnel should be allowed to install, replace, or service this equipment.
Warning
Statement 1073—No User-Serviceable Parts
There are no serviceable parts inside. To avoid risk of electric shock, do not open.
Warning
Installation, Maintenance, and Upgrade
19
Installation, Maintenance, and Upgrade
Secure the Power Cord on the AC Power Supply Module

Statement 1089—Instructed and Skilled Person Definitions
An instructed person is someone who has been instructed and trained by a skilled person and takes the
necessary precautions when working with equipment.
A skilled person or qualified personnel is someone who has training or experience in the equipment
technology and understands potential hazards when working with equipment.
Warning
Statement 1090—Installation by Skilled Person
Only a skilled person should be allowed to install, replace, or service this equipment. See statement 1089
for the definition of a skilled person.
Warning
Statement 1091—Installation by an Instructed Person
Only an instructed person or skilled person should be allowed to install, replace, or service this equipment.
See statement 1089 for the definition of an instructed or skilled person.
Warning
Step 1 Attach the clamp to the tie wrap by holding the clamp with the loop side on the bottom and sliding the tie wrap through
the box-shaped channel above the clamp (see the following figure).
One side of the tie wrap has evenly spaced ridges and the other is smooth. Be sure the ridged side is face up and that you
slide it through the open side of the channel. You will hear a click as the tie slides through—it moves in one direction
only. To remove the tie wrap from the clamp, push the lever on the closed side of the box-shaped channel and slide out
the tie wrap.
Figure 11: Tie Wrap Through the Box Channel of the Clamp
Box channel2Tie wrap1
Step 2 Attach the clamp to the power supply module:
Installation, Maintenance, and Upgrade
20
Installation, Maintenance, and Upgrade
Secure the Power Cord on the AC Power Supply Module