Cisco 3110 Manual

Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation
Guide
First Published: 2022-04-06
Last Modified: 2022-06-28
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of
the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.
Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.
The documentation set for this product strives to use bias-free language. For purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on
age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that
is hardcoded in the user interfaces of the product software, language used based on standards documentation, or language that is used by a referenced third-party product.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL:
https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a
partnership relationship between Cisco and any other company. (1721R)
©2022 Cisco Systems, Inc. All rights reserved.

CONTENTS
Overview 1
CHAPTER 1
Features 1
Deployment Options 4
Package Contents 5
Serial Number and QR Codes 6
Front Panel 8
Front Panel LEDs 11
Rear Panel 13
1/10/25-Gb Network Module 15
40-Gb Network Module 17
Hardware Bypass Network Modules 19
10/100/1000Base-T Network Module with Hardware Bypass 20
1-Gb SX/10-Gb SR/10-Gb LR/25-Gb SR/25-Gb LR Network Module with Hardware Bypass 22
Power Supply Module 24
Dual Fan Modules 26
SSDs 27
Supported SFP/SFP+/QSFP+ Transceivers 28
Hardware Specifications 32
Product ID Numbers 33
Power Cord Specifications 35
Installation Preparation 45
CHAPTER 2
Installation Warnings 45
Safety Recommendations 47
Maintain Safety with Electricity 48
Prevent ESD Damage 49
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
iii

Site Environment 49
Site Considerations 49
Power Supply Considerations 49
Rack Configuration Considerations 50
Rack-Mount the Chassis 51
CHAPTER 3
Unpack and Inspect the Chassis 51
Rack-Mount the Chassis Using Brackets 52
Rack-Mount the Chassis Using Slide Rails 54
Ground the Chassis 61
Installation, Maintenance, and Upgrade 65
CHAPTER 4
Install, Remove, and Replace the Network Module 65
Remove and Replace the SSD 67
Remove and Replace the Dual Fan Module 70
Remove and Replace the Power Supply Module 71
Connect the DC Power Supply Module 74
Secure the Power Cord on the Power Supply Module 77
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
iv
Contents

CHAPTER 1
Overview
•Features, on page 1
•Deployment Options, on page 4
•Package Contents, on page 5
•Serial Number and QR Codes, on page 6
•Front Panel, on page 8
•Front Panel LEDs, on page 11
•Rear Panel, on page 13
•1/10/25-Gb Network Module, on page 15
•40-Gb Network Module, on page 17
•Hardware Bypass Network Modules, on page 19
•10/100/1000Base-T Network Module with Hardware Bypass, on page 20
•1-Gb SX/10-Gb SR/10-Gb LR/25-Gb SR/25-Gb LR Network Module with Hardware Bypass, on page
22
•Power Supply Module, on page 24
•Dual Fan Modules, on page 26
•SSDs, on page 27
•Supported SFP/SFP+/QSFP+ Transceivers , on page 28
•Hardware Specifications, on page 32
•Product ID Numbers, on page 33
•Power Cord Specifications, on page 35
Features
The Cisco Secure Firewall 3100 is a standalone modular security services platform that includes the Secure
Firewall 3110, 3120, 3130, and 3140. See Product ID Numbers, on page 33 for a list of the product IDs (PIDs)
associated with the 3100 series.
The Secure Firewall 3100 supports Cisco Firepower Threat Defense and Cisco ASA software. See the Cisco
Secure Firewall Threat Defense Compatibility Guide and the Cisco Secure Firewall ASA Compatibility guide,
which provide Cisco software and hardware compatibility, including operating system and hosting environment
requirements, for each supported version.
The following figure shows the Secure Firewall 3100.
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
1

Figure 1: Secure Firewall 3100
The following table lists the features for the Secure Firewall 3100.
Table 1: Secure Firewall 3100 Features
3140313031203110Feature
1 RU
Fits a standard 19-inch (48.3-cm) square-hole rack
Form factor
(Optional) Two 2-post mount brackets and/or two slide rails
4-post Electronic Industries Association (EIA)-310-D rack
We recommend that you order the slide rails for your Secure Firewall 3100.
Note
Rack mount
Front to rear (I/O side to non-I/O side)
Cold aisle to hot aisle
Airflow
AMD 7452AMD 7352AMD 7282
AMD 7272Processor
32241612Core count
2.35 GHz2.3 GHz2.8 GHz2.9 GHzCore clock
4 x 64 GB4 x 32 GB2 x 64 GB2 x 32 GBSystem memory
One 1/10-Gb small form-factor pluggable (SFP) portManagement port
One RJ-45 serial portConsole port
USB 3.1 Type A (900 mA) portUSB port
8 SFP fixed ports and 8 copper RJ-45 ports
Named Ethernet 1/1 through 1/16
Network ports
Eight 1/10/25-Gb SFP ports
Four 40-Gb QSFP ports
Network module
ports
One (hot-swappable)
Although the hardware supports hot-swapping, the software does not. You
must power off the chassis when removing/replacing network modules.
Note
Network module
slots
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
2
Overview
Features

3140313031203110Feature
• 8-port 1Gb/10Gb/25Gb SFP+
(FPR3K-XNM-8X25G)
• 8-port 1Gb/10Gb SFP+
(FPR3K-XNM-8X10G)
• 4-port 40-Gb QSFP+
(FPR3K-XNM-4X40G)
• 6-port 1-Gb SFP SX multimode
hardware
bypass(FPR3K-XNM-6X1SXF)
• 6-port 10-Gb SFP SR multimode
hardware bypass
(FPR3K-XNM-6X10SRF)
• 6-port 10-Gb SFP LR single mode
hardware bypass
(FPR3K-XNM-6X10LRF)
• 6-port 25-Gb SFP SR multimode
hardware bypass
(FPR3K-XNM-6X25SRF)
• 6-port 25-Gb SFP LR single mode
hardware bypass
(FPR3K-XNM-6X25LRF)
• 8-port 10/100/1000Base-T hardware
bypass (FPR3K-XNM-8X1GF)
• 8-port 1Gb/10Gb SFP+
(FPR3K-XNM-8X10G)
• 6-port 1-Gb SFP SX multimode
hardware bypass
(FPR3K-XNM-6X1SXF)
• 6-port 10-Gb SFP SR multimode
hardware bypass
(FPR3K-XNM-6X10SRF)
• 6-port 10-Gb SFP LR single mode
hardware bypass
(FPR3K-XNM-6X10LRF)
• 6-port 25-Gb SFP SR multimode
hardware bypass
(FPR3K-XNM-6X25SRF)
• 6-port 25-Gb SFP LR single mode
hardware bypass
(FPR3K-XNM-6X25LRF)
• 8-port 10/100/1000Base-T hardware
bypass (FPR3K-XNM-8X1GF)
Network modules
Two power supply slots
Ships with two 400-W AC power supply
modules
Hot-swappable
Two power supply slots
Ships with one 400-W AC power supply
module
Hot-swappable
AC power supply
Yes (optional)
Hot-swappable
DC power supply
Yes
Ships with two power supplies.
Note
No
Yes, if you order an extra power
supply.
Note
Redundant power
Two dual fan module slots (3 + 1)
The dual fan modules are hot-swappable.
Note
Fans
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
3
Overview
Features

3140313031203110Feature
Two Nonvolatile Memory Express (NVMe) SSD slots
Ships with one 900-GB SSD installed in slot 1. You can order a second RAID1 SSD
for slot 2. The RAID1 SSD is preconfigured for RAID1.
Slot 2 is reserved for the optional software RAID1 configuration.
Note
Hot-swapping is supported with 2 SSDs. However, you must enter a CLI
command to remove one disk from the RAID before hot swapping. See the
CLI configuration guide for your software for the procedure.
Note
Storage
Displays the serial number and a QR code that points to the low touch provisioning
(LTP) guide.
Pullout asset card
On rear panelGrounding lug
On rear panelPower switch
Resets the system to factory default without requiring serial console access
The reset button is recessed. Press with a pin and hold longer than 5 seconds
to set the system back to the factory default.
Note
Reset button
Deployment Options
Here are some examples of how you can deploy the Secure Firewall 3100:
• As a firewall:
• At the enterprise internet edge in a redundant configuration
• At branch offices in either a high availability pair or standalone
• At data centers in a high availability pair or clustered, which serves the needs of smaller enterprises
•As a device that provides additional application control, URL filtering, or IPS/threat-centered capabilities:
• Behind an enterprise internet edge firewall in an inline configuration or as a standalone (requires
hardware fail-open network module support)
• Deployed passively off a SPAN port on a switch or a tap on a network, or standalone
• As a branch native SD-WAN solution that offers remote deployment and is managed over a 4G LTE
• As a VPN device:
• For remote access VPN
• For site-to-site VPN
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
4
Overview
Deployment Options

Package Contents
The following figure shows the package contents for the Secure Firewall 3100. The contents are subject to
change and your exact contents contain additional or fewer items depending on whether you order the optional
parts. See Product ID Numbers for a list of PIDs associated with the package contents.
There are two sets of four screws that you can use to secure the chassis to your rack. Chose the screws that
fit your rack.
Note
Figure 2: Secure Firewall 3100 Package Contents
Console cable RJ-45 to DB-9 (part number
72-3383-01)
2Secure Firewall 3100 chassis1
SFP transceiver
(Optional; in package if ordered)
4One or two power cords (country-specific)
See Power Cord Specifications, on page 35 for
a list of supported power cords.
3
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
5
Overview
Package Contents

Cable management bracket kit (part number
69-100376-01)
• Two cable management brackets (part
number 700-128334-01)
• Four 8-32 x 0.375-inch Phillips screws (part
number 48-2696-01)
(Optional; in package if ordered)
6One ground lug kit (part number 69-100359-01)
• One #6 AWG, 90 degree, #10 post ground
lug (part number 32-0608-01)
• Two 10-32 x 0.38-inch Phillips screws (part
number 48-0700-01)
5
Rack-mount bracket kit (53-101510-02):
• Two rack-mount brackets (700-127244-01)
• Six 8-32 x 0.375-inch Phillips screws (part
number 48-2286) for securing the brackets
to the chassis
• Four 10-32 x 0.75-inch Phillips screws (part
number 48-0441-01) for securing the chassis
to your rack
• Four 12-24 x 0.75-inch Phillips screws (part
number 48-0440-01) for securing the chassis
to your rack
(Optional; in package if ordered)
8Two slide rails (800-110033-01)
Slide rail accessories kit (53-101509-02):
•Two slide rail locking brackets (part number
700-121935-01)
• Six 8-32 x 0.302-inch slide rail locking
bracket Phillips screws (part number
48-102184-01)
• Two M3 x 0.5 x 6-mm Phillips screws (part
number 48-101144-01)
(Optional; in package if ordered)
7
Two power supply module tie wraps and clamps
(part number 52-100162-01)
10Cisco Secure Firewall 3100
This document has a URL pointing to the
hardware installation guide, a URL pointing the
regulatory and safety guide, and a QR code and
URL pointing to the Getting Started Guide.
9
Serial Number and QR Codes
The pullout asset card on the front panel of your Secure Firewall 3100 chassis contains the model number,
serial number, and Low-Touch Provisioning (LTP) document QR code. The LTP document, Easy Deployment
Guide for 1000, 2100, or 3100 Series Cisco Secure Firewalls, explains how to use LTP to allow anyone to
connect a new Secure Firewall 3100 chassis to a network so that they can add the device to Cisco Defense
Orchestrator (CDO) and configure it remotely.
The compliance label on the bottom of the chassis (along with regulatory information) contains a QR code
that points to the Cisco Secure Firewall 3100 Getting Started Guide. The getting started guide explains how
to get the chassis cabled and running with your chosen operating system.
You can view additional model information on the compliance label located on the bottom of the chassis.
Note
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
6
Overview
Serial Number and QR Codes

Figure 3: Pullout Asset Card
The following figure shows an example compliance label found on the bottom of the chassis and the pullout
asset card found on the front panel of the chassis.
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
7
Overview
Serial Number and QR Codes

Figure 4: Example Compliance Label and Pullout Asset Card
Serial number2Model number1
QR code pointing to the Cisco Secure Firewall
3100 Getting Started Guide
4QR code pointing to the LTP document3
Front Panel
The following figure shows the front panel of the Secure Firewall 3100. See Front Panel LEDs, on page 11
for a description of the LEDs.
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
8
Overview
Front Panel

Figure 5: Secure Firewall 3100 Front Panel
SSD-22SSD-11
RJ-45 console port4System LEDs3
Gigabit Ethernet management port:
• Secure Firewall Threat
Defense—Management 0 (also referred to
as Management 1/1 and Diagnostic 1/1)
• ASA—Management 1/1
6Type A USB 3.1 port5
Recessed factory reset button8Reset button LED7
Fixed copper ports (NM-1)
Copper ports named 1/1 through 1/8 left to right
10Pullout asset card with chassis serial number,
getting started guide QR code, and LTP QR code
9
Network module (NM-2)12Fixed fiber ports (NM-1)
Fiber ports named 1/9 through 1/16 left to right
11
Management Port
The Secure Firewall 3100 chassis management port is a 1/10-Gb fiber SFP port.
RJ-45 Console Port
The Secure Firewall 3100 chassis has a standard RJ-45 console port. You can use the CLI to configure
your 3100 through the RJ-45 serial console port by using a terminal server or a terminal emulation
program on a computer.
The RJ-45 (8P8C) port supports RS-232 signaling to an internal UART controller. The console port does
not have any hardware flow control, and does not support a remote dial-in modem. The baud rate is 9600.
You can use the standard cable found in your accessory kit to convert the RJ-45 to DB-9 if necessary.
Type A USB 3.1 Port
You can use the external Type A USB port to attach a data-storage device. The external USB drive
identifier is usb:. The Type A USB port supports the following:
• Hot swapping
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
9
Overview
Front Panel

• USB drive formatted with FAT32
• Boot kickstart image from ROMMON for discovery recovery purposes
• Copy files to and from workspace:/ and volatile:/ within local-mgmt. The most relevant files are:
• Core files
• Ethanalyzer packet captures
• Tech-support files
• Security module log files
• Platform bundle image upload using download image usbA:
The Type A USB port does not support Cisco Secure Package (CSP) image upload support.
Network Ports
The Secure Firewall 3100 chassis has a network module slot that supports the following network modules:
• 8-port 1/10-Gb SFP
• 8-port 1/10/25-Gb SFP
• 6-port 1-Gb SFP SX multimode hardware bypass
• 6-port 10-Gb SFP SR multimode hardware bypass
• 6-port 10-Gb SFP LR single mode hardware bypass
• 6-port 25-Gb SFP SR multimode hardware bypass
• 6-port 25-Gb SFP LR single mode hardware bypass
• 8-port 10/100/1000Base-T hardware bypass
• 4-port 40-Gb QSFP
The 4-port 40-Gb and 8-port 25-Gb network modules are supported only on the
3130 and 3140.
Note
Factory Reset Button
The Secure Firewall 3100 chassis has a recessed reset button that resets the system to the factory default.
All previous configuration is erased after pressing the button down for five seconds. The following
occurs:
• ROMMON NVRAM is cleared and returned to default.
• All extra images are removed; the current running image remains.
• FXOS logs, core files, SSH keys, certificates, FXOS configuration, and Apache configuration are
removed.
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
10
Overview
Front Panel

If power is lost between when you pushed the reset button and when the reset process is complete, the
process stops and you have to push the button again after the system powers back on.
Note
For More Information
• See Remove and Replace the SSD, on page 67 for the procedure for removing a replacing the SSD.
• See Install, Remove, and Replace the Network Module, on page 65 for the procedure for installing
network modules.
• See 1/10/25-Gb Network Module, on page 15 for more information about the network module.
• See 1-Gb SX/10-Gb SR/10-Gb LR/25-Gb SR/25-Gb LR Network Module with Hardware Bypass, on
page 22 for more information about the network module.
• See 10/100/1000Base-T Network Module with Hardware Bypass, on page 20 for more information
about the network module.
• See 40-Gb Network Module, on page 17 for more information about the network module.
Front Panel LEDs
The following figure shows the Secure Firewall 3100 front panel LEDs.
Figure 6: Secure Firewall 3100 Front Panel LEDs
RJ-45 Copper Port Activity Status
• Off—No activity
• Green, flashing—The number of flashes
determines the link speed; 1 flash=10 Mb,
2=100 Mb, 3=1 Gb.
2RJ-45 Copper Port Link Status
• Off—No link.
• Green—Link is up.
1
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
11
Overview
Front Panel LEDs

Factory Reset Button Status
• Green, flashing—Flashes 5 seconds after
you depress the button.
• Off—Reset is complete.
4Management Port Status
The 1/10-Gb fiber management port has a bicolor
LED under the SFP cage that indicates
link/activity/fault:
• Off—No SFP.
• Green—Link up.
• Green, flashing—Network activity.
• Amber—SFP present, but no link.
3
Network Module 2 Port Status
• Green—Port is enabled, the link partner is
detected.
•Amber—Port is enabled, but the link partner
is not detected.
• Green, flashing—Port is enabled; network
activity is detected.
6Fiber Port Link/Activity Status
Each fiber port has one dual color LED under the
SFP cage.
• Off—No SFP.
• Green—Link up.
• Green, flashing—Network activity at >1G
is detected.
• Amber—No link or network failure.
5
Alarm Status
• Off—No alarms.
• Amber—Environmental error.
• Green—Status is ok.
8CDO Status
• Green, flashing slowly (twice in 5
seconds)—Cloud is connected.
• Green and amber, flashing—Cloud
connection failure.
• Green—Cloud is disconnected.
See the Easy Deployment Guide for
1000, 2100, or 3100 Series Cisco
Secure Firewalls for more information
on LTP.
Note
7
System Status
• Off—System has not booted up yet.
• Green, flashing quickly—System is booting
up.
• Green—Normal system function.
• Amber—System boot up has failed.
• Amber, flashing—Alarm condition, system
needs service or attention and may not boot
properly.
10SSD 1 Status
• Off—The SSD is not present.
• Green—The SSD is present; no activity.
• Green, flashing—The SSD is active.
• Amber—The SSD has a problem or failure.
9
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
12
Overview
Front Panel LEDs

Power Status
• Off—Input power is not detected. If the AC
power cord is plugged in, and the LED on
the power supply is blinking green, standby
power is still on.
• Green, flashing—The system has detected
a power switch toggle event, and initiated
the shutdown sequence. If the power switch
is in the OFF position, the system powers
off after shutdown is completed. Do not
remove the AC or DC power source while
this LED is blinking so that the system has
time to perform a graceful shutdown.
• Amber—The system is powering up (before
the BIOS boots). This takes one to five
seconds at most.
• Green—The system is fully powered up.
12SSD 2 Status
• Off—The SSD is not present.
• Green—The SSD is present; no activity.
• Green, flashing—The SSD is active.
• Amber—The SSD has a problem or failure.
11
—Activity Status (Role of a high-availability pair)
• Off—The unit is not configured or enabled
in a high-availability pair.
• Green—The unit is in active mode.
• Amber—The unit is in standby mode.
13
Rear Panel
The following figure shows the rear panel of the Secure Firewall 3100.
Figure 7: Secure Firewall 3100 Rear Panel
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
13
Overview
Rear Panel

Power LED below
This power LED has the same
behavior as the front panel LED. See
Front Panel LEDs, on page 11 for
more information.
Note
2Power on/off switch1
Power supply module 1 FAIL LED4Power supply module 13
Power supply module 1 connector6Power supply module 1 OK LED5
Dual fan module 18Dual Fan Module 1 LED7
Dual fan module 210Dual Fan Module 2 LED9
Power supply module 2 FAIL LED12Power supply module 211
Power supply module 2 connector14Power supply module 2 OK LED13
—Two-post grounding pad
The two-post grounding lug and two
screws are included in the accessory
kit.
Note
15
Power Switch
The power switch is located to the left of power supply module 1 on the rear of the chassis. It is a toggle
switch that controls power to the system. If the power switch is off but the power cord is plugged in and
the power supply is flashing green, the system is in standby position, and only the 3.3-V standby power
is enabled from the power supply module. The 12-V main power is OFF. When the switch is in the ON
position, the 12-V main power is turned on and the system boots.
Before you move the power switch to the OFF position, use the shutdown commands so that the system
can perform a graceful shutdown. This may take several minutes to complete. After the graceful shutdown
is complete, the console displays It is safe to power off now. Wait until the front panel
PWR LED flashes momentarily and is off before removing AC power.
See Front Panel LEDs, on page 11 for the PWR LED description. See the FXOS Configuration Guide
for more information on using the shutdown commands.
If you remove the system power cords before the graceful shutdown is complete, disk corruption can
occur. You can move the power switch to OFF before the shutdown. The system ignores it.
Caution
After removing power from the chassis by unplugging the power cord, wait at least 10 seconds before
turning power back ON. You want to keep the system power off, including the standby power, for 10
seconds.
Note
For More Information
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
14
Overview
Rear Panel

• See Remove and Replace the Power Supply Module, on page 71 for the procedure for removing and
replacing the power supply module in the Secure Firewall 3100.
• See Remove and Replace the Dual Fan Module, on page 70 for the procedure for removing and replacing
the dual fan module in the Secure Firewall 3100.
• See Ground the Chassis, on page 61 for the procedure for using the grounding lug to ground the chassis.
• See Power Supply Module, on page 24 for a description of the power supply module LEDs.
• See Dual Fan Modules, on page 26 for a description of the fan LEDs.
1/10/25-Gb Network Module
The Secure Firewall 3100 chassis has one network module slot. Network modules are optional, removable
I/O modules that provide either additional ports or different interface types. The network module plugs into
the chassis on the front panel. See Front Panel, on page 8 for the location of the network module slot on the
chassis.
There are two PIDs for this network module: FPR3K-XNM-8X10G and FPR3K-XNM-8X25G.
FPR3K-XNM-8X10G supports 1 Gb and 10 Gb full-duplex Ethernet traffic per port and is supported on all
Secure Firewall 3100s. FPR3K-XNM-8X25G supports 1 Gb, 10 Gb, or 25 Gb full-duplex Ethernet traffic per
port and is supported only on the 3130 and 3140.
The top ports are numbered from left to right—Ethernet X/1, Ethernet X/3, Ethernet X/5, and Ethernet X/7.
The bottom ports are numbered from left to right—Ethernet X/2, Ethernet X/4, Ethernet X/6, and Ethernet X/8
(see the figure below). Up arrows are the top ports and down arrows are the bottom ports (see the figure
below). This network module supports SFP/SFP+/SFP28 transceivers. See Supported SFP/SFP+/QSFP+
Transceivers , on page 28 for the list of Cisco-supported transceivers.
The hardware and the system support hot swapping if you are replacing a network module with the same type
of network module. You must first disable the network port and then reenable it after replacement. If you
replace the 1/10/25-Gb network module with another supported network module, you must reboot the chassis
so that the new network module is recognized. See the configuration guide for your operating system for the
detailed procedures for managing network modules.
Note
Although you can install the 8-port 1/10/25-Gb network in the Secure Firewall 3110 and 3120, the software
does not recognize it because it is not supported.
Note
The following figure shows the front panel of the 1/10-Gb and 1/10/25-Gb network module.
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
15
Overview
1/10/25-Gb Network Module

Figure 8: 1/10-Gb and 1/10/25-Gb Network Module
Ethernet X/12Captive screw1
Ethernet X/54Ethernet X/33
Power on LED6Ethernet X/75
Ethernet X/28Ejector handle7
Ethernet X/610Ethernet X/49
Network activity LEDs
The up arrows represent the top ports and the
down arrows represent the bottom ports.
• Off—No SFP.
• Amber—No link or network failure.
• Green—Link up.
• Green, flashing—Network activity.
12Ethernet X/811
For More Information
• See 40-Gb Network Module, on page 17 for a description of the 40-Gb network module.
• See 1-Gb SX/10-Gb SR/10-Gb LR/25-Gb SR/25-Gb LR Network Module with Hardware Bypass,
on page 22 for a description of the 1/10/25-Gb network module.
Cisco Secure Firewall 3110, 3120, 3130, and 3140 Hardware Installation Guide
16
Overview
1/10/25-Gb Network Module