Cisco Firepower 9300 Manual

Cisco Firepower 9300 Hardware Installation Guide
First Published: 2015-07-16
Last Modified: 2018-11-14
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of
the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.
Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com
go trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any
other company. (1721R)
©2015-2018 Cisco Systems, Inc. All rights reserved.

CONTENTS
Overview 1
CHAPTER 1
Features 1
Chassis Components 4
Deployment Options 5
Package Contents 6
Serial Number Location 7
Front Panel 8
Rear Panel 9
Supervisor 10
Security Modules 12
Network Modules 14
10-G Network Module 14
40-G Network Module 15
100-G Network Module (Two Ports Single Wide) 16
100-G Network Module (Four Ports Single Wide) 17
100-G Network Module (Double Wide) 18
Hardware Bypass Network Modules 19
40-G Network Module with Hardware Bypass 20
10-G SR/10-G LR Network Module with Hardware Bypass 22
Power Supply Modules 24
Fan Modules 26
Supported SFP/SFP+ and QSFP Transceivers 26
Hardware Specifications 29
Product ID Numbers 30
Power Cord Specifications 33
Cisco Firepower 9300 Hardware Installation Guide
iii

Installation Preparation 39
CHAPTER 2
Installation Warnings 39
Safety Recommendations 41
Maintain Safety with Electricity 42
Prevent ESD Damage 42
Site Environment 43
Site Considerations 43
Power Supply Considerations 43
Rack Configuration Considerations 44
Mount and Connect 45
CHAPTER 3
Unpack and Inspect the Chassis 45
Rack-Mount the Chassis 46
Ground the Chassis 50
Install the FIPS Opacity Shield 52
Connect Cables, Turn on Power, and Verify Connectivity 56
Maintenance and Upgrade 59
CHAPTER 4
Remove and Replace the Supervisor 59
Remove and Replace the Security Module 60
Remove and Replace the SSD 61
Remove and Replace the Single-Wide Network Module 63
Remove and Replace the Double-Wide Network Module 66
Remove and Replace the Power Supply Module 69
Connect the DC Power Supply Module 71
Connect the HVDC Power Supply Module 72
Remove and Replace the Fan Module 74
Cisco Firepower 9300 Hardware Installation Guide
iv
Contents

CHAPTER 1
Overview
•Features , on page 1
•Chassis Components, on page 4
•Deployment Options, on page 5
•Package Contents, on page 6
•Serial Number Location, on page 7
•Front Panel, on page 8
•Rear Panel, on page 9
•Supervisor, on page 10
•Security Modules, on page 12
•Network Modules, on page 14
•Hardware Bypass Network Modules, on page 19
•Power Supply Modules, on page 24
•Fan Modules, on page 26
•Supported SFP/SFP+ and QSFP Transceivers, on page 26
•Hardware Specifications, on page 29
•Product ID Numbers, on page 30
•Power Cord Specifications, on page 33
Features
The Cisco Firepower 9300 security appliance is a next generation network and content security platform. Its
modular standalone chassis offers high-performance and flexible I/O options, which enable it to run multiple
security services simultaneously. See Product ID Numbers, on page 30 for a list of the product IDs (PIDs)
associated with the Firepower 9300.
The Firepower 9300 supports the following software:
• Cisco Firepower Threat Defense
• Cisco Firepower eXtensible Operating System (FXOS)
• Cisco ASA
Cisco Firepower 9300 Hardware Installation Guide
1

The Firepower 9300 is certified for Common Criteria (CC) and Federal Information Processing Standards
(FIPS). See "Security Certifications Compliance" in the Cisco FXOS CLI Configuration Guide for the procedure
for enabling these modes using the CLI. See "Security Certifications Compliance" in the Cisco FXOS Firepower
Chassis Manager Configuration Guide for information for enabling these modes using the Firepower Chassis
Manager.
Note
The following figure shows a fully populated Firepower 9300.
Figure 1: Firepower 9300
See the Cisco Interactive Library for a video that displays the features and components of the Firepower 9300.
The following table lists the hardware features of the Firepower 9300.
Table 1: Firepower 9300 Features
DescriptionFeature
3 RUForm factor
Yes
Mount rails included (4-post EIA-310-D rack) with span between front and rear rails
of 24 to 36 in.
Rack mount
Front to rear
Cold aisle to hot aisle
Airflow
Cisco Firepower 9000 Supervisor with eight 10-Gigabit Ethernet ports and 2 network
module slots for I/O expansion
Supervisor
3Security module
slots
2
Located in the Supervisor
Network module
slots
Cisco Firepower 9300 Hardware Installation Guide
2
Overview
Features

DescriptionFeature
Cisco Firepower 9000 Security Module 24 with two SSDs in a RAID 1 configuration
Cisco Firepower 9000 Security Module 36 with two SSDs in a RAID 1 configuration
Cisco Firepower 9000 Security Module 44 with two SSDs in a RAID 1 configuration
Security modules
8-port 10-Gigabit Ethernet SFP+
4-port 40-Gigabit Ethernet QSFP+
2-port 100-Gigabit Ethernet QSFP28 (double-wide, occupies both network module
slots)
2-port 100-Gigabit Ethernet QSFP28
4-port 100-Gigabit Ethernet QSFP28
2-port 40-Gigabit Ethernet SFP+ fail-to-wire
6-port 10-Gigabit Ethernet SR/LR fiber fail-to-wire
You can deploy the Firepower 9300 as a dedicated threat sensor with
fail-to-wire network modules.
Note
Network modules
256-GB DDR4 DRAM per security moduleMemory
Up to twenty-four 10-Gigabit Ethernet (SFP+) interfaces; up to eight 40-Gigabit
Ethernet (QSFP+) interfaces with 2 network modules; up to four 100-Gigabit Ethernet
(SFP+) interfaces
Maximum number
of interfaces
One Gigabit Ethernet port on the Supervisor
Supports 1-G fiber or copper SFPs
Management port
One RJ-45 consoleSerial port
One USB 2.0 Type AUSB port
Yes
Displays serial number
Pullout asset card
Yes
On rear panel
Grounding lug
YesLocator beacon
Yes
On rear panel
The initial Firepower 9300 chassis does not have a power switch.
Note
Power switch
Two
On rear panel
Power supply slots
Cisco Firepower 9300 Hardware Installation Guide
3
Overview
Features

DescriptionFeature
AC, DC, and HVDC
Do not mix power supply types or wattage.
Note
Power supply types
Yes 1 + 1Redundant power
Four (hot-swappable)
On rear panel
Fan slots
Up to 2.4 TB per chassis (800 GB per security module in RAID 1 configuration)Storage
Chassis Components
The Firepower 9300 chassis contains the following components:
• Firepower 9300 Supervisor—Chassis supervisor module
• Management port
• RJ-45 console port
• USB Type A port
• Eight ports for 1- or 10-Gigabit Ethernet SFPs (fiber and copper)
• Firepower 9300 Security Module—Up to three security modules
• Firepower Network Module—Two single-wide network modules or one double-wide network module
• Two power supply modules (AC or DC)
• Four fan modules
Power Switch
The initial Firepower 9300 AC chassis has no external power switch. You reset the Firepower 9300 using
CLI commands. To physically power cycle the 9300, you must unplug the power cord and then plug the
power cord back in.
Note
After removing power from the chassis either by moving the power switch to OFF or unplugging the
power cord, wait at least 10 seconds before turning power back ON.
Note
The Firepower 9300 chassis has a standby power switch at the rear of the chassis. It controls both power
supply modules. You must shut down the software applications gracefully before turning the switch to
OFF.
Cisco Firepower 9300 Hardware Installation Guide
4
Overview
Chassis Components

Turning the switch to OFF turns off the main power to the Supervisor and the security modules regardless
of the software status, which can result in the loss of any data in transit and the corruption of data on the
SSDs. You must shut down the software applications gracefully before turning the switch to OFF.
Warning
Graceful Shutdown of the Chassis
You can gracefully shut down the chassis from either the CLI or Chassis Manager.
See the FXOS Configuration Guide for the procedure to shut down the chassis from the CLI. The graceful
shutdown usually takes as little as a few seconds to as long as three minutes. When the System Halted
message appears, you can move the power switch on the rear of the chassis to OFF.
See Powering Off the FXOS Chassis for the procedure to shut down the chassis from the Chassis Manager.
After the shutdown is completed, you can move the power switch on the rear of the chassis to OFF.
When you shut down the chassis, the security modules are automatically shut down.
Graceful Shutdown of the Security Modules
You can shut down the security modules individually from the CLI, the Chassis Manager, or you can
use the power switch on the front of each security module. Push the power button briefly on the front
panel of each security module. When the power button changes to amber, you can move the power switch
on the rear of the chassis to OFF.
Shut the security modules down individually when you are replacing a security module.
You must push the power button on every security module installed in the 9300 chassis. You can have
up to 3 security modules installed in the chassis.
Note
See the FXOS Configuration Guide for the procedure to shut down the security modules gracefully using
CLI commands from the Supervisor. When you see Oper Power: off for all slots, you can move the
power switch on the rear of the chassis to OFF.
See Powering On/Off a Security Module/Engine for the procedure to shut down the security module
from the Chassis Manager. After the shutdown is complete, you can move the power switch on the rear
of the chassis to OFF.
The shutdown commands are first available in Firepower FXOS version 2.0.1. See the FXOS Configuration
Guide for more information on using these commands.
Note
Deployment Options
Here are some examples of how you can deploy the Firepower 9300:
• At the core/aggregation layer of a three-tier data center in a high availability configuration.
• As a dedicated multifunction security service within converged infrastructure stacks (vBlock, FlexPod,
for example) at the access layer.
Cisco Firepower 9300 Hardware Installation Guide
5
Overview
Deployment Options

• As a high-performance data center security appliance between the WAN edge and data center core in an
high availability configuration.
• As a leaf that exclusively offers security functions in a spine/leaf data center design.
Package Contents
The following figure shows the package contents for the Firepower 9300. Note that the contents are subject
to change and your exact contents might contain additional or fewer items.
Figure 2: Firepower 9300 Package Contents
Blue console cable PC terminal adapter2Firepower 9300 chassis1
2 rack static rails
Adjusts to fit racks with a 24 in. to 36 in.
front-to-rear rail span
42 power cords (country specific)3
Four 10-32 retention nuts for
rack-mounting
6Four 10-32 x .5 in. screws used to attach
the rails to rack
5
10/100/1000BASE-T SFP transceiver8Four 10-32 x .75 in. Philips head screws
used to attach the chassis to the rack
7
Cisco Firepower 9300 Hardware Installation Guide
6
Overview
Package Contents