Cisco Firepower 4112 Manual

Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
First Published: 2019-06-20
Last Modified: 2019-09-30
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of
the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.
Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.
The documentation set for this product strives to use bias-free language. For purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on
age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that
is hardcoded in the user interfaces of the product software, language used based on standards documentation, or language that is used by a referenced third-party product.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL:
https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a
partnership relationship between Cisco and any other company. (1721R)
©2019-2023 Cisco Systems, Inc. All rights reserved.

CONTENTS
Overview 1
CHAPTER 1
Features 1
Deployment Options 5
Package Contents 5
Serial Number Location 6
Front Panel 8
Front Panel LEDs 9
Rear Panel 10
Network Modules 11
10-Gb Network Module 12
40-Gb Network Module 13
100-Gb Network Module 14
Hardware Bypass Network Modules 15
1-Gb Network Module with Hardware Bypass 16
40-Gb Network Module with Hardware Bypass 18
1-Gb SX/10-Gb SR/10-Gb LR Network Module with Hardware Bypass 19
Power Supply Modules 22
Fan Modules 24
Supported SFP/SFP+ and QSFP Transceivers 25
Hardware Specifications 28
Product ID Numbers 29
Power Cord Specifications 32
Installation Preparation 39
CHAPTER 2
Installation Warnings 39
Network Equipment-Building System (NEBS) Statements 42
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
iii

Safety Recommendations 44
Maintain Safety with Electricity 44
Prevent ESD Damage 44
Site Environment 45
Site Considerations 45
Power Supply Considerations 45
Rack Configuration Considerations 46
Rack-Mount and Ground the Chassis 47
CHAPTER 3
Unpack and Inspect the Chassis 47
Rack-Mount the Chassis 47
Ground the Chassis 52
Installation, Maintenance, and Upgrade 55
CHAPTER 4
Install, Remove, and Replace the Network Module 55
Remove and Replace the Fan Module 58
Remove and Replace the SSD 60
Remove and Replace the Power Supply Module 63
Connect the DC Power Supply Module 67
Secure the Power Cord on the AC Power Supply Module 73
Install the FIPS Opacity Shield 76
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
iv
Contents

CHAPTER 1
Overview
•Features, on page 1
•Deployment Options, on page 5
•Package Contents, on page 5
•Serial Number Location, on page 6
•Front Panel, on page 8
•Front Panel LEDs, on page 9
•Rear Panel, on page 10
•Network Modules, on page 11
•Hardware Bypass Network Modules, on page 15
•Power Supply Modules, on page 22
•Fan Modules, on page 24
•Supported SFP/SFP+ and QSFP Transceivers, on page 25
•Hardware Specifications, on page 28
•Product ID Numbers, on page 29
•Power Cord Specifications, on page 32
Features
The Cisco Firepower 4100 is a standalone modular security services platform. It is capable of running multiple
security services simultaneously and so is targeted at the data center as a multiservice platform. The series
includes the Firepower 4112, 4115, 4125, and 4145. See Product ID Numbers, on page 29 for a list of the
product IDs (PIDs) associated with the 4100 series.
The Firepower 4100 supports Cisco Secure Firewall Threat Defense, Cisco Secure Firewall eXtensible
Operating System (FXOS), and Cisco Secure Firewall ASA software. See Cisco Firepower 4100/9300 FXOS
Compatibility, which lists software and hardware compatibility information for the Firepower 4100 series.
The following figure shows the Firepower 4100.
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
1

Figure 1: Firepower 4100
The following table lists the features for the Firepower 4100.
Table 1: Firepower 4100 Features
4145412541154112Feature
1 RU
Fits a standard 19-inch (48.3cm) square-hole rack
Form factor
Slide rails, mount ears, and screws included (4-post EIA-310-D rack)Rack mount
Front to rear
Cold aisle to hot aisle
Airflow
Two 22-core
2.1-GHz Intel Xeon
6152
Two 16-core
2.1-GHz Intel Xeon
6130T
Two 12-core
2.1-GHz Intel Xeon
4116
One 12-core
2.1-GHz Intel Xeon
4116
Processor
384-GB DRAM
12 x 32-GB
DDR4-2666
192-GB DRAM
12 x 16-GB
DDR4-2666
192-GB DRAM
12 x 16-GB
DDR4-2400
96-GB DRAM
6 x 16-GB
DDR4-2400
Memory
24
With two 8-port network modules installed
Maximum number
of interfaces
One Gigabit Ethernet
Supports 1-Gb fiber or copper SFPs
Management port
One RJ-45 consoleSerial port
One USB 2.0 Type AUSB port
Eight fixed 1-Gb and 10-Gb SFP+ ports (named Ethernet 1/1 through 1/8)Network ports
Eight fixed 1-Gb and 10-Gb SFP+ portsSmall form-factor
pluggable (SFP)
ports
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
2
Overview
Features

4145412541154112Feature
Displays the serial number; on the front panelPullout asset card
On rear panelGrounding lug
On front panelLocator beacon
On rear panelPower switch
Two network module slots (network module 2 and network module 3)Network modules
• 8-port 10-Gigabit Ethernet SFP+
• 4-port 40-Gigabit Ethernet QSFP+
• 2-port 100-Gigabit Ethernet QSFP28
First supported in threat defense 7.3.1 and ASA 9.18.1.
Note
• 8-port 1-Gigabit Ethernet copper with hardware bypass
• 2-port 40-Gigabit Ethernet QSFP+ (built-in) with hardware bypass
• 6-port 1-Gigabit Ethernet SX fiber SFP (built-in) with hardware bypass
• 6-port 10-Gigabit Ethernet SR fiber SFP+ (built-in) with hardware bypass
• 6-port 10-Gigabit Ethernet LR fiber SFP+ (built-in) with hardware bypass
Supported network
modules
Two (1+1) power supply module slots
Ships with two 1100-W AC power supply
modules
Hot-swappable
Two (1+1) power supply module slots
Ships with one 1100-W AC power supply
module
Hot-swappable
AC power supply
Two (1+1) power supply module slots
950-W DC power supply module
Hot-swappable
DC power supply
(optional)
1+1Redundant power
Six fan module slots
5+1 redundancy
Hot-swappable
Fan
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
3
Overview
Features

4145412541154112Feature
Two SSD slots
Ships with one 800-GB SSD installed in
slot 1. Slot 1 is the primary SSD and
should always be present. Slot 1 is reserved
for the logical device application instance
(threat defense or ASA).
RAID is not supported.
Note
The SSD must be installed in
slot 1. Slot 2 is reserved only
for the optional MSP.
Caution
Two SSD slots
Ships with one 400-GB SSD installed in
slot 1. Slot 1 is the primary SSD and
should always be present. Slot 1 is reserved
for the logical device application instance
(threat defense or ASA).
RAID is not supported.
Note
The SSD must be installed in
slot 1. Slot 2 is reserved only
for the optional Malware
Storage Pack (MSP).
Caution
Storage
Installed in the second SSD slot onlyMSP (optional)
—Certified—
—Network Equipment
Building Systems
(NEBS) certification
•Common Criteria (CC) certification for the Network Device
Collaborative Protection Profile (NDcPPv2.2E), VPN
Gateway Module (VPNGW_MOD_v1.1), and Firewall
Module (FW_MOD_v1.4e) for ASA 9.16.x.
• Common Criteria (CC) and Commercial Solutions for
Classified (CSFC) for FTD 6.2.x.
•CC for the Network Device Collaborative Protection Profile
(NDcPPv2.1) for ASA 9.12.xand FX-OS 2.6.x.
• Federal Information Processing Standards (FIPS) 140-2 on
ASA 9.12.x, FTD 6.4.x, and FX-OS 2.6.x.
• Department of Defense Information Network Approved
Product List (DoDIN APL) for ASA 9.12.xand FTD 6.4.x.
• US Government Compliance for IPv6 (USGv6) for ASA
9.8.xand FTD 6.2.x.
Firepower 4112 has not yet completed the above
certifications.
Note
See the "Security Certifications Compliance"
chapter in the Cisco FXOS CLI Configuration
Guide or Cisco FXOS Firepower Chassis Manager
Configuration Guide for the procedure to enable
security modes.
Note
—Security standards
certifications
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
4
Overview
Features

Deployment Options
Here are some examples of how you can deploy the Firepower 4100:
• In a data center using NGFW and ASA
• At the core/aggregation layer of a 3-tier data center in a high availability configuration
• As a dedicated multifunctional security service within converged infrastructure stacks, for example,
vBlock, FlexPod, and so forth, at the access layer
• As a high-performance data center security appliance between the WAN edge and the data center core
in a high availability configuration
• Inter-DC clustering deployments
• In newer spine/leaf data center designs, deployment as a leaf that exclusively offers security functions
Package Contents
The following figure shows the package contents for the Firepower 4100. Note that the contents are subject
to change and your exact contents might contain additional or fewer items.
Figure 2: Firepower 4100 Package Contents
Blue console cable PC terminal adapter (part
number 72-3383-01)
2Firepower 4100 chassis1
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
5
Overview
Deployment Options

10/100/1000BASE-T SFP transceiver4Two power cords (country-specific)
See Power Cord Specifications, on page 32 for
a list of supported power cords.
3
Cable management bracket kit (part number
69-100376-01)
• Two cable management brackets (part
number 700-106377-01)
• Four 8-32 x 0.375-inch Phillips screws (part
number 48-2696-01)
6Ground lug kit (part number 69-1000359-01):
• One ground lug #6 AWG, 90 degree, #10
post (part number 32-0608-01)
•Two 10-32 x 39-8-inch Phillips Head screws
(part number 48-0700-01)
5
Two slide rail locking brackets (part number
700-105350-02)
Six 8-32 x 0.375-inch Phillips screws (part
number 48-2696-01)
8Two slide rails with two M3 x 0.5 x 6-mm screws
(48-101144-01)
7
Flextronics tie wrap and tie wrap clamp (part
number 52-100202-01)
10Artesyn tie wrap and tie wrap clamp (part number
52-100204-01)
9
—Cisco Secure Firepower 4100
This document has a URL and QR code that point
to the Digital Documentation Portal. The portal
contains links to the Product Information page,
the Hardware Installation Guide, the Regulatory
and Safety Information Guide, the Getting Started
Guide, and the Easy Deployment Guide.
11
Serial Number Location
The serial number for the Firepower 4100 series chassis is located on the pullout asset card on the front panel.
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
6
Overview
Serial Number Location

Figure 3: Serial Number on the 4100 Chassis
You can also view additional model information on the compliance label located on the bottom of the chassis.
Figure 4: Compliance Label on the 4100 Chassis
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
7
Overview
Serial Number Location

Front Panel
The following figure shows the front panel of the Firepower 4100.
Figure 5: Firepower 4100 Front Panel
Gigabit Ethernet management port2RJ-45 console port1
Eight fixed SFP+ (1-Gb/10-Gb) ports (in network
module slot 1)
Ethernet 1/1 through 1/8 labeled top to bottom,
left to right
4USB 2.0 Type A port3
SSD 2
Reserved for the optional MSP.
6SSD 1
Reserved for the primary SSD; slot 1 must always
be populated.
5
Locator LED8Power LED7
Network module 2
The 10-Gb network module is
shown.
Note
10Pullout asset card9
Network module 3
The 10-Gb network module is
shown.
Note
11
RJ-45 Console Port
The Firepower 4100 has a standard RJ-45 console port. You can use the CLI to configure your Firepower
4100 through the RJ-45 serial console port by using a terminal server or a terminal emulation program
on a computer.
The RJ-45 (8P8C) port supports RS-232 signaling to an internal UART controller. The console port does
not have any hardware flow control, and does not support a remote dial-in modem. The baud rate is 9600.
You can use the standard cable found in your accessory kit to convert the RJ-45 to DB-9 if necessary.
Type A USB Port
You can use the external USB Type A port to attach a data storage device. The external USB drive
identifier is disk1:. The USB Type A port supports the following:
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
8
Overview
Front Panel

• Hot swapping
• USB drive formatted with FAT32
• Boot kick-start image from the Supervisor ROMMON for discovery recovery purposes
• Copy files to and from workspace:/ and volatile:/ within local-mgmt. The most relevant files are:
• Core files
• Ethanalyzer packet captures
• Tech-support files
• Security module log files
• Platform bundle image upload using download image usbA:
The USB Type A port does not support Cisco Secure Package (CSP) image upload.
Network Ports
The Firepower 4100 chassis has eight fixed ports that require 1-Gb/10-Gb SFP/SFP+ transceivers (fiber
or copper). They are numbered from left to right starting with 1 and are named Ethernet 1/1 through
Ethernet 1/8. The 4100 also has two network module slots that support different numbers of ports
depending on the network module. See Network Modules, on page 11 for the supported network modules.
See for Supported SFP/SFP+ and QSFP Transceivers, on page 25 the list of supported transceivers.
Each port has LEDs that represent link/activity status.
Management Port
The Firepower 4100 chassis has a management port that requires a 1-Gb fiber or copper SFP.
Front Panel LEDs
The following figure and table describe the Firepower 4100 front panel LEDs.
Figure 6: Front Panel LEDs
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
9
Overview
Front Panel LEDs

Health (SYS)
• Off—System is not booting yet.
• Green, flashing—Power-up diagnostics are
complete and system is booting up.
• Green—The system has passed power-up
diagnostics.
• Amber—Power-up diagnostics has failed.
• Amber, flashing—Alarm; power-up
diagnostics are running.
2Management
• Off—No connection or port is not in use.
• Amber—No link or network failure.
• Green—Link up.
• Green, flashing—Network activity.
1
Power
• Off—Input power not detected.
• Green, flashing—Appears only when you
move the power switch from ON to OFF.
System is shutting down and powers off once
shutdown is completed.
• Amber—System is powering up.
• Green—System fully powered up.
• Amber, flashing—Reserved.
4SSD
• Off— SSD not present.
• Green—SSD is present; no activity.
• Green, flashing—SSD is active.
• Amber—SSD failure.
• Amber, flashing—Rebuilding, flashes at 1
Hz.
•Amber, flashing—Predictive failure analysis
(PFA) and hot spare; two fast flashes at 4
Hz, pause for 0.5 seconds.
3
Locator LED
• Off—Locate is off.
• Blue—Locate is on.
6Active (ACT)
This LED is not supported; reserved for future
use.
5
Network activity
• Off—No connection or port is not in use.
• Amber—No link or network failure.
• Green—Link up.
• Green, flashing—Network activity.
7
Rear Panel
The following figure shows the rear panel of the Firepower 4100.
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
10
Overview
Rear Panel

Figure 7: Firepower 4100 Rear Panel
Power supply module 12Power on/off switch1
Fan module 14Power supply module 23
Fan module 36Fan module 25
Fan module 58Fan module 47
Location for the two-post grounding lug
The two-post grounding lug is
included in the accessory kit.
Note
10Fan module 69
The power switch is located to the left of power supply module 1 on the rear of the chassis. It is a toggle
switch that controls power to the system. If the power switch is in standby position, only the 3.3-V standby
power is enabled from the power supply module and the 12-V main power is OFF. When the switch is in the
ON position, the 12-V main power is turned on and the system boots.
You can shut down the chassis in one of two ways:
• Perform a graceful shutdown using the shutdown commands (see the FXOS CLI Configuration Guide
for the procedure). This may take several minutes to complete. Then toggle the power switch to the OFF
position. The power LED changes from solid green to off immediately.
If you move the power switch to the OFF position before the shutdown command
sequence is complete or if you remove the system power cords before the graceful
shutdown is complete, disk corruption can occur.
Caution
• Toggle the power switch to the OFF position. The power LED changes from solid green to off.
After removing power from the chassis either by moving the power switch to OFF or unplugging the power
cord, wait at least 10 seconds before turning power back ON.
Note
Network Modules
The Firepower 4100 contains two network module slots that provide optical or electrical network interfaces.
Network modules are optional, removable I/O modules that provide either additional ports or different interface
types (1/10/40 Gb). The Firepower network modules plug into the chassis on the front panel.
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
11
Overview
Network Modules

For More Information
• See 10-Gb Network Module, on page 12 for a description of the 10-GB network module.
• See 40-Gb Network Module, on page 13 for a description of the 40-GB network module.
• See 100-Gb Network Module, on page 14 for a description of the two-port 100-Gb network module.
• See Hardware Bypass Network Modules, on page 15 for the location and description of the LEDs,
and the port configurations for the hardware bypass network modules.
• See Install, Remove, and Replace the Network Module, on page 55 for the procedure for removing
and replacing network modules.
10-Gb Network Module
The following figure shows the front panel of the 10-Gb network module (FPR4K-NM-8X10G). The
FPR4K-NM-8X10G is a single-wide module that supports hot swapping. The eight ports are numbered from
top to bottom, left to right.
Make sure you have the correct firmware package and software version installed to support this network
module. For instructions on how to verify your firmware package version and to upgrade the firmware if
necessary, see the Cisco Firepower 4100/9300 FXOS Firmware Upgrade Guide. See Cisco Firepower 4100/9300
FXOS Compatibility for the software compatibility matrix.
Note
The FPR4K-NM-8X10G is NEBS-compliant.
Note
You can fit four copper SFPs in either the top row of ports or the bottom row of ports. Both rows cannot be
populated at the same time, because of the port row spacing.
Note
Figure 8: FPR4K-NM-8X10G
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
12
Overview
10-Gb Network Module

Ethernet X/12Captive screw/handle1
Ethernet X/54Ethernet X/33
Ethernet X/26Ethernet X/75
Ethernet X/68Ethernet X/47
Network activity LEDs
• Off—No connection or port is not in use.
• Amber—No link or network failure.
• Green—Link up.
• Green, flashing—Network activity.
10Ethernet X/89
For More Information
• For a list of copper SFPs, see Supported SFP/SFP+ and QSFP Transceivers, on page 25.
40-Gb Network Module
The following figure shows the front panel of the 40-Gb network module (FPR4K-NM-4X40G.) The
FPR4K-NM-4X40G is a single-wide module that supports hot swapping. The four ports are numbered left to
right.
Make sure you have the correct firmware package and software version installed to support this network
module. For instructions on how to verify your firmware package version and to upgrade the firmware if
necessary, see the Cisco Firepower 4100/9300 FXOS Firmware Upgrade Guide. See Cisco Firepower 4100/9300
FXOS Compatibility for the software compatibility matrix.
Note
The FPR4K-NM-4X40G is NEBS-compliant.
Note
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
13
Overview
40-Gb Network Module

Figure 9: FPR4K-NM-4X40G
Network activity LEDs
• Off—No connection or port is not in use.
• Amber—No link or network failure.
• Green—Link up.
• Green, flashing—Network activity.
• 40Gb—Only the leftmost LED indicates the
port status.
• 4x10Gb—Each of the port LEDS indicates
the status of respective 10-Gb channel.
2Captive screw/handle1
Ethernet X/24Ethernet X/13
Ethernet X/46Ethernet X/35
100-Gb Network Module
The following figure shows the front panel of the 100-Gb network module (FPR4K-NM-2X100G). The
FPR4K-NM-2X100G is a two-port single-wide module that supports hot swapping. The two ports are numbered
left to right. The FPR4K-NM-2X100G is first supported in FTD 7.2 and ASA 9.18.
Make sure you have the correct firmware package and software version installed to support this network
module. For instructions on how to verify your firmware package version and to upgrade the firmware if
necessary, see the Cisco Firepower 4100/9300 FXOS Firmware Upgrade Guide. See Cisco Firepower 4100/9300
FXOS Compatibility for the software compatibility matrix.
Note
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
14
Overview
100-Gb Network Module

Figure 10: FPR4K-NM-2X100G
Network activity LEDs
• Off—No connection or port is not in use.
• Amber—No link or network failure.
• Green—Link up.
• Green, flashing—Network activity.
2Power LED1
Ethernet X/14Network activity LEDs
• Off—No connection or port is not in use.
• Amber—No link or network failure.
• Green—Link up.
• Green, flashing—Network activity.
3
Captive screw/handle6Ethernet X/25
Hardware Bypass Network Modules
Hardware bypass (also known as fail-to-wire) is a physical layer (Layer 1) bypass that allows paired interfaces
to go into bypass mode so that the hardware forwards packets between these port pairs without software
intervention. Hardware bypass provides network connectivity when there are software or hardware failures.
Hardware bypass is useful on ports where the Firepower security appliance is only monitoring or logging
traffic. The hardware bypass network modules have an optical switch that is capable of connecting the two
ports when needed. The hardware bypass network modules have built-in SFPs.
Hardware bypass is supported only on a fixed set of ports. You can pair Port 1 with Port 2, Port 3 with Port
4, but you cannot pair Port 1 with Port 4 for example.
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
15
Overview
Hardware Bypass Network Modules

When the appliance switches from normal operation to hardware bypass or from hardware bypass back to
normal operation, traffic may be interrupted for several seconds. A number of factors can affect the length of
the interruption; for example, behavior of the optical link partner such as how it handles link faults and
debounce timing; spanning tree protocol convergence; dynamic routing protocol convergence; and so on.
During this time, you may experience dropped connections.
Note
There are three configuration options for hardware bypass network modules:
• Passive interfaces—Connection to a single port.
For each network segment you want to monitor passively, connect the cables to one interface. This is
how the nonhardware bypass network modules operate.
•Inline interfaces—Connection to any two like ports (10 Gb to 10 Gb for example) on one network module,
across network modules, or fixed ports.
For each network segment you want to monitor inline, connect the cables to pairs of interfaces.
• Inline with hardware bypass interfaces—Connection of a hardware bypass paired set.
For each network segment that you want to configure inline with fail-open, connect the cables to the
paired interface set.
For the 40-Gb network module, you connect the two ports to form a paired set. For the 1/10-Gb network
modules, you connect the top port to the bottom port to form a hardware bypass paired set. This allows
traffic to flow even if the security appliance fails or loses power.
If you have an inline interface set with a mix of hardware bypass and nonhardware bypass interfaces, you
cannot enable hardware bypass on this inline interface set. You can only enable hardware bypass on an inline
interface set if all the pairs in the inline set are valid hardware bypass pairs.
Note
For More Information
•See 1-Gb Network Module with Hardware Bypass , on page 16 for a description of the 1-Gb network
module.
• See 40-Gb Network Module with Hardware Bypass , on page 18 for a description of the 40-Gb
network module.
• See 1-Gb SX/10-Gb SR/10-Gb LR Network Module with Hardware Bypass , on page 19 for a
description of the 1-GB SX, 10-GB SR, and LR network modules.
• See Install, Remove, and Replace the Network Module, on page 55 for the procedure for removing
and replacing single-wide network modules.
1-Gb Network Module with Hardware Bypass
The following figure shows the front panel view of the 1-Gb network module with hardware bypass
(FPR-NM-8X1G-F). Pair ports 1 and 2, 3 and 4, 5 and 6, and 7 and 8 to form hardware bypass paired sets.
Cisco Firepower 4112, 4115, 4125, and 4145 Hardware Installation Guide
16
Overview
1-Gb Network Module with Hardware Bypass