Cisco EXPLORER 3100 User manual

Overview
•Features, on page 1
•Deployment Options, on page 4
•Package Contents, on page 5
•Serial Number and Digital Documentation Portal QR Code, on page 6
•Front Panel, on page 8
•Front Panel LEDs, on page 11
•Rear Panel, on page 13
•8-Port 1/10/25-Gb Network Module, on page 15
•4-Port 40-Gb Network Module, on page 17
•8-Port 10/100/1000Base-T Network Module with Hardware Bypass, on page 19
•6-Port 1-Gb SX/10-Gb SR/10-Gb LR/25-Gb SR/25-Gb LR Network Module with Hardware Bypass ,
on page 21
•Power Supply Module, on page 24
•Dual Fan Modules, on page 26
•SSDs, on page 27
•Supported SFP/SFP+/QSFP+ Transceivers , on page 29
•Hardware Specifications, on page 32
•Product ID Numbers, on page 33
•Power Cord Specifications, on page 35
Features
The Cisco Secure Firewall 3100 is a standalone modular security services platform that includes the Secure
Firewall 3105, 3110, 3120, 3130, and 3140.
See Product ID Numbers, on page 33 for a list of the product IDs (PIDs) associated with the 3100 series.
The Secure Firewall 3100 supports Cisco Firepower Threat Defense and Cisco ASA software. See the Cisco
Secure Firewall Threat Defense Compatibility Guide and the Cisco Secure Firewall ASA Compatibility guide,
which provide Cisco software and hardware compatibility, including operating system and hosting environment
requirements, for each supported version.
Overview
1

The Secure Firewall 3105 is first supported in Cisco Firepower Threat Defense 7.3 and Cisco ASA 9.19 and
later.
Note
The following figure shows the Secure Firewall 3100.
Figure 1: Secure Firewall 3100
The following table lists the features for the Secure Firewall 3100.
Table 1: Secure Firewall 3100 Features
31403130312031103105Feature
1 RU
Fits a standard 19-inch (48.3-cm) square-hole rack
Form factor
(Optional) Two 2-post mount brackets and/or two slide rails
4-post Electronic Industries Association (EIA)-310-D rack
We recommend that you order the slide rails for your Secure Firewall 3100.
Note
Rack mount
Front to rear (I/O side to non-I/O side)
Cold aisle to hot aisle
Airflow
AMD 7452AMD 7352AMD 7282
AMD 7272Processor
32241612Core count
2.35 GHz2.3 GHz2.8 GHz2.9 GHzCore clock
4 x 64 GB4 x 32 GB2 x 64 GB2 x 32 GBSystem memory
One 1/10-Gb small form-factor pluggable (SFP) portManagement
port
One RJ-45 serial portConsole port
USB 3.1 Type A (900 mA) portUSB port
8 SFP+ fixed ports and 8 copper RJ-45 ports
Named Ethernet 1/1 through 1/16
Network ports
Overview
2
Overview
Features

31403130312031103105Feature
Eight 1/10/25-Gb SFP ports
Four 40-Gb QSFP ports
Network module
ports
One
Hot-swapping of identical modules is supported, but if you replace a network
module with another type, you must reboot the system so that the new network
module is recognized.
Note
Network module
slots
• 8-port 1Gb/10Gb/25Gb SFP+
(FPR3K-XNM-8X25G)
• 8-port 1Gb/10Gb SFP+
(FPR3K-XNM-8X10G)
• 4-port 40-Gb QSFP+
(FPR3K-XNM-4X40G)
• 6-port 1-Gb SFP SX
multimode hardware
bypass(FPR3K-XNM-6X1SXF)
• 6-port 10-Gb SFP SR
multimode hardware bypass
(FPR3K-XNM-6X10SRF)
• 6-port 10-Gb SFP LR single
mode hardware bypass
(FPR3K-XNM-6X10LRF)
• 6-port 25-Gb SFP SR
multimode hardware bypass
(FPR3K-XNM-6X25SRF)
• 6-port 25-Gb SFP LR single
mode hardware bypass
(FPR3K-XNM-6X25LRF)
• 8-port 10/100/1000Base-T
hardware bypass
(FPR3K-XNM-8X1GF)
•8-port 1Gb/10Gb SFP+ (FPR3K-XNM-8X10G)
•6-port 1-Gb SFP SX multimode hardware bypass
(FPR3K-XNM-6X1SXF)
• 6-port 10-Gb SFP SR multimode hardware
bypass (FPR3K-XNM-6X10SRF)
• 6-port 10-Gb SFP LR single mode hardware
bypass (FPR3K-XNM-6X10LRF)
• 8-port 10/100/1000Base-T hardware bypass
(FPR3K-XNM-8X1GF)
Network
modules
Two power supply slots
Ships with two 400-W AC power
supply modules
Hot-swappable
Two power supply slots
Ships with one 400-W AC power supply module
Hot-swappable
AC power
supply
Yes (optional)
Hot-swappable
DC power
supply
Overview
3
Overview
Features

31403130312031103105Feature
Yes
Ships with two power
supplies.
Note
No
Yes, if you order an extra power supply.
Note
Redundant
power
Two dual fan module slots (3 + 1)
The dual fan modules are hot-swappable.
Note
Fans
Two Nonvolatile Memory Express (NVMe) SSD slots
Ships with one 900-GB SSD installed in slot 1. You can order a second RAID1 SSD for
slot 2. The RAID1 SSD is preconfigured for RAID1.
Slot 2 is reserved for the optional software RAID1 configuration.
Note
Hot-swapping is supported with 2 SSDs. However, you must enter a CLI
command to remove one disk from the RAID before hot swapping. See the
CLI configuration guide for your software for the procedure.
Note
Storage
Displays the serial number and a QR code that points to the low touch provisioning (LTP)
guide.
Pullout asset
card
On rear panelGrounding lug
On rear panelPower switch
Resets the system to factory default without requiring serial console access
The reset button is recessed. Press with a pin and hold longer than 5 seconds
to set the system back to the factory default.
Note
Reset button
Deployment Options
Here are some examples of how you can deploy the Secure Firewall 3100:
• As a firewall:
• At the enterprise internet edge in a redundant configuration
• At branch offices in either a high availability pair or standalone
• At data centers in a high availability pair or clustered, which serves the needs of smaller enterprises
•As a device that provides additional application control, URL filtering, or IPS/threat-centered capabilities:
• Behind an enterprise internet edge firewall in an inline configuration or as a standalone (requires
hardware fail-open network module support)
• Deployed passively off a SPAN port on a switch or a tap on a network, or standalone
Overview
4
Overview
Deployment Options

• As a branch native SD-WAN solution that offers remote deployment and is managed over a 4G LTE
• As a VPN device:
• For remote access VPN
• For site-to-site VPN
Package Contents
The following figure shows the package contents for the Secure Firewall 3100. The contents are subject to
change and your exact contents contain additional or fewer items depending on whether you order the optional
parts. See Product ID Numbers for a list of PIDs associated with the package contents.
There are two sets of four screws that you can use to secure the chassis to your rack. Chose the screws that
fit your rack.
Note
Figure 2: Secure Firewall 3100 Package Contents
Console cable RJ-45 to DB-9 (part number
72-3383-01)
2Secure Firewall 3100 chassis1
Overview
5
Overview
Package Contents

SFP transceiver
(Optional; in package if ordered)
4One or two power cords (country-specific)
See Power Cord Specifications, on page 35 for
a list of supported power cords.
3
Cable management bracket kit (part number
69-100376-01)
• Two cable management brackets (part
number 700-128334-01)
• Four 8-32 x 0.375-inch Phillips screws (part
number 48-2696-01)
(Optional; in package if ordered)
6One ground lug kit (part number 69-100359-01)
• One #6 AWG, 90 degree, #10 post ground
lug (part number 32-0608-01)
• Two 10-32 x 0.38-inch Phillips screws (part
number 48-0700-01)
5
Rack-mount bracket kit (53-101510-02):
• Two rack-mount brackets (700-127244-01)
• Six 8-32 x 0.375-inch Phillips screws (part
number 48-2286) for securing the brackets
to the chassis
• Four 10-32 x 0.75-inch Phillips screws (part
number 48-0441-01) for securing the chassis
to your rack
• Four 12-24 x 0.75-inch Phillips screws (part
number 48-0440-01) for securing the chassis
to your rack
(Optional; in package if ordered)
8Two slide rails (800-110033-01)
Slide rail accessories kit (53-101509-02):
•Two slide rail locking brackets (part number
700-121935-01)
• Six 8-32 x 0.302-inch slide rail locking
bracket Phillips screws (part number
48-102184-01)
• Two M3 x 0.5 x 6-mm Phillips screws (part
number 48-101144-01)
(Optional; in package if ordered)
7
Two power supply module tie wraps and clamps
(part number 52-100162-01)
10Cisco Secure Firewall 3100
This document has a URL and QR code that point
to the Digital Documentation Portal. The portal
contains links to the Product Information page,
the Hardware Installation Guide, the Regulatory
and Safety Information Guide, the Getting Started
Guide, and the Easy Deployment Guide.
9
Serial Number and Digital Documentation Portal QR Code
The pullout asset card on the front panel of your Secure Firewall 3100 chassis contains the chassis serial
number and the Digital Documentation Portal QR code, which points to the getting started guide, the regulatory
and compliance guide, the easy deployment guide, and the hardware installation guide.
Overview
6
Overview
Serial Number and Digital Documentation Portal QR Code

Figure 3: Pullout Asset Card
Documentation Portal QR code2Pullout asset tag1
—Chassis serial number3
The compliance label on the bottom of the chassis contains the chassis serial number, regulatory compliance
marks, and the Digital Documentation Portal QR code that points to the guides listed above. The following
figure shows an example compliance label found on the bottom of the chassis.
Overview
7
Overview
Serial Number and Digital Documentation Portal QR Code

Figure 4: Example Compliance Label
Chassis serial number2Chassis model number1
—Documentation Portal QR code3
Front Panel
The following figure shows the front panel of the Secure Firewall 3100. See Front Panel LEDs, on page 11
for a description of the LEDs.
Overview
8
Overview
Front Panel

Figure 5: Secure Firewall 3100 Front Panel
SSD-22SSD-11
RJ-45 console port4System LEDs3
Gigabit Ethernet management port:
• Secure Firewall Threat
Defense—Management 0 (also referred to
as Management 1/1 and Diagnostic 1/1)
• ASA—Management 1/1
6Type A USB 3.1 port5
Recessed factory reset button8Reset button LED7
Fixed copper ports (NM-1)
Copper ports named 1/1 through 1/8 left to right
10Pullout asset card with chassis serial number,
getting started guide QR code, and LTP QR code
9
Network module (NM-2)12Fixed fiber ports (NM-1)
Fiber ports named 1/9 through 1/16 left to right
11
Management Port
The Secure Firewall 3100 chassis management port is a 1/10-Gb fiber SFP port.
RJ-45 Console Port
The Secure Firewall 3100 chassis has a standard RJ-45 console port. You can use the CLI to configure
your 3100 through the RJ-45 serial console port by using a terminal server or a terminal emulation
program on a computer.
The RJ-45 (8P8C) port supports RS-232 signaling to an internal UART controller. The console port does
not have any hardware flow control, and does not support a remote dial-in modem. The baud rate is 9600.
You can use the standard cable found in your accessory kit to convert the RJ-45 to DB-9 if necessary.
Type A USB 3.1 Port
You can use the external Type A USB port to attach a data-storage device. The external USB drive
identifier is usb:. The Type A USB port supports the following:
• Hot swapping
Overview
9
Overview
Front Panel

• USB drive formatted with FAT32
• Boot kickstart image from ROMMON for discovery recovery purposes
• Copy files to and from workspace:/ and volatile:/ within local-mgmt. The most relevant files are:
• Core files
• Ethanalyzer packet captures
• Tech-support files
• Security module log files
• Platform bundle image upload using download image usbA:
The Type A USB port does not support Cisco Secure Package (CSP) image upload support.
Network Ports
The Secure Firewall 3100 chassis has a network module slot that supports the following network modules:
• 8-port 1/10-Gb SFP
• 8-port 1/10/25-Gb SFP
• 6-port 1-Gb SFP SX multimode hardware bypass
• 6-port 10-Gb SFP SR multimode hardware bypass
• 6-port 10-Gb SFP LR single mode hardware bypass
• 6-port 25-Gb SFP SR multimode hardware bypass
• 6-port 25-Gb SFP LR single mode hardware bypass
• 8-port 10/100/1000Base-T hardware bypass
First supported on FTD 7.2.1 and ASA 9.18.2.
Note
• 4-port 40-Gb QSFP
First supported on FTD 7.2.1 and ASA 9.18.2.
Note
The 4-port 40-Gb and 8-port 25-Gb network modules are supported only on the 3130 and 3140.
Note
Factory Reset Button
The Secure Firewall 3100 chassis has a recessed reset button that resets the system to the factory default.
All previous configuration is erased after pressing the button down for five seconds. The following
occurs:
Overview
10
Overview
Front Panel