Cisco Firepower 9300 Manual

Cisco Firepower 9300 Hardware Installation Guide
First Published: 2015-07-16
Last Modified: 2018-11-14
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of
the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.
Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com
go trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any
other company. (1721R)
©2015-2018 Cisco Systems, Inc. All rights reserved.

CONTENTS
Overview 1
CHAPTER 1
Features 1
Chassis Components 4
Deployment Options 5
Package Contents 6
Serial Number Location 7
Front Panel 8
Rear Panel 9
Supervisor 10
Security Modules 12
Network Modules 14
10-G Network Module 14
40-G Network Module 15
100-G Network Module (Two Ports Single Wide) 16
100-G Network Module (Four Ports Single Wide) 17
100-G Network Module (Double Wide) 18
Hardware Bypass Network Modules 19
40-G Network Module with Hardware Bypass 20
10-G SR/10-G LR Network Module with Hardware Bypass 22
Power Supply Modules 24
Fan Modules 26
Supported SFP/SFP+ and QSFP Transceivers 26
Hardware Specifications 29
Product ID Numbers 30
Power Cord Specifications 33
Cisco Firepower 9300 Hardware Installation Guide
iii

Installation Preparation 39
CHAPTER 2
Installation Warnings 39
Safety Recommendations 41
Maintain Safety with Electricity 42
Prevent ESD Damage 42
Site Environment 43
Site Considerations 43
Power Supply Considerations 43
Rack Configuration Considerations 44
Mount and Connect 45
CHAPTER 3
Unpack and Inspect the Chassis 45
Rack-Mount the Chassis 46
Ground the Chassis 50
Install the FIPS Opacity Shield 52
Connect Cables, Turn on Power, and Verify Connectivity 56
Maintenance and Upgrade 59
CHAPTER 4
Remove and Replace the Supervisor 59
Remove and Replace the Security Module 60
Remove and Replace the SSD 61
Remove and Replace the Single-Wide Network Module 63
Remove and Replace the Double-Wide Network Module 66
Remove and Replace the Power Supply Module 69
Connect the DC Power Supply Module 71
Connect the HVDC Power Supply Module 72
Remove and Replace the Fan Module 74
Cisco Firepower 9300 Hardware Installation Guide
iv
Contents

CHAPTER 1
Overview
•Features , on page 1
•Chassis Components, on page 4
•Deployment Options, on page 5
•Package Contents, on page 6
•Serial Number Location, on page 7
•Front Panel, on page 8
•Rear Panel, on page 9
•Supervisor, on page 10
•Security Modules, on page 12
•Network Modules, on page 14
•Hardware Bypass Network Modules, on page 19
•Power Supply Modules, on page 24
•Fan Modules, on page 26
•Supported SFP/SFP+ and QSFP Transceivers, on page 26
•Hardware Specifications, on page 29
•Product ID Numbers, on page 30
•Power Cord Specifications, on page 33
Features
The Cisco Firepower 9300 security appliance is a next generation network and content security platform. Its
modular standalone chassis offers high-performance and flexible I/O options, which enable it to run multiple
security services simultaneously. See Product ID Numbers, on page 30 for a list of the product IDs (PIDs)
associated with the Firepower 9300.
The Firepower 9300 supports the following software:
• Cisco Firepower Threat Defense
• Cisco Firepower eXtensible Operating System (FXOS)
• Cisco ASA
Cisco Firepower 9300 Hardware Installation Guide
1

The Firepower 9300 is certified for Common Criteria (CC) and Federal Information Processing Standards
(FIPS). See "Security Certifications Compliance" in the Cisco FXOS CLI Configuration Guide for the procedure
for enabling these modes using the CLI. See "Security Certifications Compliance" in the Cisco FXOS Firepower
Chassis Manager Configuration Guide for information for enabling these modes using the Firepower Chassis
Manager.
Note
The following figure shows a fully populated Firepower 9300.
Figure 1: Firepower 9300
See the Cisco Interactive Library for a video that displays the features and components of the Firepower 9300.
The following table lists the hardware features of the Firepower 9300.
Table 1: Firepower 9300 Features
DescriptionFeature
3 RUForm factor
Yes
Mount rails included (4-post EIA-310-D rack) with span between front and rear rails
of 24 to 36 in.
Rack mount
Front to rear
Cold aisle to hot aisle
Airflow
Cisco Firepower 9000 Supervisor with eight 10-Gigabit Ethernet ports and 2 network
module slots for I/O expansion
Supervisor
3Security module
slots
2
Located in the Supervisor
Network module
slots
Cisco Firepower 9300 Hardware Installation Guide
2
Overview
Features

DescriptionFeature
Cisco Firepower 9000 Security Module 24 with two SSDs in a RAID 1 configuration
Cisco Firepower 9000 Security Module 36 with two SSDs in a RAID 1 configuration
Cisco Firepower 9000 Security Module 44 with two SSDs in a RAID 1 configuration
Security modules
8-port 10-Gigabit Ethernet SFP+
4-port 40-Gigabit Ethernet QSFP+
2-port 100-Gigabit Ethernet QSFP28 (double-wide, occupies both network module
slots)
2-port 100-Gigabit Ethernet QSFP28
4-port 100-Gigabit Ethernet QSFP28
2-port 40-Gigabit Ethernet SFP+ fail-to-wire
6-port 10-Gigabit Ethernet SR/LR fiber fail-to-wire
You can deploy the Firepower 9300 as a dedicated threat sensor with
fail-to-wire network modules.
Note
Network modules
256-GB DDR4 DRAM per security moduleMemory
Up to twenty-four 10-Gigabit Ethernet (SFP+) interfaces; up to eight 40-Gigabit
Ethernet (QSFP+) interfaces with 2 network modules; up to four 100-Gigabit Ethernet
(SFP+) interfaces
Maximum number
of interfaces
One Gigabit Ethernet port on the Supervisor
Supports 1-G fiber or copper SFPs
Management port
One RJ-45 consoleSerial port
One USB 2.0 Type AUSB port
Yes
Displays serial number
Pullout asset card
Yes
On rear panel
Grounding lug
YesLocator beacon
Yes
On rear panel
The initial Firepower 9300 chassis does not have a power switch.
Note
Power switch
Two
On rear panel
Power supply slots
Cisco Firepower 9300 Hardware Installation Guide
3
Overview
Features

DescriptionFeature
AC, DC, and HVDC
Do not mix power supply types or wattage.
Note
Power supply types
Yes 1 + 1Redundant power
Four (hot-swappable)
On rear panel
Fan slots
Up to 2.4 TB per chassis (800 GB per security module in RAID 1 configuration)Storage
Chassis Components
The Firepower 9300 chassis contains the following components:
• Firepower 9300 Supervisor—Chassis supervisor module
• Management port
• RJ-45 console port
• USB Type A port
• Eight ports for 1- or 10-Gigabit Ethernet SFPs (fiber and copper)
• Firepower 9300 Security Module—Up to three security modules
• Firepower Network Module—Two single-wide network modules or one double-wide network module
• Two power supply modules (AC or DC)
• Four fan modules
Power Switch
The initial Firepower 9300 AC chassis has no external power switch. You reset the Firepower 9300 using
CLI commands. To physically power cycle the 9300, you must unplug the power cord and then plug the
power cord back in.
Note
After removing power from the chassis either by moving the power switch to OFF or unplugging the
power cord, wait at least 10 seconds before turning power back ON.
Note
The Firepower 9300 chassis has a standby power switch at the rear of the chassis. It controls both power
supply modules. You must shut down the software applications gracefully before turning the switch to
OFF.
Cisco Firepower 9300 Hardware Installation Guide
4
Overview
Chassis Components

Turning the switch to OFF turns off the main power to the Supervisor and the security modules regardless
of the software status, which can result in the loss of any data in transit and the corruption of data on the
SSDs. You must shut down the software applications gracefully before turning the switch to OFF.
Warning
Graceful Shutdown of the Chassis
You can gracefully shut down the chassis from either the CLI or Chassis Manager.
See the FXOS Configuration Guide for the procedure to shut down the chassis from the CLI. The graceful
shutdown usually takes as little as a few seconds to as long as three minutes. When the System Halted
message appears, you can move the power switch on the rear of the chassis to OFF.
See Powering Off the FXOS Chassis for the procedure to shut down the chassis from the Chassis Manager.
After the shutdown is completed, you can move the power switch on the rear of the chassis to OFF.
When you shut down the chassis, the security modules are automatically shut down.
Graceful Shutdown of the Security Modules
You can shut down the security modules individually from the CLI, the Chassis Manager, or you can
use the power switch on the front of each security module. Push the power button briefly on the front
panel of each security module. When the power button changes to amber, you can move the power switch
on the rear of the chassis to OFF.
Shut the security modules down individually when you are replacing a security module.
You must push the power button on every security module installed in the 9300 chassis. You can have
up to 3 security modules installed in the chassis.
Note
See the FXOS Configuration Guide for the procedure to shut down the security modules gracefully using
CLI commands from the Supervisor. When you see Oper Power: off for all slots, you can move the
power switch on the rear of the chassis to OFF.
See Powering On/Off a Security Module/Engine for the procedure to shut down the security module
from the Chassis Manager. After the shutdown is complete, you can move the power switch on the rear
of the chassis to OFF.
The shutdown commands are first available in Firepower FXOS version 2.0.1. See the FXOS Configuration
Guide for more information on using these commands.
Note
Deployment Options
Here are some examples of how you can deploy the Firepower 9300:
• At the core/aggregation layer of a three-tier data center in a high availability configuration.
• As a dedicated multifunction security service within converged infrastructure stacks (vBlock, FlexPod,
for example) at the access layer.
Cisco Firepower 9300 Hardware Installation Guide
5
Overview
Deployment Options

• As a high-performance data center security appliance between the WAN edge and data center core in an
high availability configuration.
• As a leaf that exclusively offers security functions in a spine/leaf data center design.
Package Contents
The following figure shows the package contents for the Firepower 9300. Note that the contents are subject
to change and your exact contents might contain additional or fewer items.
Figure 2: Firepower 9300 Package Contents
Blue console cable PC terminal adapter2Firepower 9300 chassis1
2 rack static rails
Adjusts to fit racks with a 24 in. to 36 in.
front-to-rear rail span
42 power cords (country specific)3
Four 10-32 retention nuts for
rack-mounting
6Four 10-32 x .5 in. screws used to attach
the rails to rack
5
10/100/1000BASE-T SFP transceiver8Four 10-32 x .75 in. Philips head screws
used to attach the chassis to the rack
7
Cisco Firepower 9300 Hardware Installation Guide
6
Overview
Package Contents

Two 10-32 x .375 in. screws used to attach
the ground lug
101 ground lug #6 AWG, 90 degree, #10 post
The ground lug ships with the
DC power version of the
Firepower 9300.
Note
9
Welcome to the Cisco Firepower 930011
Serial Number Location
The serial number for the Firepower 9300 chassis is located on the pullout asset card on the front panel, on
the side of the chassis, and on the Supervisor.
Figure 3: Serial Numbers on the 9300 Chassis
You can also view additional model information on the compliance label located on the bottom of the chassis.
Cisco Firepower 9300 Hardware Installation Guide
7
Overview
Serial Number Location

Figure 4: Compliance Label on the 9300 Chassis
For More Information
For the procedure to remove the Supervisor so that you can see the serial number, see Remove and Replace
the Supervisor, on page 59.
Front Panel
The following figure shows the front panel of the Firepower 9300.
Figure 5: Firepower 9300 Front Panel
Cisco Firepower 9300 Hardware Installation Guide
8
Overview
Front Panel

Security module 12Security module 31
1 Gigabit Ethernet management port4RJ-45 console port3
Eight 10 Gigabit Ethernet data ports
(Gigabit Ethernet 1/1 through 1/8)
62.0 USB port5
Network module 18Supervisor7
Security module 210Network module 29
Power supply module PSU-112Power supply module PSU-211
For More Information
• See Chassis Components, on page 4 for a list of all of the chassis components.
• See Supervisor, on page 10 for detailed information about the Supervisor.
• See Security Modules, on page 12 for detailed information about the security modules.
• See Network Modules, on page 14 for detailed information about the network modules.
• See Hardware Bypass Network Modules, on page 19 for detailed information about fail-to-wire
network modules
• See Power Supply Modules, on page 24 for detailed information about the power supply modules.
Rear Panel
The following figure shows the rear panel of the Firepower 9300.
Figure 6: Firepower 9300 Rear Panel
Power feed for PSU-12Power feed for PSU-21
Fan module FAN-14On/Off switch3
Cisco Firepower 9300 Hardware Installation Guide
9
Overview
Rear Panel

Fan module FAN-36Fan module FAN-25
Grounding lugFan module FAN-47
For More Information
• See Chassis Components, on page 4 for detailed information about the power switch.
• See Fan Modules, on page 26 for detailed information about the fan modules.
• See Power Supply Modules, on page 24 for detailed information about the power supply modules.
Supervisor
The Firepower 9300 contains a supervisor management I/O card called the Firepower 9300 Supervisor, which
is located on the front panel. The Supervisor provides chassis management and eight 1- or 10-G SFP+ interfaces,
and it directs traffic to/from the Firepower 9300 security modules.
Unless you are running FXOS software, if you change the SFP transceiver for the management interface, you
must reboot the Firepower 9300. FXOS then detects the new SFP module.
Note
The Supervisor has the following ports:
• RJ-45 console port
• One Gigabit Ethernet SFP management port
• USB 3.0 Type A port
• Eight ports that support 1- or 10-Gigabit Ethernet SFPs (fiber and copper) (Ethernet 1/1 through 1/8)
Figure 7: Firepower 9300 Supervisor Front Panel
Gigabit Ethernet management port2RJ-45 console port1
Cisco Firepower 9300 Hardware Installation Guide
10
Overview
Supervisor

8 SFP/SFP+ ports that support 1-G or 10-G
Ethernet (copper or fiber)
4USB Type A port3
Management LED:
• Off—No connection or port is not in
use.
• Amber—No link or network failure.
• Green—Link up.
• Green, flashing—Network activity.
6Locator/Beacon (push button):
• Off—Locate is off.
• Blue—Locate is on.
5
ACT LED
This LED is not supported; reserved for
future use.
8Power LED:
• Off—No power.
• Green—System has power.
7
Network port status LEDs:
• Off—No connection or port is not in
use.
• Amber—No link or network failure.
• Green—Network activity up to 1 G.
• Green, flashing—Network activity
faster than 1 G.
10SYS LED:
• Off—System is not booting up yet.
• Green, flashing—Power-up
diagnostics is complete and the
system is booting up.
• Green—System has booted up
successfully.
• Amber—Power-up diagnostics have
failed.
• Amber, flashing—Alarm; power-up
diagnostics are running.
9
RJ-45 Console Port
The Firepower 9300 has a standard RJ-45 console port. You can use the CLI to configure your Firepower
9300 through the RJ-45 serial console port by using a terminal server or a terminal emulation program
on a computer.
The RJ-45 (8P8C) port supports RS-232 signaling to an internal UART controller. The console port does
not have any hardware flow control, and does not support a remote dial-in modem. The baud rate is 9600.
You can use the standard cable found in your accessory kit to convert the RJ-45 to DB-9 if necessary.
Type A USB Port
You can use the external USB Type A port to attach a data storage device. The external USB drive
identifier is disk1:. The USB Type A port supports the following:
• Hot swapping
• USB drive formatted with FAT32
• Boot kick-start image from the Supervisor ROMMON for discovery recovery purposes
Cisco Firepower 9300 Hardware Installation Guide
11
Overview
Supervisor

• Copy files to and from workspace:/ and volatile:/ within local-mgmt. The most relevant files are:
• Core files
• Ethanalyzer packet captures
• Tech-support files
• Security module log files
• Platform bundle image upload using download image usbA:
The USB Type A port does not support Cisco Secure Package (CSP) image upload.
Network Ports
The Firepower 9300 chassis has eight ports for 1-G or 10-G SFPs (fiber or copper). They are numbered
from left to right starting with 1 and are named Ethernet 1/1 through Ethernet 1/8.
Each port has LEDs that represent link/activity status.
Management Port
The Firepower 9300 chassis has a management port that supports 1-G fiber or copper SFPs.
Security Modules
The Firepower 9300 has three slots for security modules. The security modules are hot-swappable.
Figure 8: Firepower 9300 Security Module Front Panel
Security module ejector handle2Paper tab for server name or serial number1
SSD bay 14Ejector handle captive screw3
Cisco Firepower 9300 Hardware Installation Guide
12
Overview
Security Modules

Power button and LED
• Off—No power.
• Green—System has power.
• Amber—Standby power.
6SSD bay 25
Security module health LED
• Off—Power off.
• Green—Normal operation.
• Amber—Minor error.
• Amber, flashing—Critical error.
8Network link status LED
• Off—No network connection.
• Green—At least one network is up.
• Green, flashing—Network activity
faster than 1 G.
7
Locator push button and LED
• Off—Locate is off.
• Blue—Locate is on.
10Reset button access9
There are three types of security modules:
• SM-24—24-physical core CPU security module (NEBS ready)
• SM-36—36-physical core CPU high performance security module
• SM-44—44-physical core CPU high performance security module (NEBS ready)
The SM-24, SM-36, and SM-44 have the following features:
• SM-24 and SM-36 are supported in FXOS 1.1.1 and later. SM-44 is supported in FXOS 2.0.1 and later,
and requires ASA 9.6(2) or FTD 6.1.
• 256 GB of DDR4 memory
• Two 800-GB SSDs
The security module ships with two 800-GB SSDs in a default RAID 1 configuration that provides storage
support. There are two LEDs on the front of the SSDs.
• One security acceleration module
All security module components except the SSDs are fixed. You cannot configure or remove any of the other
components.
Note
If you replace a security module with a new security module, you must decommission the old security module.
See the "Security Module/Engine Management" chapter in the Cisco FXOS Firepower Chassis Manager
Configuration Guide for the instructions. See Remove and Replace the Security Module for the procedure for
replacing security modules.
Caution
Cisco Firepower 9300 Hardware Installation Guide
13
Overview
Security Modules

Network Modules
The Firepower 9300 contains two network module slots that provide optical or electrical network interfaces.
Network modules are optional, removable I/O modules that provide either additional ports or different interface
types (1/10/40/100 G).
The Firepower network modules plug into the chassis on the front panel. You can also remove the divider
between the two network module slots and insert a double-wide network module.
For More Information
• See 10-G Network Module , on page 14 for a description of the 10-G network module.
• See 40-G Network Module , on page 15 for a description of the 40-G network module.
• See 100-G Network Module (Two Ports Single Wide), on page 16 for a description of the 100-G
two-port single-wide network module.
• See 100-G Network Module (Four Ports Single Wide), on page 17
• See 100-G Network Module (Double Wide) , on page 18 for a description of the 100-G double-wide
network module.
• See Supported SFP/SFP+ and QSFP Transceivers, on page 26 for a list of supported SFPs.
• See Remove and Replace the Single-Wide Network Module, on page 63 for the procedure for
removing and replacing single-wide network modules.
• See Remove and Replace the Double-Wide Network Module, on page 66 for the procedure for
removing and replacing double-wide network modules.
10-G Network Module
The following figure shows the front panel of the 10-G network module (FPR9K-NM-8X10G). The
FPR9K-NM-8X10G is a single-wide module that supports hot swapping. The eight ports are numbered from
top to bottom, left to right.
The FPR9K-NM-8X10G is NEBS-compliant.
Note
You can fit four copper SFPs in either the top row of ports or the bottom row of ports. Both rows cannot be
populated at the same time, because of the port row spacing.
Note
Cisco Firepower 9300 Hardware Installation Guide
14
Overview
Network Modules

Figure 9: FPR9K-NM-8X10G
Ethernet X/1
2Captive screw/handle1
Ethernet X/5
4
Ethernet X/3
3
Ethernet X/2
6
Ethernet X/7
5
Ethernet X/6
8
Ethernet X/4
7
Network activity LEDs
• Off—No connection or port is not in
use.
• Amber—No link or network failure.
• Green—Link up.
• Green, flashing—Network activity.
10
Ethernet X/8
9
For More Information
• For a list of copper SFPs, see Supported SFP/SFP+ and QSFP Transceivers, on page 26.
40-G Network Module
The following figure shows the front panel of the 40-G network module (FPR9K-NM-4X40G.) The
FPR9K-NM-4X40G is a single-wide module that supports hot swapping. The four ports are numbered left to
right.
The FPR9K-NM-4X40G is NEBS-compliant.
Note
Cisco Firepower 9300 Hardware Installation Guide
15
Overview
40-G Network Module

Figure 10: FPR9K-NM-4X40G
Network activity LEDs
• Off—No connection or port is not in
use.
• Amber—No link or network failure.
• Green—Link up.
• Green, flashing—Network activity.
2Captive screw/handle1
Ethernet X/2
4
Ethernet X/1
3
Ethernet X/4
6
Ethernet X/3
5
100-G Network Module (Two Ports Single Wide)
The following figure shows the front panel of the 100-G network module (FPRK9-NM-2X100G). The
FPRK9-NM-2X100G is a single-wide module that supports hot swapping. The two ports are numbered left
to right.
You must upgrade your Firepower 9300 to firmware package 1.0.16 or later and have FXOS 2.3.2 or later
installed to support this network module.
Note
Cisco Firepower 9300 Hardware Installation Guide
16
Overview
100-G Network Module (Two Ports Single Wide)