Cisco Firepower 4100 Series User manual

Overview
•Features, on page 1
•Deployment Options, on page 5
•Package Contents, on page 5
•Serial Number Location, on page 6
•Front Panel, on page 8
•Front Panel LEDs, on page 9
•Rear Panel, on page 10
•Network Modules, on page 11
•Hardware Bypass Network Modules, on page 16
•Power Supply Modules, on page 23
•Fan Modules, on page 25
•Supported SFP/SFP+ and QSFP Transceivers, on page 26
•Hardware Specifications, on page 29
•Product ID Numbers, on page 31
•Power Cord Specifications, on page 34
Features
The Cisco Firepower 4100 series security appliance is a standalone modular security services platform. It is
capable of running multiple security services simultaneously and so is targeted at the data center as a
multiservice platform. The series includes the Firepower 4110, 4120, 4140, and 4150. See Product ID Numbers,
on page 31 for a list of the product IDs (PIDs) associated with the 4100 series.
The Firepower 4100 series supports Cisco Secure Firewall Threat Defense, Cisco Secure Firewall eXtensible
Operating System (FXOS), and Cisco Secure Firewall ASA software. See Cisco Firepower 4100/9300 FXOS
Compatibility, which lists software and hardware compatibility information for the Firepower 4100 series.
The following figure shows the Firepower 4100 series security appliance.
Overview
1

Figure 1: Firepower 4100 Series
The following table lists the features for the Firepower 4100 series.
Table 1: Firepower 4100 Series Features
4150414041204110Feature
• Common Criteria certification (CC) for the Network Device Collaborative
Protection Profile (NDcPPv2.2E), VPN Gateway Module (VPNGW_MOD_v1.1),
and Firewall Module (FW_MOD_v1.4e) for ASA 9.16.x.
•Common Criteria (CC) and Commercial Solutions for Classified (CSFC) for ASA
9.8.xand FTD 6.2.x.
• CC for the Network Device Collaborative Protection Profile (NDcPPv2.1) for
ASA 9.12.xand FX-OS 2.6.x.
• Federal Information Processing Standards (FIPS) 140-2 on ASA 9.12.x, FTD
6.4.x, and FX-OS 2.6.x.
• Department of Defense Information Network Approved Product List (DoDIN
APL) for ASA 9.12.xand FTD 6.4.x.
• US Government Compliance for IPv6 (USGv6) for ASA 9.8.xand FTD 6.2.x.
See the "Security Certifications Compliance" chapter in the Cisco FXOS
CLI Configuration Guide or Cisco FXOS Firepower Chassis Manager
Configuration Guide for the procedure to enable security modes.
Note
Security standards
certifications
——Certified
—Network Equipment
Building Systems
(NEBS) certification
1 RU
Fits a standard 19-inch (48.3cm) square-hole rack
Form factor
Slide rails, mount ears, and screws included
4-post Electronic Industries Association (EIA)-310-D rack
Rack mount
Overview
2
Overview
Features

4150414041204110Feature
Front to rear
Cold aisle to hot aisle
Airflow
Single 22-coreSingle 18-core
Single 12-coreProcessor
256-GB DDR4
DRAM
256-GB DDR4
DRAM
128-GB DDR4
DRAM
64-GB DDR4
DRAM
Memory
24
With two 8-port network modules installed
Maximum number
of interfaces
One Gigabit Ethernet
Supports 1-Gb fiber or copper small form-factor pluggable (SFP)
Management port
One RJ-45 consoleSerial port
One USB 2.0 Type AUSB port
Eight fixed 1-Gb and 10-Gb SFP+ ports (named Ethernet 1/1 through 1/8)Network ports
Eight fixed 1-Gb and 10-Gb SFP+ ports
See Supported SFP/SFP+ and QSFP Transceivers, on page 26 for a list of supported
transceivers.
Small form-factor
pluggable (SFP)
ports
Displays the serial number; on the front panelPullout asset card
On rear panelGrounding lug
On front panelLocator beacon
On rear panelPower switch
Two network module slots (named network module 2 and network module 3)Network modules
Overview
3
Overview
Features

4150414041204110Feature
• 8-port 10-Gigabit Ethernet SFP+
• 4-port 40-Gigabit Ethernet QSFP+
• 8-port 1-Gigabit Ethernet copper with hardware bypass
• 2-port 40-Gigabit Ethernet QSFP+ (built-in) with hardware bypass
• 6-port 1-Gigabit Ethernet SX fiber SFP (built-in) with hardware bypass
• 6-port 10-Gigabit Ethernet SR fiber SFP+ (built-in) with hardware bypass
• 6-port 10-Gigabit Ethernet LR fiber SFP+ (built-in) with hardware bypass
• 2-port 100-Gigabit Ethernet QSFP28
First supported in threat defense 7.2 and ASA 9.18.
Note
• 4-port 100-Gigabit Ethernet QSFP28
First supported in threat defense 7.2 and ASA 9.18.
Note
Supported network
modules
Two (1+1) power supply module slots
Ships with two 400-W AC power supply
modules
Hot-swappable
Two (1+1) power supply module slots
Ships with one 400-W AC power supply
modules
Hot-swappable
AC power supply
OptionalDC power supply
1+1Redundant power
Six fan module slots
3+1 redundancy
Hot-swappable
Fan
Two SSD slots
Ships with one 400-GB SSD installed in
slot 1. Slot 1 is the primary SSD and
should always be present.
RAID is not supported.
Note
The SSD must be installed in slot 1. Slot
2 is optional and is reserved only for the
MSP.
Two SSD slots
Ships with one 200-GB SSD installed in
slot 1. Slot 1 is the primary SSD and
should always be present.
RAID is not supported.
Note
The SSD must be installed in slot 1. Slot
2 is optional and is reserved only for the
Malware Storage Pack (MSP).
Storage
Installed in the second SSD slot onlyMSP
Overview
4
Overview
Features

Deployment Options
Here are some examples of how you can deploy the Firepower 4100:
• In a data center using NGFW and ASA
• At the core/aggregation layer of a 3-tier data center in a high availability configuration
• As a dedicated multifunctional security service within converged infrastructure stacks, for example,
vBlock, FlexPod, and so forth, at the access layer
• As a high-performance data center security appliance between the WAN edge and the data center core
in a high availability configuration
• Inter-DC clustering deployments
• In newer spine/leaf data center designs, deployment as a leaf that exclusively offers security functions
Package Contents
The following figure shows the package contents for the Firepower 4100. Note that the contents are subject
to change and your exact contents might contain additional or fewer items.
Figure 2: Firepower 4100 Package Contents
Blue console cable PC terminal adapter (part
number 72-3383-01)
2Firepower 4100 chassis1
Overview
5
Overview
Deployment Options

10/100/1000BASE-T SFP transceiver4Two power cords (country-specific)
See Power Cord Specifications, on page 34 for
a list of supported power cords.
3
6Two slide rails with two M3 x 0.5 x 6-mm screws
(48-101144-01)
5
Flextronics tie wrap and tie wrap clamp (part
number 52-100202-01)
8Artesyn tie wrap and tie wrap clamp (part number
52-100204-01)
7
Two slide rail locking brackets (part number
700-105350-02)
Six 8-32 x 0.375-inch Phillips screws (part
number 48-2696-01)
109
1211
Cable management bracket kit (part number
69-100376-01)
• Two cable management brackets (part
number 700-106377-01)
• Four 8-32 x 0.375-inch Phillips screws (part
number 48-2696-01)
14Ground lug kit (part number 69-1000359-01):
• One ground lug #6 AWG, 90 degree, #10
post (part number 32-0608-01)
•Two 10-32 x 39-8-inch Phillips Head screws
(part number 48-0700-01)
13
Cisco Firepower 4100
This document has a URL pointing to the
hardware installation guide, a URL pointing the
regulatory and safety guide, and a QR code and
URL pointing to the Getting Started Guide.
15
Serial Number Location
The serial number for the Firepower 4100 series chassis is located on the pullout asset card on the front panel.
Overview
6
Overview
Serial Number Location

Figure 3: Serial Number on the 4100 Chassis
You can also view additional model information on the compliance label located on the bottom of the chassis.
Figure 4: Compliance Label on the 4100 Chassis
Overview
7
Overview
Serial Number Location

Front Panel
The following figure shows the front panel of the Firepower 4100.
Figure 5: Firepower 4100 Front Panel
Gigabit Ethernet management port2RJ-45 console port1
Eight fixed SFP+ (1-Gb/10-Gb) ports (in network
module slot 1)
Ethernet 1/1 through 1/8 labeled top to bottom,
left to right
4USB 2.0 Type A port3
SSD 2
Reserved for the optional MSP.
6SSD 1
Reserved for the primary SSD; slot 1 must always
be populated.
5
Locator LED8Power LED7
Network module 2
The 10-Gb network module is shown.
Note
10Pullout asset card9
Network module 3
The 10-Gb network module is shown.
Note
11
RJ-45 Console Port
The Firepower 4100 has a standard RJ-45 console port. You can use the CLI to configure your Firepower
4100 through the RJ-45 serial console port by using a terminal server or a terminal emulation program
on a computer.
The RJ-45 (8P8C) port supports RS-232 signaling to an internal UART controller. The console port does
not have any hardware flow control, and does not support a remote dial-in modem. The baud rate is 9600.
You can use the standard cable found in your accessory kit to convert the RJ-45 to DB-9 if necessary.
Type A USB Port
You can use the external USB Type A port to attach a data storage device. The external USB drive
identifier is disk1:. The USB Type A port supports the following:
• Hot swapping
Overview
8
Overview
Front Panel

• USB drive formatted with FAT32
• Boot kick-start image from the Supervisor ROMMON for discovery recovery purposes
• Copy files to and from workspace:/ and volatile:/ within local-mgmt. The most relevant files are:
• Core files
• Ethanalyzer packet captures
• Tech-support files
• Security module log files
• Platform bundle image upload using download image usbA:
The USB Type A port does not support Cisco Secure Package (CSP) image upload.
Network Ports
The Firepower 4100 chassis has eight fixed ports that require 1-Gb/10-Gb SFP/SFP+ transceivers (fiber
or copper). They are numbered from left to right starting with 1 and are named Ethernet 1/1 through
Ethernet 1/8. The 4100 also has two network module slots that support different numbers of ports
depending on the network module. See Network Modules, on page 11 for the supported network modules.
See for Supported SFP/SFP+ and QSFP Transceivers, on page 26 the list of supported transceivers.
Each port has LEDs that represent link/activity status.
Management Port
The Firepower 4100 chassis has a management port that requires a 1-Gb fiber or copper SFP.
Front Panel LEDs
The following figure and table describe the Firepower 4100 front panel LEDs.
Figure 6: Front Panel LEDs
Overview
9
Overview
Front Panel LEDs

Health (SYS)
• Off—System is not booting yet.
• Green, flashing—Power-up diagnostics are
complete and system is booting up.
• Green—The system has passed power-up
diagnostics.
• Amber—Power-up diagnostics has failed.
• Amber, flashing—Alarm; power-up
diagnostics are running.
2Management
• Off—No connection or port is not in use.
• Amber—No link or network failure.
• Green—Link up.
• Green, flashing—Network activity.
1
Power
• Off—Input power not detected.
• Green, flashing—Appears only when you
move the power switch from ON to OFF.
System is shutting down and powers off once
shutdown is completed.
• Amber—System is powering up.
• Green—System fully powered up.
• Amber, flashing—Reserved.
4SSD
• Off— SSD not present.
• Green—SSD is present; no activity.
• Green, flashing—SSD is active.
• Amber—SSD failure.
• Amber, flashing—Rebuilding, flashes at 1
Hz.
•Amber, flashing—Predictive failure analysis
(PFA) and hot spare; two fast flashes at 4
Hz, pause for 0.5 seconds.
3
Locator LED
• Off—Locate is off.
• Blue—Locate is on.
6Active (ACT)
This LED is not supported; reserved for future
use.
5
Network activity
• Off—No connection or port is not in use.
• Amber—No link or network failure.
• Green—Link up.
• Green, flashing—Network activity.
7
Rear Panel
The following figure shows the rear panel of the Firepower 4100.
Overview
10
Overview
Rear Panel