Cisco Firepower 4100 Series Manual

Cisco Firepower 4100 Series Hardware Installation Guide
First Published: 2016-03-31
Last Modified: 2017-04-27
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
©2016-2017 Cisco Systems, Inc. All rights reserved.

CONTENTS
CHAPTER 1 Overview 1
About the Cisco Firepower 4100 Security Appliance 1
Deployment Options 4
Package Contents 4
Serial Number Location 5
Front Panel 6
Front Panel LEDs 7
Rear Panel 8
Network Modules 9
Nonhardware (FTW) Bypass Network Modules 10
Hardware Bypass (FTW) Network Modules 12
Power Supply Modules 18
Fan Modules 20
Supported SFP/SFP+ Transceivers 21
Power Cord Specifications 24
Hardware Specifications 34
CHAPTER 2 Prepare for Installation 37
Installation Notes and Warnings 37
Safety Recommendations 39
Maintain Safety with Electricity 40
Prevent Electrostatic Discharge Damage 40
Site Environment 41
Power Supply Considerations 41
Equipment Rack Configuration Considerations 41
CHAPTER 3 Mount and Connect 43
Rack-Mount the Chassis 43
Cisco Firepower 4100 Series Hardware Installation Guide
iii

Ground the Chassis 49
Install the FIPS Opacity Shield 50
Connect Cables, Turn on Power, and Verify Connectivity 55
CHAPTER 4 Maintenance and Upgrades 59
Remove and Replace the Network Module 59
Remove and Replace the Fan Module 62
Remove and Replace the SSD 64
Remove and Replace the Power Supply Module 65
Connect the DC Power Supply Module 69
Secure the Power Cord on the AC Power Supply Module 75
Cisco Firepower 4100 Series Hardware Installation Guide
iv
Contents

CHAPTER 1
Overview
This chapter describes the hardware features of the Cisco Firepower 4100 security appliance, and contains
the following sections:
•About the Cisco Firepower 4100 Security Appliance, page 1
•Deployment Options, page 4
•Package Contents, page 4
•Serial Number Location, page 5
•Front Panel, page 6
•Front Panel LEDs, page 7
•Rear Panel, page 8
•Network Modules, page 9
•Power Supply Modules, page 18
•Fan Modules, page 20
•Supported SFP/SFP+ Transceivers, page 21
•Power Cord Specifications, page 24
•Hardware Specifications, page 34
About the Cisco Firepower 4100 Security Appliance
The Cisco Firepower 4100 security appliance is a standalone modular security services platform with a one
RU form factor. It is capable of running multiple security services simultaneously and so is targeted at the
data center as a multi-service platform. The Firepower 4100 chassis contains the following components:
•Network module 1 with eight fixed SFP+ ports (1G and 10G connectivity), the management port, RJ-45
console port, Type A USB port, PID and S/N card, locator indicator, and power switch
•Two network modules slots (network module 2 and network module 3)
•Two (1+1) redundant power supply module slots
Cisco Firepower 4100 Series Hardware Installation Guide
1

•Six fan module slots
•Two SSD bays
RAID is not supported.Note
The network modules, power supply modules, fan modules and SSDs are FRUs (field replaceable units). The
power supply modules and the fan modules are hot-swappable. Although the hardware supports hot swapping
for the SSDs and network modules, the software does not, so you must power down the chassis before removing
and replacing them.
You can install an MSP (Malware Storage Pack) in the second SSD slot (SSD slot 2). The MSP stores threat
detection results for use in future analysis. It supports the Advanced Malware Protection software feature. It
is used as both storage and as the Malware application repository.
Do not switch the two SSDs. The MSP MUST be installed in slot 2. If you remove it and install it in slot
1, all stored file capture data are lost.
Caution
The Firepower 4100 is a one RU chassis designed to fit in a 19-inch rack using rack mount slides. The ports
are located on the front (cold aisle) and the power supplies, power entry, and fans are in the rear. Air flow is
from front to rear (cold aisle to hot aisle).
The following figure shows the Firepower 4100 series security appliance.
Figure 1: Firepower 4100 Series Security Appliance
Cisco Firepower 4100 Series Hardware Installation Guide
2
Overview
About the Cisco Firepower 4100 Security Appliance

Power Switch
The power switch is located to the left of power supply module 1 on the rear of the chassis. It is a toggle
switch that controls power to the system. If the power switch is in standby position, only the 3.3V
standby power is enabled from the power supply module and the 12V main power is OFF. When the
switch is in the ON position, the 12V main power is turned on and the system boots.
Before you move the power switch to the OFF position, use the shutdown commands so that the system
can perform a graceful shutdown. This may take several minutes to complete. After the graceful shutdown
is completed, the front panel power LED is unlit and the console displays Power Down.
The shutdown commands are first available in Firepower eXtensible Operating
System (FXOS) version 2.0.1. See the FXOS Configuration Guide for more
information on using these commands.
Note
If you move the power switch to the OFF position before the shutdown
command sequence has completed or if you remove the system power cords
before the graceful shutdown is complete, disk corruption can occur.
Caution
The Firepower 4100 has the following hardware configurations.
Firepower 4110
The Firepower 4110 has a single 12-core processor, one AC power supply module, one 200-GB SSD,
and 64-GB of DDR4 RAM. You can add another power supply module for redundant power.
The second SSD bay is reserved for the MSP SSD.
Firepower 4120
The Firepower 4120 has dual 12-core processors, one AC power supply module, one 200-GB SSD,
and 128-GB of DDR4 RAM. You can add another power supply module for redundant power.
The second SSD bay is reserved for the MSP SSD.
The Firepower 4120 is NEBS-certified.Note
Firepower 4140
The Firepower 4140 has dual 18-core processors, dual AC power supply modules, one 400-GB SSD,
and 256-GB of DDR4 RAM.
The second SSD bay is reserved for the MSP SSD.
Firepower 4150
The Firepower 4150 has a dual 22-core processor, dual redundant AC power supply modules, one
400-GB SSD in slot 1, and 256-GB of DDR4 RAM. The second SSD bay is reserved for the MSP SSD.
Cisco Firepower 4100 Series Hardware Installation Guide
3
Overview
About the Cisco Firepower 4100 Security Appliance

Deployment Options
You can deploy the Firepower 4100 in the following ways:
•In a data center using NGFW and ASA
•At the core/aggregation layer of a three-tier data center in an HA configuration
•As a dedicated multi-functional security service within converged infrastructure stacks, for example,
vBlock, FlexPod, and so forth, at the access layer
•As a high-performance data center security appliance between the WAN edge and the data center core
in an HA configuration
•Inter-DC clustering deployments
•In newer spine/leaf data center designs, deployment as a leaf that exclusively offers security functions
Package Contents
The following figure shows the package contents for the Firepower 4100 series security appliance. Note that
the contents are subject to change and your exact contents might contain additional or fewer items.
Figure 2: Firepower 4100 Package Contents
Blue console cable PC terminal
adapter
2Firepower 4100 chassis1
10/100/1000BASE-T SFP
transceiver
4Two power cords
(country-specific)
3
Cisco Firepower 4100 Series Hardware Installation Guide
4
Overview
Deployment Options

Tie wrap clamp6Two slide rails5
Flextronics tie wrap8Artesyn tie wrap7
Ten 8-32 x .375" countersink
screws used to secure the mounting
bracket to chassis (6 screws), and
the cable management brackets to
the mounting brackets (4 screws)
10Two M3X6mm screws used to
secure the inner slide rail to the
chassis
9
Two 10-32 x .375" screws used to
secure the ground lug
12Two slide rail locking brackets11
Two cable management brackets14One ground lug #6 AWG, 90
degree, #10 post
13
Welcome to the Cisco Firepower
4100
115
Serial Number Location
The serial number for the Firepower 4100 series chassis is located on the pull-out label card on the front panel.
Figure 3: Serial Number on 4100 Chassis
Cisco Firepower 4100 Series Hardware Installation Guide
5
Overview
Serial Number Location

Front Panel
The following figure shows the front panel of the Firepower 4100 series security appliance.
Figure 4: Firepower 4100 Series Front Panel
Gigabit Ethernet management port2RJ-45 console port1
Eight fixed SFP+ (1G/10G) ports are
provided (network module slot 1)
Gigabit Ethernet 1/1 through 1/8
labeled top to bottom, left to right
4Type A USB port3
SSD 26SSD 15
Locator LED8Power LED7
Network Module (network module slot
2)
The 10G network module is
shown.
Note
10Pull-out label card9
Network Module (network module slot
3)
The 10G network module is
shown.
Note
11
Cisco Firepower 4100 Series Hardware Installation Guide
6
Overview
Front Panel

Front Panel LEDs
The following figure and table describe the Firepower 4100 series security appliance front panel LEDs.
Figure 5: Front Panel LEDs
Health (SYS)
•Solid Green –Normal.
•Blinking Amber –Critical
condition, blinks at 1 Hz.
•Solid Amber –Degraded
condition.
2Management
•Unlit –No connection or port is
not in use.
•Solid amber –No link or network
failure.
•Solid green –Link up.
•Blinking green –Network activity.
1
Power
•Unlit –Input power not detected.
•Blinking green –System is
shutting down and will power
off once shutdown is completed.
•Solid amber –System is
powering up.
•Solid green –System fully
powered up.
•Blinking amber –Reserved.
4SSD
•Unlit –SSD not present.
•Solid green –SSD is present; no
activity.
•Blinking green –SSD is active.
•Solid amber –SSD failure.
•Blinking amber –Rebuilding,
blinks at 1 Hz.
•Blinking amber –Predictive
failure analysis (PFA) and
hotspare; 2 fast blinks at 4 Hz,
pause for 0.5 seconds.
3
Cisco Firepower 4100 Series Hardware Installation Guide
7
Overview
Front Panel LEDs

Locator LED
•Unlit –Locate is off.
•Solid blue –Locate is on.
6Activity (ACT)
•Green –System is active. The
status is updated every 10 seconds.
•Amber –Not currently supported.
5
Network activity
•Unlit –No connection or port is
not in use.
•Solid amber –No link or network
failure.
•Solid green –Link up.
•Blinking green –Network activity.
7
Rear Panel
The following figure shows the rear panel of the Firepower 4100 series security appliance.
Figure 6: Firepower 4100 Series Rear Panel
Power supply module 12Power on/off switch1
Fan module 14Power supply module 23
Fan module 36Fan module 25
Fan module 58Fan module 47
Location for the two-post grounding lug
The two-post grounding lug is
included in the accessory kit.
Note
10Fan module 69
Cisco Firepower 4100 Series Hardware Installation Guide
8
Overview
Rear Panel

Network Modules
The FirePower 4100 security appliance contains two network module slots that provide optical or electrical
network interfaces. Network modules are optional, removable I/O modules that provide either additional ports
or different interface types (1/10/40G). The Firepower network modules plug into the chassis on the front
panel.
Some network modules also offer Hardware Bypass functionality, also known as Fail-to-Wire (FTW), for
interface pairs for supported applications. FTW is a physical layer bypass that allows interface port pairs to
be put in bypass mode so that the hardware forwards packets without software intervention.
The network modules are NOT hot-swappable.Note
Firepower 4100 supports the following network modules:
•Firepower 8-port 10G SPF+ Network Module single-wide (FPR4K-NM-8X10G)
The 10 Gigabit Ethernet network module ports are numbered from top to bottom, left to right. This
network module is NEBS-compliant.
•Firepower 4-port 40G QSPF Network Module single-wide (FPR4K-NM-4X40G)
The 40 Gigabit Ethernet network module ports are numbered left to right. This network module is
NEBS-compliant.
•Firepower 2-port 40G FTW Network Module single-wide (FPR-NM-2X40G-F)
The 40 Gigabit Ethernet network module ports are numbered left to right.
•Firepower 6-port 10G Short Reach FTW Network Module single-wide (FPR-NM-6X10SR-F)
The 10 Gigabit Ethernet network module ports are numbered from top to bottom, left to right.
•Firepower 6-port 10G Long Reach FTW Network Module single-wide (FPR-NM-6X10LR-F)
The 10 Gigabit Ethernet network module ports are numbered from top to bottom, left to right.
•Firepower 6-port 1G SX Fiber FTW Network Module single-wide (FPR-NM-6X1SX-F)
The 1 Gigabit Ethernet network module ports are numbered from top to bottom, left to right.
•Firepower 8-port 1G 1000Base-T FTW Network Module single-wide ( FPR-NM-8X1G-F)
The 1 Gigabit Ethernet network module ports are numbered from top to bottom, left to right. This network
module is NEBS-compliant.
For More Information
•See Nonhardware (FTW) Bypass Network Modules, on page 10 for the location and description
of the LEDs for the nonhardware bypass network modules.
•See Hardware Bypass (FTW) Network Modules, on page 12 for the location and description of
the LEDs, and the port configurations for the hardware bypass network modules.
•See Remove and Replace the Network Module, on page 59 for the procedure for removing and
replacing network modules.
Cisco Firepower 4100 Series Hardware Installation Guide
9
Overview
Network Modules

Nonhardware (FTW) Bypass Network Modules
The Firepower 4100 supports two nonhardware bypass modules, the 10G and the 40G.
The following figure shows the front panel view of the 10G network module.
Figure 7: Firepower Network Module 10G
Ethernet X/1
2Captive screw/handle1
Ethernet X/5
4
Ethernet X/3
3
Ethernet X/2
6
Ethernet X/7
5
Ethernet X/6
8
Ethernet X/4
7
Network activity LEDs
•Unlit –No connection or port
is not in use.
•Solid amber –No link or
network failure.
•Solid green –Link up.
•Blinking green –Network
activity.
10
Ethernet X/8
9
Cisco Firepower 4100 Series Hardware Installation Guide
10
Overview
Nonhardware (FTW) Bypass Network Modules

You can fit four copper SFPs in either the top row of ports or the bottom row of ports. Both rows cannot
be populated at the same time, because the SFP ports are too close together for the copper SFPs to fit on
both the top and the bottom row at the same time. For a list of copper SFPS, see Supported SFP/SFP+
Transceivers, on page 21.
Note
The following figure shows the front panel view of the 40G network module.
Figure 8: Firepower Network Module 40G
Network activity LEDs
•Unlit –No connection or port
is not in use.
•Solid amber –No link or
network failure.
•Solid green –Link up.
•Blinking green –Network
activity.
2Captive screw/handle1
Ethernet X/2
4
Ethernet X/1
3
Ethernet X/4
6
Ethernet X/3
5
For More Information
•See Hardware Bypass (FTW) Network Modules, on page 12 for the location and description of
the LEDs, and the port configurations for the hardware bypass network modules.
•See Remove and Replace the Network Module, on page 59 for the procedure for removing and
replacing network modules.
Cisco Firepower 4100 Series Hardware Installation Guide
11
Overview
Nonhardware (FTW) Bypass Network Modules

Hardware Bypass (FTW) Network Modules
Fail-to-Wire (FTW) is a physical layer (Layer 1) bypass that allows paired interfaces to go into bypass mode
so that the hardware forwards packets between these port pairs without software intervention. FTW provides
network connectivity when there are software or hardware failures. Hardware bypass is useful on ports where
the Firepower security appliance is only monitoring or logging traffic. The hardware bypass network modules
have an optical switch that is capable of connecting the two ports when needed.
The FTW network modules have built-in SFPs.
Hardware bypass is supported only on a fixed set of ports. You can pair Port 1 with Port 2, Port 3 with Port
4, but you cannot pair Port 1 with Port 4 for example.
Hardware bypass is only supported in inline mode. Also, hardware bypass support depends on your
software application.
Note
When switching from normal operation to hardware bypass or from hardware bypass back to normal
operation, traffic may be interrupted for several seconds. A number of factors can affect the length of the
interruption; for example, copper port autonegotiation; behavior of the optical link partner such as how it
handles link faults and debounce timing; spanning tree protocol convergence; dynamic routing protocol
convergence; and so on. During this time, you may experience dropped connections.
Note
There are three configuration options for hardware bypass network modules:
•Passive interfaces—Connection to a single port.
For each network segment you want to monitor passively, connect the cables to one interface. This is
how the non FTW network modules operate.
•Inline interfaces—Connection to any two like ports (10G to 10G for example) on one network module,
across network modules, or fixed ports.
For each network segment you want to monitor inline, connect the cables to pairs of interfaces.
•Inline with FTW interfaces—Connection of an FTW paired set.
For each network segment that you want to configure inline with fail-open, connect the cables to the
paired interface set.
For the 40G network module, you connect the two ports to form a paired set. For the 1/10G network
modules, you connect the top port to the bottom port to form an FTW paired set. This allows traffic to
flow even if the Firepower security appliance fails or loses power.
If you have a inline interface set with a mix of FTW-capable and non FTW-capable interfaces, you cannot
enable hardware bypass on this inline interface set. You can only enable hardware bypass on an inline
interface set if all the pairs in the inline set are valid FTW pairs.
Note
Cisco Firepower 4100 Series Hardware Installation Guide
12
Overview
Hardware Bypass (FTW) Network Modules

The following figure shows the front panel view of the 1G FTW network module. Pair ports 1 and 2, 3 and
4, 5 and 6, and 7 and 8 to form hardware bypass paired sets.
Figure 9: Firepower Network Module 1G with Hardware Bypass
Eight Network activity LEDs
•Left LED –Solid green
indicates network activity
when a 10M/100M/1G
connection is made.
•Right LED –Not in use at
this time.
2Captive screw/handle1
Ethernet X/2
Ports 3 and 4 are paired together to
form a hardware bypass pair. LED
B2 applies to this paired port.
4
Ethernet X/1
Ports 1 and 2 are paired together
to form a hardware bypass pair.
LED B1 applies to this paired
port.
3
Ethernet X/2
Ports 7 and 8 are paired together to
form a hardware bypass pair. LED
B4 applies to this paired port.
6
Ethernet X/2
Ports 5 and 6 are paired together
to form a hardware bypass pair.
LED B3 applies to this paired
port.
5
Cisco Firepower 4100 Series Hardware Installation Guide
13
Overview
Hardware Bypass (FTW) Network Modules

Bypass LEDs B1 through B4
•Solid green –In Standby
mode.
•Blinking amber –Port is in
hardware bypass mode,
failure event.
•Solid amber –Port is in
hardware bypass mode,
forced.
The following figure shows the front panel view of 40G FTW network module. Pair the two ports to create
a hardware bypass paired set.
Figure 10: Firepower Network Module 40G with Hardware Bypass
Ethernet X/1
Ports 1 and 2 are paired together to
form a hardware bypass pair.
2Captive screw/handle1
Ethernet X/2
Ports 1 and 2 are paired together to
form a hardware bypass pair.
4Bypass LED BP
•Solid green –In Standby
mode.
•Blinking amber –Port is in
hardware bypass mode,
failure event.
•Solid amber –Port is in
hardware bypass mode,
forced.
3
Cisco Firepower 4100 Series Hardware Installation Guide
14
Overview
Hardware Bypass (FTW) Network Modules

Network activity LEDs
•Solid amber –No
connection, or port is not in
use, or no link or network
failure.
•Solid green –Link up, no
network activity.
•Blinking green –Network
activity.
5
The following figure shows the front panel view of the 1G SX, 10G SR, and 10G LR FTW network module.
Pair ports 1 and 2, 3 and 4, and 5 and 6 to form hardware bypass paired sets.
Figure 11: Firepower Network Module 1G SX /10G SR/10G LR with Hardware Bypass
Six Network activity LEDs
•Solid amber –No connection,
or port is not in use, or no
link or network failure.
•Solid green –Link up, no
network activity.
•Blinking green –Network
activity.
2Captive screw/handle1
Cisco Firepower 4100 Series Hardware Installation Guide
15
Overview
Hardware Bypass (FTW) Network Modules

Ethernet X/1 (top port)
Ethernet X/2 (bottom port)
Ports 1 and 2 are paired together to
form a hardware bypass pair.
4Bypass LEDs B1 through B3
•Solid green –In Standby
mode.
•Blinking amber –Port is in
hardware bypass mode,
failure event.
•Solid amber –Port is in
hardware bypass mode,
forced.
3
Ethernet X/5 (top port)
Ethernet X/6 (bottom port)
Ports 5 and 6 are paired together to
form a hardware bypass pair.
6
Ethernet X/3 (top port)
Ethernet X/4 (bottom port)
Ports 3 and 4 are paired together
to form a hardware bypass pair.
5
1G SX/10G SR/10G LR Network Module Insertion Loss
The 1G SX /10G SR/10G LR network module has the following insertion loss measurements. Insertion loss
measurements help you to troubleshoot the network by verifying cable installation and performance.
Table 1: 1G SX Network Module (FPR-NM-6X1SX-F)
MaximumTypicalOperating Mode
1.4 dB
1.7 dB
0.9 dB
1.2 dB
Normal
Hardware bypass
Insertion loss
Cable Distance
Half the distance
specified by the
IEEE standard.
Note
Modal Bandwidth
(MHz/km
Core Diameter (microns)
110 m
137 m
250 m
275 m
500 m
160 (FDDI)
200(OM1)
400
500 (OM2)
2000 (OM3)
62.5
62.5
50
50
50
Cable and operating
distance
Table 2: 10G SR Network Module (FPR-NM-6X10SR-F)
MaximumTypicalOperating Mode
Cisco Firepower 4100 Series Hardware Installation Guide
16
Overview
Hardware Bypass (FTW) Network Modules