Cisco Firepower 2120 Manual

Cisco Firepower 2100 Series Hardware Installation Guide
First Published: 2017-05-25
Last Modified: 2017-06-20
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
©2017 Cisco Systems, Inc. All rights reserved.

CONTENTS
CHAPTER 1 Overview 1
Cisco Firepower 2100 Series Features 1
Deployment Options 3
Package Contents 4
Serial Number Location 6
Front Panel 6
Front Panel LEDs 9
Rear Panel 14
Network Modules 15
Power Supply Modules 17
Fans 20
SSDs 20
Supported SFP/SFP+ Transceivers 20
Hardware Specifications 23
CHAPTER 2 Installation Preparation 27
Installation Notes and Warnings 27
Safety Recommendations 30
Maintain Safety with Electricity 30
Prevent Electrostatic Discharge Damage 31
Site Environment 31
Site Considerations 31
Power Supply Considerations 31
Equipment Rack Configuration Considerations 32
CHAPTER 3 Mount and Connect 33
Rack-Mount the Chassis 33
Ground the Chassis 38
Cisco Firepower 2100 Series Hardware Installation Guide
iii

Connect Cables, Turn on Power, and Verify Connectivity 39
CHAPTER 4 Maintenance and Upgrades 43
Remove and Replace the Network Module 43
Remove and Replace the SSD 45
Remove and Replace the Power Supply Module 46
Connect the DC Power Supply Module 48
Secure the Power Cord on the Power Supply Module 51
Remove and Replace the Fan Tray 54
Install the Optional Cable Management Brackets 55
Cisco Firepower 2100 Series Hardware Installation Guide
iv
Contents

CHAPTER 1
Overview
This chapter describes the hardware features of the Cisco Firepower 2100 security appliance, and contains
the following sections:
•Cisco Firepower 2100 Series Features, page 1
•Deployment Options, page 3
•Package Contents, page 4
•Serial Number Location, page 6
•Front Panel, page 6
•Front Panel LEDs, page 9
•Rear Panel, page 14
•Network Modules, page 15
•Power Supply Modules, page 17
•Fans, page 20
•SSDs, page 20
•Supported SFP/SFP+ Transceivers, page 20
•Hardware Specifications, page 23
Cisco Firepower 2100 Series Features
The Cisco Firepower 2100 series security appliance is a standalone modular security services platform. The
series includes the Firepower 2110, 2120, 2130, and 2140.
Figure 1: Firepower 2110/2120 and Firepower 2130/2140
Cisco Firepower 2100 Series Hardware Installation Guide
1

The following table lists the features for the Firepower 2100 series.
Table 1: Cisco Firepower 2100 Series Features
2140213021202110Feature
1 RU
Fits standard 19-in (48.3-cm) square-hole rack.
Form factor
Yes
4-post EIA-310-D rack
(Optional) 2-two-post mount brackets
Yes
2 two-post mount brackets
(Optional) 4-post EIA-310-D rack
Rack mountable
Front to rear (cold aisle to hot aisle)Airflow
Single 16-core at
1.3G
Single 8-core at
2.0G
Single 6-core at
1.9G
Single 4-core at
1.8G
Intel x86 processor
64 GB32 GB16 GBIntel x86 memory
Single 16-core at
1.8G
Single 12-core at
1.2G
Single 8-core at
1.2G
Single 6-core at
1.2G
Cavium Network
Processor Unit
(NPU)
16G8GCavium NPU RAM
8G (nominal)Flash
2416Maximum number
of interfaces
1 Gigabit Ethernet (10M/100M/1G Base-T)Management port
RJ-45 serial portConsole port
Type A 2.0 (500mA)USB port
12 fixed RJ-45 1G/100M/10M ports
Named Ethernet 1/1 through 1/12
Network ports
4 fixed 1G/10G SFP+ ports4 fixed 1G SFP portsSmall Form-Factor
Pluggable (SFP)
ports
Yes
Displays serial number.
Pull-out label card
YesGrounding lug
Cisco Firepower 2100 Series Hardware Installation Guide
2
Overview
Cisco Firepower 2100 Series Features

2140213021202110Feature
YesLocator beacon
YesPower switch
1 network module slot
NOT hot swappable
NoNetwork modules
2 power supply slots
Ships with two
400W AC power
supplies
Hot swappable
2 power supply slots
Ships with one
400W AC power
supply
Hot swappable
1 fixed AC power supply moduleAC power supply
Yes (optional)NoDC power supply
YesNoRedundant power
1 hot-swappable fan tray with 4 fans4 fixed fansFan
Two SSD slots (200GB )
Ships with one 200GB SSD installed in
slot 1.
Two SSD slots (100GB )
Ships with one 100GB SSD installed in
slot 1.
Storage
Yes
You can install the MSP in the SSD slot 2.
Malware Storage
Pack (MSP)
Deployment Options
You can deploy the Firepower 2100 in the following ways:
•As a firewall:
◦At the enterprise Internet edge deployed in a high availability configuration
◦At branch offices in either an HA pair or standalone
•As a device that provides additional application control, URL filtering, or IPS/threat-centric capabilities:
◦Behind an enterprise Internet edge firewall in an inline in a transparent bump-in-the-wire
configuration or as a standalone (requires hardware fail open network module support)
◦Deployed passively off a SPAN port on a switch or a tap on a network, or standalone
•As a VPN device:
◦For remote access VPN
Cisco Firepower 2100 Series Hardware Installation Guide
3
Overview
Deployment Options

◦For site-to-site VPN
Package Contents
The following illustration shows the package contents for the Firepower 2110 and 2120. The contents are
subject to change and your exact contents will contain additional or fewer items depending on whether you
order the optional parts.
Figure 2: Firepower 2110 and 2120 Package Contents
Blue console cable PC terminal
adapter
2Firepower 2110 or 2120 chassis1
SFP transceiver
(Optional; in package if ordered)
4One power cord
(country-specific)
3
One ground lug kit
#6 AWG lug, two 10-32 x .38"
screws
62 rack-mount brackets and
screws:
•Six 8-32, 0.281#
•Four 12-24, 0.75#
•Four 10-32, 0.75#
•Four M6, 19mm
5
Useful Links Cisco Firepower 2100
Series
8Two cable management brackets
(Optional; in package if ordered)
7
Cisco Firepower 2100 Series Hardware Installation Guide
4
Overview
Package Contents

The following illustration shows the package contents for the Firepower 2130 and 2140. The contents are
subject to change and your exact contents will contain additional or fewer items depending on whether you
order the optional parts.
Figure 3: Firepower 2130 and 2140 Package Contents
Blue console cable PC terminal
adapter
2Firepower 2130 or 2140 chassis1
SFP transceiver
(Optional; in package if ordered)
4One or two power cords
(country-specific)
3
Six 8-32 x .25" slide rail locking
bracket screws
6Slide rail kit
Left and right slide rails, two
M3X6mm wafer head screws
5
One ground lug kit
#6 AWG lug, two 10-32 x .38"
screws
8Two slide rail locking brackets7
Useful Links Cisco Firepower 2100
Series
10Cable management bracket kit
Two cable management brackets
and four 8-32 x 0.375" screws
(Optional; in package if ordered)
9
Power supply module tie wrap
and clamp
11
Cisco Firepower 2100 Series Hardware Installation Guide
5
Overview
Package Contents

Serial Number Location
The serial number for the Firepower 2100 series chassis is located on the pull-out label card on the front panel.
Figure 4: Serial Number on 2100 Chassis
Front Panel
The following figure shows the front panel of the Firepower 2110 and 2120 security appliances. See Front
Panel LEDs, on page 9 for a description of the LEDs.
Figure 5: Firepower 2110 and 2120 Front Panel
Gigabit Ethernet management port
Management 0 (also referred to as
Management 1/1 and Diagnostic 1/1)
2Power LED1
Cisco Firepower 2100 Series Hardware Installation Guide
6
Overview
Serial Number Location

SSD (slot 1)4Twelve RJ-45 1G/100M/10M auto
duplex/auto MDI-X Base-T ports
Ethernet 1/1 through 1/12 labeled top to
bottom, left to right
3
System LEDs6Locator beacon5
RJ-45 console port8Type A USB 2.0 port7
4 fixed SFP (1G) ports
Fiber ports 1/13 through 1/16 labeled
left to right
10Pull-out label card9
SSD (slot 2)11
The following figure shows the front panel of the Firepower 2130 and 2140 security appliance. See Front
Panel LEDs, on page 9 for a description of the LEDs.
Figure 6: Firepower 2130 and 2140 Front Panel
Locator beacon2Power LED1
Twelve RJ-45 1G/100M/10M auto
duplex/auto MDI-X Base-T ports
Ethernet 1/1 through 1/12 labeled top
to bottom, left to right
4Gigabit Ethernet management port
Management 0 (also referred to as
Management 1/1 and Diagnostic 1/1)
3
SSD 26SSD 15
Type A USB 2.0 port8System LEDs7
Pull-out label card10RJ-45 console port9
Network Module (network module slot
1)
124 fixed SFP+ (1G/10G) ports
Fiber ports 13 through 16 labeled left to
right
11
Cisco Firepower 2100 Series Hardware Installation Guide
7
Overview
Front Panel

Management Port
The Firepower 2100 chassis has an RJ-45 copper management port.
RJ-45 Console Port
The Firepower 2100 chassis has a standard RJ-45 console port. You can use the command-line interface
(CLI) to configure your 2100 through the RJ-45 serial console port by using a terminal server or a
terminal emulation program on a computer.
The RJ-45 (8P8C) port supports RS-232 signaling to an internal UART controller. The console port
does not have any hardware flow control, and does not support a remote dial-in modem. The baud rate
is 9600. You can use the standard cable found in your accessory kit to convert the RJ45 to DB9 if
necessary.
Type A USB Port
You can use the external Type A USB port to attach a data-storage device. The external USB drive
identifier is disk1:. The Type A USB port supports the following:
•OIR
•USB drive formatted with FAT32
•Boot kickstart image from ROMMON for discovery recovery purposes
•Copy files to and from workspace:/ and volatile:/ within local-mgmt. The most relevant files are:
◦Core files
◦Ethanalyzer packet captures
◦Tech-support files
◦Security module log files
•Platform bundle image upload using download image usbA:
The Type A USB port does NOT support Cisco Secure Package (CSP) image upload support.
Network Ports
The Firepower 2100 chassis has 12 fixed RJ-45 1G/100M/10M) ports. They are numbered from top to
bottom, left to right starting with 1 and are named Ethernet 1/1 through Ethernet 1/12.
The 2110 and 2120 also have four fixed SFP (1G) ports, and the 2130 and 2140 have four fixed SFP+
(1G/10G) ports. They are fiber ports numbered left to right (1/13 through 1/16).
Each port has LEDs that represent Link/Activity status.
Cisco Firepower 2100 Series Hardware Installation Guide
8
Overview
Front Panel

Front Panel LEDs
The following figure shows the Firepower 2110 and 2120 front panel LEDs.
Figure 7: Firepower 2110 and 2120 Front Panel LEDs
Locator Beacon
•Unlit –Locate is off.
•Solid blue –Locate is on.
The Locator beacon helps
you locate a unit that needs
physical service attention.
This feature is activated in
the software.
Note
2PWR
•Unlit –Input power is not
detected. Standby power is off.
•Blinking green –The system has
detected a power switch toggle
event, and initiated the shutdown
sequence. If the power switch is
in the OFF position, the system
powers off after shutdown is
completed. Do not remove the AC
or DC power source while this
LED is blinking so that the system
has time to perform a graceful
shutdown.
•Solid amber –The system is
powering up (before the BIOS
boots). This takes one to five
seconds at most.
•Solid green –The system is fully
powered up.
1
Cisco Firepower 2100 Series Hardware Installation Guide
9
Overview
Front Panel LEDs

ACT (Active)
•Unlit –The system in standby
mode.
•Green –The system is active.
The status is updated every 10
seconds.
•Amber –Not in use at this time.
4SYS (Health)
•Unlit –The system has not booted
up yet.
•Blinking green –The system is
booting up or in bootloader stage.
•Solid green –The system has fully
booted.
•Solid amber –The system boot up
has failed.
•Blinking amber –Alarm
condition, system needs service or
attention and may not boot
properly.
3
SSD2 ACT
•Unlit –SSD is not present.
•Solid green –SSD is present; no
activity.
•Blinking green –SSD is active.
6SSD1 ACT
•Unlit –SSD is not present.
•Solid green –SSD is present; no
activity.
•Blinking green –SSD is active.
5
SSD1 Alert Status
•Unlit –SSD has normal activity.
•Solid amber –SSD failure.
8FAN
•Unlit –The environmental
subsystem is not active yet.
•Solid green—The fans are running
normally. It may take up to one
minute for the LED status to turn
green after power is on.
•Solid amber—One fan has failed.
The system can continue to
operate normally, but fan service
is required.
•Blinking amber—Two or more
fans have failed, or the fan tray has
been removed from the system.
Immediate attention is required.
7
Ethernet Link
•Solid green –The link partner is
detected; no activity.
•Blinking green –Network
activity is detected.
10SSD2 Alert Status
•Unlit –SSD has normal activity.
•Solid amber –SSD failure.
9
Cisco Firepower 2100 Series Hardware Installation Guide
10
Overview
Front Panel LEDs

Fiber Port
•Solid green –Port is enabled, the
link partner is detected.
•Solid amber –Port is enabled,
but the link partner is not
detected.
•Blinking green –Port is enabled;
network activity is detected.
12Ethernet Speed
•Blinking green –The number of
blinks determines link speed; 1
blink=10Mbit, 2=100Mbit,
3=1Gbit.
11
The following figure describes the Firepower 2130 and 2140 front panel LEDs.
Figure 8: Firepower 2130 and 2140 Front Panel LEDs
Cisco Firepower 2100 Series Hardware Installation Guide
11
Overview
Front Panel LEDs

Locator LED
•Unlit –Locate is off.
•Solid blue –Locate is on.
The Locator beacon helps
you locate a unit that needs
physical service attention.
This feature is activated in
the software.
Note
2Power
•Unlit –Input power is not
detected. Standby power is off.
•Blinking green –The system has
detected a power switch toggle
event, and initiated the shutdown
sequence. If the power switch is
in the OFF position, the system
powers off after shutdown is
completed. Do not remove the AC
or DC power source while this
LED is blinking so that the system
has time to perform a graceful
shutdown.
•Solid amber –The system is
powering up (before the BIOS
boots). This takes one to five
seconds at most.
•Solid green –The system is fully
powered up.
1
ACT (Active)
•Unlit –The system in standby
mode.
•Green –The system is active.
The status is updated every 10
seconds.
•Amber –Not in use at this time.
4SYS (Health)
•Unlit –The system has not booted
up yet.
•Blinking green –The system is
booting up or in bootloader stage.
•Solid green –The system has fully
booted.
•Solid amber –The system boot up
has failed.
•Blinking amber –Alarm
condition, system needs service or
attention and may not boot
properly.
3
SSD2 ACT
•Unlit –The SSD is not present.
•Solid green –The SSD is
present; no activity.
•Blinking green –The SSD is
active.
6SSD1 ACT
•Unlit –The SSD is not present.
•Solid green –The SSD is present;
no activity.
•Blinking green –The SSD is
active.
5
Cisco Firepower 2100 Series Hardware Installation Guide
12
Overview
Front Panel LEDs

PSU-2
•Unlit –The power supply
module is not present or not
detected.
•Solid green –The power supply
module is present and working
properly.
•Solid amber –The power supply
module is present but a fault or
problem has been detected.
8PSU-1
•Unlit –The power supply module
is not present or not detected.
•Solid green –The power supply
module is present and working
properly.
•Solid amber –The power supply
module is present but a fault or
problem has been detected.
7
SSD1 Alert Status
•Unlit –SSD has normal activity.
•Solid amber –SSD failure.
10FAN
•Unlit –The environmental
subsystem is not active yet.
•Solid green—The fans are running
normally. It may take up to one
minute for the LED status to turn
green after power is on.
•Solid amber—One fan has failed.
The system can continue to
operate normally, but fan service
is required.
•Blinking amber—Two or more
fans have failed, or the fan tray has
been removed from the system.
Immediate attention is required.
9
Ethernet Link
•Solid green –The link partner is
detected; no activity.
•Blinking green –Network
activity is detected.
12SSD2 Alert Status
•Unlit –SSD has normal activity.
•Solid amber –SSD failure.
11
Fiber Port
•Solid green –Port is enabled, the
link partner is detected.
•Solid amber –Port is enabled,
but the link partner is not
detected.
•Blinking green –Port is enabled;
network activity is detected.
14Ethernet Speed
•Blinking green –The number of
blinks determines link speed; 1
blink=10Mbit, 2=100Mbit,
3=1Gbit.
13
Cisco Firepower 2100 Series Hardware Installation Guide
13
Overview
Front Panel LEDs

Rear Panel
The following figure shows the rear panel of the Firepower 2110 and 2120.
Figure 9: Firepower 2110 and 2120 Rear Panel
Fixed power supply module2Power on/off switch1
Two-post grounding lug
The two-post grounding lug is
included in the accessory kit.
Note
4Fixed fans3
The following figure shows the rear panel of the Firepower 2130 and 2140.
Figure 10: Firepower 2130 and 2140 Rear Panel
Power supply module 1 FAIL LED2Power on/off switch1
Power supply module 14Power supply module 2 FAIL LED3
Fan tray6Power supply module 1 OK LED5
Power supply module 2 OK LED8Power supply module 27
Cisco Firepower 2100 Series Hardware Installation Guide
14
Overview
Rear Panel

Two-post grounding lug
The two-post grounding lug is
included in the accessory kit.
Note
9
Power Switch
The power switch is located to the left of power supply module 1 on the rear of the chassis. It is a toggle
switch that controls power to the system. If the power switch is in standby position, only the 3.3V
standby power is enabled from the power supply module and the 12V main power is OFF. When the
switch is in the ON position, the 12V main power is turned on and the system boots.
Before you move the power switch to the OFF position, use the shutdown commands so that the system
can perform a graceful shutdown. This may take several minutes to complete. After the graceful shutdown
is completed, the front panel power LED is unlit and the console displays Power Down. See the FXOS
Configuration Guide for more information on using these commands.
If you move the power switch to the OFF position before the shutdown
command sequence has completed or if you remove the system power cords
before the graceful shutdown is complete, disk corruption can occur.
Caution
For More Information
•See Remove and Replace the Power Supply Module, on page 46 for the procedure for removing and
replacing the power supply module in the Firepower 2130 and 2140.
•See Remove and Replace the Fan Tray, on page 54 for the procedure for removing and replacing the
fan tray in the Firepower 2130 and 2140.
•See Ground the Chassis, on page 38 for the procedure for using the grounding lug to ground the chassis.
•See Power Supply Modules, on page 17 for a description of the power supply module LEDs.
•See Front Panel LEDs, on page 9 for a description of the fan LEDs.
Network Modules
The Firepower 2130 and 2140 contain one network module slot that provides optical or electrical network
interfaces. Network modules are optional, removable I/O modules that provide either additional ports or
different interface types. The Firepower network module plugs into the chassis on the front panel.
The network module is NOT hot swappable.Note
The Firepower 2130 and 2140 support the Firepower 8-port 10G Network Module single-wide
(FPR-NM-8X10G SFP+). The 10 Gigabit Ethernet network module ports are numbered from top to bottom,
left to right.
Cisco Firepower 2100 Series Hardware Installation Guide
15
Overview
Network Modules

The following figure shows the front panel view of the 10G network module.
Figure 11: Firepower Network Module 10G
Ethernet 2/12Captive screw/handle1
Ethernet 2/54Ethernet 2/33
Ethernet 2/26Ethernet 2/75
Ethernet 2/68Ethernet 2/47
Network activity LEDs
•Unlit –No connection or port is not
in use.
•Solid amber –No link or network
failure.
•Solid green –Link up.
•Blinking green –Network activity.
10Ethernet 2/89
For More Information
•See Supported SFP/SFP+ Transceivers, on page 20 for a list of supported SFPS.
•See Remove and Replace the Network Module, on page 43 for the procedure for removing and replacing
network modules.
Cisco Firepower 2100 Series Hardware Installation Guide
16
Overview
Network Modules