Cisco EXPLORER 3100 User manual

Overview
•Features, on page 1
•Deployment Options, on page 4
•Package Contents, on page 5
•Serial Number and Digital Documentation Portal QR Code, on page 6
•Front Panel, on page 8
•Front Panel LEDs, on page 11
•Rear Panel, on page 13
•8-Port 1/10/25-Gb Network Module, on page 15
•4-Port 40-Gb Network Module, on page 17
•8-Port 10/100/1000Base-T Network Module with Hardware Bypass, on page 19
•6-Port 1-Gb SX/10-Gb SR/10-Gb LR/25-Gb SR/25-Gb LR Network Module with Hardware Bypass ,
on page 21
•Power Supply Module, on page 24
•Dual Fan Modules, on page 26
•SSDs, on page 27
•Supported SFP/SFP+/QSFP+ Transceivers , on page 29
•Hardware Specifications, on page 32
•Product ID Numbers, on page 33
•Power Cord Specifications, on page 35
Features
The Cisco Secure Firewall 3100 is a standalone modular security services platform that includes the Secure
Firewall 3105, 3110, 3120, 3130, and 3140.
See Product ID Numbers, on page 33 for a list of the product IDs (PIDs) associated with the 3100 series.
The Secure Firewall 3100 supports Cisco Firepower Threat Defense and Cisco ASA software. See the Cisco
Secure Firewall Threat Defense Compatibility Guide and the Cisco Secure Firewall ASA Compatibility guide,
which provide Cisco software and hardware compatibility, including operating system and hosting environment
requirements, for each supported version.
Overview
1

The Secure Firewall 3105 is first supported in Cisco Firepower Threat Defense 7.3 and Cisco ASA 9.19 and
later.
Note
The following figure shows the Secure Firewall 3100.
Figure 1: Secure Firewall 3100
The following table lists the features for the Secure Firewall 3100.
Table 1: Secure Firewall 3100 Features
31403130312031103105Feature
1 RU
Fits a standard 19-inch (48.3-cm) square-hole rack
Form factor
(Optional) Two 2-post mount brackets and/or two slide rails
4-post Electronic Industries Association (EIA)-310-D rack
We recommend that you order the slide rails for your Secure Firewall 3100.
Note
Rack mount
Front to rear (I/O side to non-I/O side)
Cold aisle to hot aisle
Airflow
AMD 7452AMD 7352AMD 7282
AMD 7272Processor
32241612Core count
2.35 GHz2.3 GHz2.8 GHz2.9 GHzCore clock
4 x 64 GB4 x 32 GB2 x 64 GB2 x 32 GBSystem memory
One 1/10-Gb small form-factor pluggable (SFP) portManagement
port
One RJ-45 serial portConsole port
USB 3.1 Type A (900 mA) portUSB port
8 SFP+ fixed ports and 8 copper RJ-45 ports
Named Ethernet 1/1 through 1/16
Network ports
Overview
2
Overview
Features

31403130312031103105Feature
Eight 1/10/25-Gb SFP ports
Four 40-Gb QSFP ports
Network module
ports
One
Hot-swapping of identical modules is supported, but if you replace a network
module with another type, you must reboot the system so that the new network
module is recognized.
Note
Network module
slots
• 8-port 1Gb/10Gb/25Gb SFP+
(FPR3K-XNM-8X25G)
• 8-port 1Gb/10Gb SFP+
(FPR3K-XNM-8X10G)
• 4-port 40-Gb QSFP+
(FPR3K-XNM-4X40G)
• 6-port 1-Gb SFP SX
multimode hardware
bypass(FPR3K-XNM-6X1SXF)
• 6-port 10-Gb SFP SR
multimode hardware bypass
(FPR3K-XNM-6X10SRF)
• 6-port 10-Gb SFP LR single
mode hardware bypass
(FPR3K-XNM-6X10LRF)
• 6-port 25-Gb SFP SR
multimode hardware bypass
(FPR3K-XNM-6X25SRF)
• 6-port 25-Gb SFP LR single
mode hardware bypass
(FPR3K-XNM-6X25LRF)
• 8-port 10/100/1000Base-T
hardware bypass
(FPR3K-XNM-8X1GF)
•8-port 1Gb/10Gb SFP+ (FPR3K-XNM-8X10G)
•6-port 1-Gb SFP SX multimode hardware bypass
(FPR3K-XNM-6X1SXF)
• 6-port 10-Gb SFP SR multimode hardware
bypass (FPR3K-XNM-6X10SRF)
• 6-port 10-Gb SFP LR single mode hardware
bypass (FPR3K-XNM-6X10LRF)
• 8-port 10/100/1000Base-T hardware bypass
(FPR3K-XNM-8X1GF)
Network
modules
Two power supply slots
Ships with two 400-W AC power
supply modules
Hot-swappable
Two power supply slots
Ships with one 400-W AC power supply module
Hot-swappable
AC power
supply
Yes (optional)
Hot-swappable
DC power
supply
Overview
3
Overview
Features

31403130312031103105Feature
Yes
Ships with two power
supplies.
Note
No
Yes, if you order an extra power supply.
Note
Redundant
power
Two dual fan module slots (3 + 1)
The dual fan modules are hot-swappable.
Note
Fans
Two Nonvolatile Memory Express (NVMe) SSD slots
Ships with one 900-GB SSD installed in slot 1. You can order a second RAID1 SSD for
slot 2. The RAID1 SSD is preconfigured for RAID1.
Slot 2 is reserved for the optional software RAID1 configuration.
Note
Hot-swapping is supported with 2 SSDs. However, you must enter a CLI
command to remove one disk from the RAID before hot swapping. See the
CLI configuration guide for your software for the procedure.
Note
Storage
Displays the serial number and a QR code that points to the low touch provisioning (LTP)
guide.
Pullout asset
card
On rear panelGrounding lug
On rear panelPower switch
Resets the system to factory default without requiring serial console access
The reset button is recessed. Press with a pin and hold longer than 5 seconds
to set the system back to the factory default.
Note
Reset button
Deployment Options
Here are some examples of how you can deploy the Secure Firewall 3100:
• As a firewall:
• At the enterprise internet edge in a redundant configuration
• At branch offices in either a high availability pair or standalone
• At data centers in a high availability pair or clustered, which serves the needs of smaller enterprises
•As a device that provides additional application control, URL filtering, or IPS/threat-centered capabilities:
• Behind an enterprise internet edge firewall in an inline configuration or as a standalone (requires
hardware fail-open network module support)
• Deployed passively off a SPAN port on a switch or a tap on a network, or standalone
Overview
4
Overview
Deployment Options

• As a branch native SD-WAN solution that offers remote deployment and is managed over a 4G LTE
• As a VPN device:
• For remote access VPN
• For site-to-site VPN
Package Contents
The following figure shows the package contents for the Secure Firewall 3100. The contents are subject to
change and your exact contents contain additional or fewer items depending on whether you order the optional
parts. See Product ID Numbers for a list of PIDs associated with the package contents.
There are two sets of four screws that you can use to secure the chassis to your rack. Chose the screws that
fit your rack.
Note
Figure 2: Secure Firewall 3100 Package Contents
Console cable RJ-45 to DB-9 (part number
72-3383-01)
2Secure Firewall 3100 chassis1
Overview
5
Overview
Package Contents

SFP transceiver
(Optional; in package if ordered)
4One or two power cords (country-specific)
See Power Cord Specifications, on page 35 for
a list of supported power cords.
3
Cable management bracket kit (part number
69-100376-01)
• Two cable management brackets (part
number 700-128334-01)
• Four 8-32 x 0.375-inch Phillips screws (part
number 48-2696-01)
(Optional; in package if ordered)
6One ground lug kit (part number 69-100359-01)
• One #6 AWG, 90 degree, #10 post ground
lug (part number 32-0608-01)
• Two 10-32 x 0.38-inch Phillips screws (part
number 48-0700-01)
5
Rack-mount bracket kit (53-101510-02):
• Two rack-mount brackets (700-127244-01)
• Six 8-32 x 0.375-inch Phillips screws (part
number 48-2286) for securing the brackets
to the chassis
• Four 10-32 x 0.75-inch Phillips screws (part
number 48-0441-01) for securing the chassis
to your rack
• Four 12-24 x 0.75-inch Phillips screws (part
number 48-0440-01) for securing the chassis
to your rack
(Optional; in package if ordered)
8Two slide rails (800-110033-01)
Slide rail accessories kit (53-101509-02):
•Two slide rail locking brackets (part number
700-121935-01)
• Six 8-32 x 0.302-inch slide rail locking
bracket Phillips screws (part number
48-102184-01)
• Two M3 x 0.5 x 6-mm Phillips screws (part
number 48-101144-01)
(Optional; in package if ordered)
7
Two power supply module tie wraps and clamps
(part number 52-100162-01)
10Cisco Secure Firewall 3100
This document has a URL and QR code that point
to the Digital Documentation Portal. The portal
contains links to the Product Information page,
the Hardware Installation Guide, the Regulatory
and Safety Information Guide, the Getting Started
Guide, and the Easy Deployment Guide.
9
Serial Number and Digital Documentation Portal QR Code
The pullout asset card on the front panel of your Secure Firewall 3100 chassis contains the chassis serial
number and the Digital Documentation Portal QR code, which points to the getting started guide, the regulatory
and compliance guide, the easy deployment guide, and the hardware installation guide.
Overview
6
Overview
Serial Number and Digital Documentation Portal QR Code

Figure 3: Pullout Asset Card
Documentation Portal QR code2Pullout asset tag1
—Chassis serial number3
The compliance label on the bottom of the chassis contains the chassis serial number, regulatory compliance
marks, and the Digital Documentation Portal QR code that points to the guides listed above. The following
figure shows an example compliance label found on the bottom of the chassis.
Overview
7
Overview
Serial Number and Digital Documentation Portal QR Code

Figure 4: Example Compliance Label
Chassis serial number2Chassis model number1
—Documentation Portal QR code3
Front Panel
The following figure shows the front panel of the Secure Firewall 3100. See Front Panel LEDs, on page 11
for a description of the LEDs.
Overview
8
Overview
Front Panel

Figure 5: Secure Firewall 3100 Front Panel
SSD-22SSD-11
RJ-45 console port4System LEDs3
Gigabit Ethernet management port:
• Secure Firewall Threat
Defense—Management 0 (also referred to
as Management 1/1 and Diagnostic 1/1)
• ASA—Management 1/1
6Type A USB 3.1 port5
Recessed factory reset button8Reset button LED7
Fixed copper ports (NM-1)
Copper ports named 1/1 through 1/8 left to right
10Pullout asset card with chassis serial number,
getting started guide QR code, and LTP QR code
9
Network module (NM-2)12Fixed fiber ports (NM-1)
Fiber ports named 1/9 through 1/16 left to right
11
Management Port
The Secure Firewall 3100 chassis management port is a 1/10-Gb fiber SFP port.
RJ-45 Console Port
The Secure Firewall 3100 chassis has a standard RJ-45 console port. You can use the CLI to configure
your 3100 through the RJ-45 serial console port by using a terminal server or a terminal emulation
program on a computer.
The RJ-45 (8P8C) port supports RS-232 signaling to an internal UART controller. The console port does
not have any hardware flow control, and does not support a remote dial-in modem. The baud rate is 9600.
You can use the standard cable found in your accessory kit to convert the RJ-45 to DB-9 if necessary.
Type A USB 3.1 Port
You can use the external Type A USB port to attach a data-storage device. The external USB drive
identifier is usb:. The Type A USB port supports the following:
• Hot swapping
Overview
9
Overview
Front Panel

• USB drive formatted with FAT32
• Boot kickstart image from ROMMON for discovery recovery purposes
• Copy files to and from workspace:/ and volatile:/ within local-mgmt. The most relevant files are:
• Core files
• Ethanalyzer packet captures
• Tech-support files
• Security module log files
• Platform bundle image upload using download image usbA:
The Type A USB port does not support Cisco Secure Package (CSP) image upload support.
Network Ports
The Secure Firewall 3100 chassis has a network module slot that supports the following network modules:
• 8-port 1/10-Gb SFP
• 8-port 1/10/25-Gb SFP
• 6-port 1-Gb SFP SX multimode hardware bypass
• 6-port 10-Gb SFP SR multimode hardware bypass
• 6-port 10-Gb SFP LR single mode hardware bypass
• 6-port 25-Gb SFP SR multimode hardware bypass
• 6-port 25-Gb SFP LR single mode hardware bypass
• 8-port 10/100/1000Base-T hardware bypass
First supported on FTD 7.2.1 and ASA 9.18.2.
Note
• 4-port 40-Gb QSFP
First supported on FTD 7.2.1 and ASA 9.18.2.
Note
The 4-port 40-Gb and 8-port 25-Gb network modules are supported only on the 3130 and 3140.
Note
Factory Reset Button
The Secure Firewall 3100 chassis has a recessed reset button that resets the system to the factory default.
All previous configuration is erased after pressing the button down for five seconds. The following
occurs:
Overview
10
Overview
Front Panel

• ROMMON NVRAM is cleared and returned to default.
• All extra images are removed; the current running image remains.
• FXOS logs, core files, SSH keys, certificates, FXOS configuration, and Apache configuration are
removed.
If power is lost between when you pushed the reset button and when the reset process is complete, the
process stops and you have to push the button again after the system powers back on.
Note
For More Information
• See Remove and Replace the SSD for the procedure for removing a replacing the SSD.
• See Install, Remove, and Replace the Network Module for the procedure for installing network modules.
• See 8-Port 1/10/25-Gb Network Module, on page 15 for more information about the network module.
• See 6-Port 1-Gb SX/10-Gb SR/10-Gb LR/25-Gb SR/25-Gb LR Network Module with Hardware Bypass
, on page 21 for more information about the network module.
•See 8-Port 10/100/1000Base-T Network Module with Hardware Bypass, on page 19 for more information
about the network module.
• See 4-Port 40-Gb Network Module, on page 17 for more information about the network module.
Front Panel LEDs
The following figure shows the Secure Firewall 3100 front panel LEDs.
Figure 6: Secure Firewall 3100 Front Panel LEDs
Overview
11
Overview
Front Panel LEDs

RJ-45 Copper Port Activity Status
• Off—No activity
• Green, flashing—The number of flashes
determines the link speed; 1 flash=10 Mb,
2=100 Mb, 3=1 Gb.
2RJ-45 Copper Port Link Status
• Off—No link.
• Green—Link is up.
1
Factory Reset Button Status
• Green, flashing—Flashes 5 seconds after
you depress the button.
• Off—Reset is complete.
4Management Port Status
The 1/10-Gb fiber management port has a bicolor
LED under the SFP cage that indicates
link/activity/fault:
• Off—No SFP.
• Green—Link up.
• Green, flashing—Network activity.
• Amber—SFP present, but no link.
3
Network Module 2 Port Status
• Green—Port is enabled, the link partner is
detected.
•Amber—Port is enabled, but the link partner
is not detected.
• Green, flashing—Port is enabled; network
activity is detected.
6Fiber Port Link/Activity Status
Each fiber port has one dual color LED under the
SFP cage.
• Off—No SFP.
• Green—Link up.
• Green, flashing—Network activity at >1G
is detected.
• Amber—No link or network failure.
5
Alarm Status
• Off—No alarms.
• Amber—Environmental error.
• Green—Status is ok.
8Managed Status
• Green, flashing slowly (twice in 5
seconds)—Cloud is connected.
• Green and amber, flashing—Cloud
connection failure.
• Green—Cloud is disconnected.
See the Easy Deployment Guide for
1000, 2100, or 3100 Series Cisco
Secure Firewalls for more
information on LTP.
Note
7
Overview
12
Overview
Front Panel LEDs

System Status
• Off—System has not booted up yet.
• Green, flashing quickly—System is booting
up.
• Green—Normal system function.
• Amber—System boot up has failed.
• Amber, flashing—Alarm condition, system
needs service or attention and may not boot
properly.
10SSD 1 Status
• Off—The SSD is not present.
• Green—The SSD is present; no activity.
• Green, flashing—The SSD is active.
• Amber—The SSD has a problem or failure.
9
Power Status
• Off—Input power is not detected. If the AC
power cord is plugged in, and the LED on
the power supply is blinking green, standby
power is still on.
• Green, flashing—The system has detected
a power switch toggle event, and initiated
the shutdown sequence. If the power switch
is in the OFF position, the system powers
off after shutdown is completed. Do not
remove the AC or DC power source while
this LED is blinking so that the system has
time to perform a graceful shutdown.
• Amber—The system is powering up (before
the BIOS boots). This takes one to five
seconds at most.
• Green—The system is fully powered up.
12SSD 2 Status
• Off—The SSD is not present.
• Green—The SSD is present; no activity.
• Green, flashing—The SSD is active.
• Amber—The SSD has a problem or failure.
11
—Activity Status (Role of a high-availability pair)
• Off—The unit is not configured or enabled
in a high-availability pair.
• Green—The unit is in active mode.
• Amber—The unit is in standby mode.
13
Rear Panel
The following figure shows the rear panel of the Secure Firewall 3100.
Overview
13
Overview
Rear Panel

Figure 7: Secure Firewall 3100 Rear Panel
Power LED below
This power LED has the same
behavior as the front panel LED.
See Front Panel LEDs, on page 11
for more information.
Note
2Power on/off switch1
Power supply module 1 FAIL LED4Power supply module 13
Power supply module 1 connector6Power supply module 1 OK LED5
Dual fan module 18Dual Fan Module 1 LED7
Dual fan module 210Dual Fan Module 2 LED9
Power supply module 2 FAIL LED12Power supply module 211
Power supply module 2 connector14Power supply module 2 OK LED13
—Two-post grounding pad
The two-post grounding lug and two
screws are included in the accessory
kit.
Note
15
Power Switch
The power switch is located to the left of power supply module 1 on the rear of the chassis. It is a toggle
switch that controls power to the system. If the power switch is off but the power cord is plugged in and
the power supply is flashing green, the system is in standby position, and only the 3.3-V standby power
is enabled from the power supply module. The 12-V main power is OFF. When the switch is in the ON
position, the 12-V main power is turned on and the system boots.
Before you move the power switch to the OFF position, use the shutdown commands so that the system
can perform a graceful shutdown. This may take several minutes to complete. After the graceful shutdown
is complete, the console displays It is safe to power off now. Wait until the front panel
PWR LED flashes momentarily and is off before removing AC power.
See Front Panel LEDs, on page 11 for the PWR LED description. See the FXOS Configuration Guide
for more information on using the shutdown commands.
Overview
14
Overview
Rear Panel

If you remove the system power cords before the graceful shutdown is complete, disk corruption can
occur. You can move the power switch to OFF before the shutdown. The system ignores it.
Caution
After removing power from the chassis by unplugging the power cord, wait at least 10 seconds before
turning power back ON. You want to keep the system power off, including the standby power, for 10
seconds.
Note
For More Information
• See Remove and Replace the Power Supply Module for the procedure for removing and replacing the
power supply module in the Secure Firewall 3100.
• See Remove and Replace the Dual Fan Module for the procedure for removing and replacing the dual
fan module in the Secure Firewall 3100.
• See Ground the Chassis for the procedure for using the grounding lug to ground the chassis.
• See Power Supply Module, on page 24 for a description of the power supply module LEDs.
• See Dual Fan Modules, on page 26 for a description of the fan LEDs.
8-Port 1/10/25-Gb Network Module
The Secure Firewall 3100 chassis has one network module slot named NM-2. Network modules are optional,
removable I/O modules that provide either additional ports or different interface types. The network module
plugs into the chassis on the front panel. See Front Panel, on page 8 for the location of the network module
slot on the chassis.
FPR-X-NM-8X10G supports 1 Gb and 10 Gb full-duplex Ethernet traffic per port and is supported on all
Secure Firewall 3100s. FPR-X-NM-8X25G supports 1 Gb, 10 Gb, or 25 Gb full-duplex Ethernet traffic per
port and is supported only on the 3130 and 3140.
The top ports are numbered from left to right—Ethernet 2/1, Ethernet 2/3, Ethernet 2/5, and Ethernet 2/7. The
bottom ports are numbered from left to right—Ethernet 2/2, Ethernet 2/4, Ethernet 2/6, and Ethernet 2/8 (see
the figure below). Up arrows are the top ports and down arrows are the bottom ports (see the figure below).
This network module supports SFP/SFP+/SFP28 transceivers. See Supported SFP/SFP+/QSFP+ Transceivers
, on page 29 for the list of Cisco-supported transceivers.
The hardware and the system support hot swapping if you are replacing a network module with the same type
of network module. You must first disable the network port and then reenable it after replacement. If you
replace the 8-port 1/10/25-Gb network module with another supported network module, you must reboot the
chassis so that the new network module is recognized. See the configuration guide for your operating system
for the detailed procedures for managing network modules.
Note
The following figure shows the front panel of the 1/10-Gb and 1/10/25-Gb network module.
Overview
15
Overview
8-Port 1/10/25-Gb Network Module

Figure 8: 8-Port 1/10-Gb (FPR-X-NM-8X10G) and 8-Port 1/10/25-Gb (FPR-X-NM-8X25G) Network Module
Ethernet 2/12Captive screw1
Ethernet 2/54Ethernet 2/33
Power on LED6Ethernet 2/75
Ethernet 2/28Ejector handle7
Ethernet 2/610Ethernet 2/49
Network activity LEDs
The up arrows represent the top ports and the
down arrows represent the bottom ports.
• Off—No SFP.
• Amber—No link or network failure.
• Green—Link up.
• Green, flashing—Network activity.
12Ethernet 2/811
For More Information
• See 4-Port 40-Gb Network Module, on page 17 for a description of the 40-Gb network module.
• See 6-Port 1-Gb SX/10-Gb SR/10-Gb LR/25-Gb SR/25-Gb LR Network Module with Hardware
Bypass , on page 21 for a description of the 1/10/25-Gb network module.
•See 8-Port 10/100/1000Base-T Network Module with Hardware Bypass, on page 19 for a description
of the 10/100/1000Base-T network module.
Overview
16
Overview
8-Port 1/10/25-Gb Network Module

•See Install, Remove, and Replace the Network Module for the procedure for removing and replacing
network modules.
4-Port 40-Gb Network Module
The Secure Firewall 3100 chassis has one network module slot named NM-2. Network modules are optional,
removable I/O modules that provide either additional ports or different interface types. The network module
plugs into the chassis on the front panel. See Front Panel, on page 8 for the location of the network module
slot on the chassis.
The FPR-X-NM-4X40G supports 40-Gb operation and is supported on the 3130 and 3140. This network
module provides full-duplex Ethernet traffic per port. The 40-Gb network module has four QSFP+ ports. The
40-Gb ports are numbered left to right, Ethernet 2/1 through Ethernet 2/4. See Supported SFP/SFP+/QSFP+
Transceivers , on page 29 for the list of Cisco-supported transceivers.
Starting with FTD 7.2 and ASA 7.18.1, you can break each of the four 40-Gb ports into four 10-Gb ports
using the supported breakout cables (see Supported SFP/SFP+/QSFP+ Transceivers , on page 29 for a list of
the breakout cables). With the four-port 40-Gb network module, you now have 16 10-Gb interfaces. The
added interfaces are Ethernet 2/1/1 through Ethernet 2/1/4.
The hardware and the system support hot swapping if you are replacing a network module with the same type
of network module. If you replace the 4-port 40-Gb network module with another supported network module,
you must reboot the chassis so that the new network module is recognized. See the configuration guide for
your operating system for the detailed procedures for managing network modules.
Note
Although you can install the 4-port 40-Gb network in the Secure Firewall 3105, 3110, and 3120, the software
does not recognize it because it is not supported.
Note
The following figure shows the front panel of the 4-port 40-Gb network module.
Overview
17
Overview
4-Port 40-Gb Network Module

Figure 9: 4-Port 40-Gb Network Module (FPR-X-NM-4X40G)
Network activity LEDs
The up arrows represent the top ports and the
down arrows represent the bottom ports.
• Off—No SFP.
• Amber—No link or a network failure.
• Green—Link is up.
• Green, flashing—Network activity.
2Captive screw1
Ejector handle4Power on LED3
Ethernet 2/26Ethernet 2/15
Ethernet 2/48Ethernet 2/37
For More Information
• See 8-Port 1/10/25-Gb Network Module, on page 15 for a description of the 1/10/25-Gb network
module.
• See 6-Port 1-Gb SX/10-Gb SR/10-Gb LR/25-Gb SR/25-Gb LR Network Module with Hardware
Bypass , on page 21 for a description of the 1/10/25-Gb network module.
•See 8-Port 10/100/1000Base-T Network Module with Hardware Bypass, on page 19 for a description
of the 1-Gb network module.
•See Install, Remove, and Replace the Network Module for the procedure for removing and replacing
network modules.
Overview
18
Overview
4-Port 40-Gb Network Module

8-Port 10/100/1000Base-T Network Module with Hardware
Bypass
The Secure Firewall 3100 chassis has one network module slot named NM-2. Network modules are optional,
removable I/O modules that provide either additional ports or different interface types. The network module
plugs into the chassis on the front panel. See Front Panel, on page 8 for the location of the network module
slot on the chassis.
FPR3K-XNM-8X1GF is an 8-port 10/100/1000Base-T hardware bypass network module. The eight ports are
numbered from top to bottom, left to right. Ports 1 and 2, 3 and 4, 5 and 6, and 7 and 8 are paired for hardware
bypass mode. In hardware bypass mode, data is not processed by the Secure Firewall 3100 but is routed to
the paired port.
Hardware bypass (also known as fail-to-wire) is a physical layer (Layer 1) bypass that allows paired interfaces
to go into bypass mode so that the hardware forwards packets between these port pairs without software
intervention. Hardware bypass provides network connectivity when there are software or hardware failures.
Hardware bypass is useful on ports where the secure firewall is only monitoring or logging traffic. The
hardware bypass network modules have a switch that is capable of connecting the two ports when needed.
Hardware bypass is only supported with threat defense, although you can use these modules in nonbypass
mode in threat defense or ASA.
Note
Hardware bypass is supported only on a fixed set of ports. You can pair Port 1 with Port 2, Port 3 with Port
4, but you cannot pair Port 1 with Port 4 for example.
When the appliance switches from normal operation to hardware bypass or from hardware bypass back to
normal operation, traffic may be interrupted for several seconds. A number of factors can affect the length of
the interruption; for example, behavior of the link partner such as how it handles link faults and debounce
timing; spanning tree protocol convergence; dynamic routing protocol convergence; and so on. During this
time, you may experience dropped connections.
Note
If you have an inline interface set with a mix of hardware bypass and nonhardware bypass interfaces, you
cannot enable hardware bypass on this inline interface set. You can only enable hardware bypass on an inline
interface set if all the pairs in the inline set are valid hardware bypass pairs.
Note
The 8-port 10/100/1000Base-T network module is supported beginning with FTD 7.2.3 and ASA 9.18.2.
Note
Overview
19
Overview
8-Port 10/100/1000Base-T Network Module with Hardware Bypass

The hardware and the system support hot swapping if you are replacing a network module with the same type
of network module. If you replace the 8-port 10/100/1000Base-T network module with another supported
network module, you must reboot the chassis so that the new network module is recognized. See the
configuration guide for your operating system for the detailed procedures for managing network modules.
Note
Make sure you have the correct firmware package and software version installed to support this network
module. See the configuration guide for your software for the procedures for updating the firmware package
and verifying the software version. See the Cisco Secure Firewall Threat Defense Compatibility Guide and
the Cisco Secure Firewall ASA Compatibility guide, which provide Cisco software and hardware compatibility,
including operating system and hosting environment requirements, for each supported version.
Note
The following figure shows the front panel of the 8-port 10/100/1000Base-Tnetwork module.
Figure 10: 8-Port 10/100/1000Base-T Network Module (FPR-X-NM-8X1GF)
Ethernet 2/1 and Ethernet 2/2
Ports 1 and 2 are paired together to form a
hardware bypass pair. LED B1 applies to this
paired port.
2Bypass LEDs B1 through B4
• Green—In standby mode.
•Amber, flashing—Port is in hardware bypass
mode, failure event.
1
Overview
20
Overview
8-Port 10/100/1000Base-T Network Module with Hardware Bypass