Cisco Firepower 9300 Maintenance and service guide

Installation, Maintenance, and Upgrade
•Remove and Replace the Supervisor, on page 1
•Install, Remove, and Replace the Security Module, on page 3
•Remove and Replace the SSD, on page 6
•Install, Remove, and Replace the Single-Wide Network Module, on page 8
•Install, Remove, and Replace the Double-Wide Network Module, on page 13
•Remove and Replace the Power Supply Module, on page 17
•Connect the DC Power Supply Module, on page 22
•Connect the HVDC Power Supply Module, on page 25
•Remove and Replace the Fan Module, on page 29
•Install the FIPS Opacity Shield, on page 32
Remove and Replace the Supervisor
You can remove the Firepower 9300 Supervisor while the system is powered on without damage to the
Supervisor hardware or system. However, because the supervisor is controlling the entire chassis, including
the power system, we recommend that you use the power switch on the rear panel of the chassis to put the
system in standby mode. See Supervisor for more information about the Supervisor.
Safety Warnings
Take note of the following component replacement safety warnings:
Statement 1028—More Than One Power Supply
This unit might have more than one power supply connection. To reduce risk of electric shock,
remove all connections to de-energize the unit.
Warning
Installation, Maintenance, and Upgrade
1

Statement 1030—Equipment Installation
Only trained and qualified personnel should be allowed to install, replace, or service this equipment.
Warning
Statement 1073—No User-Serviceable Parts
There are no serviceable parts inside. To avoid risk of electric shock, do not open.
Warning
Statement 1089—Instructed and Skilled Person Definitions
An instructed person is someone who has been instructed and trained by a skilled person and takes
the necessary precautions when working with equipment.
A skilled person or qualified personnel is someone who has training or experience in the equipment
technology and understands potential hazards when working with equipment.
Warning
Statement 1090—Installation by Skilled Person
Only a skilled person should be allowed to install, replace, or service this equipment. See statement
1089 for the definition of a skilled person.
Warning
Statement 1091—Installation by an Instructed Person
Only an instructed person or skilled person should be allowed to install, replace, or service this
equipment. See statement 1089 for the definition of an instructed or skilled person.
Warning
Step 1 To remove the Supervisor, loosen the two captive screws on the Supervisor tray.
Step 2 Remove the Supervisor tray from the chassis by pulling the handle on the Supervisor until it is unseated.
Step 3 Slide the tray partway out of the chassis, place your other hand under the tray to support its weight, and remove it from
the chassis.
Installation, Maintenance, and Upgrade
2
Installation, Maintenance, and Upgrade
Remove and Replace the Supervisor

Figure 1: Remove and Replace the Supervisor
Step 4 To install a new Supervisor tray, grasp the front of the tray and place your other hand under the tray to support it.
Step 5 Open the handle on the front of the tray.
Step 6 Gently slide the tray into the opening until you cannot push it any farther.
Step 7 Press the handle so that it catches the edge of the chassis and presses the tray all the way in.
Step 8 When the tray is all the way in the chassis, push in the handle to fully seat the tray.
Step 9 Using your fingers, tighten the captive screw on the front of the Supervisor; if using a screw driver, tighten to no more
than 3 in-lbs.
Tightening the captive screws with your fingers is unlikely to lead to stripped or damaged captive screws.
Install, Remove, and Replace the Security Module
This procedure describes how to install a security module into an empty slot that has never contained a security
module, and how to remove an installed security module and replace it with another security module.
You can remove the Firepower 9300 security module while the system is running, but we recommend that
you use the power switch on the rear of the chassis to put the security module in standby mode before removal
and reinstallation. If you install a new service module in an empty slot, you do not need to power off the
system.
Make sure you have the correct firmware package and software version installed to support your security
module. For instructions on how to verify your firmware package version and to upgrade the firmware
if necessary, see the Cisco Firepower 4100/9300 FXOS Firmware Upgrade Guide. See Cisco Firepower
4100/9300 FXOS Compatibility for the software compatibility matrix.
Note
Installation, Maintenance, and Upgrade
3
Installation, Maintenance, and Upgrade
Install, Remove, and Replace the Security Module

If you want to replace an existing security module with another security module, you must decommission
the old security module before removing it. See the "Security Module/Engine Management" chapter in
the Cisco FXOS Firepower Chassis Manager Configuration Guide for the instructions. After you
decommission the old security module, you can remove it, install the new security module, have the
system acknowledge it, and then reinitialize it.
Caution
Safety Warnings
Take note of the following component replacement safety warnings:
Statement 1028—More Than One Power Supply
This unit might have more than one power supply connection. To reduce risk of electric shock,
remove all connections to de-energize the unit.
Warning
Statement 1030—Equipment Installation
Only trained and qualified personnel should be allowed to install, replace, or service this equipment.
Warning
Statement 1073—No User-Serviceable Parts
There are no serviceable parts inside. To avoid risk of electric shock, do not open.
Warning
Statement 1089—Instructed and Skilled Person Definitions
An instructed person is someone who has been instructed and trained by a skilled person and takes
the necessary precautions when working with equipment.
A skilled person or qualified personnel is someone who has training or experience in the equipment
technology and understands potential hazards when working with equipment.
Warning
Statement 1090—Installation by Skilled Person
Only a skilled person should be allowed to install, replace, or service this equipment. See statement
1089 for the definition of a skilled person.
Warning
Installation, Maintenance, and Upgrade
4
Installation, Maintenance, and Upgrade
Install, Remove, and Replace the Security Module

Statement 1091—Installation by an Instructed Person
Only an instructed person or skilled person should be allowed to install, replace, or service this
equipment. See statement 1089 for the definition of an instructed or skilled person.
Warning
Step 1 To install a new security module for the first time into an empty slot, do the following:
a) Follow steps 6 through 10.
b) Enter scope slot > acknowledge to bring the new security module online.
Step 2 To remove a security module, loosen the captive screw on the front of the security module.
Step 3 Remove the security module from the chassis by pulling the handle on the security module until it is unseated.
Step 4 Slide the security module partway out of the chassis, place your other hand under the security module to support its
weight, and remove it from the chassis.
Figure 2: Remove and Install the Security Module
Step 5 Place the security module on an antistatic mat or antistatic foam if you are not immediately reinstalling it in another
slot.
If the slot is to remain empty, install a blank faceplate to ensure proper airflow and to keep dust out of the chassis;
otherwise install another security module.
Step 6 To install a new security module, grasp the front of the security module and place your other hand under the security
module to support it.
Step 7 Open the handle in the front of the security module.
Step 8 Gently slide the security module into the opening until you cannot push it any farther.
Step 9 Press the handle so that it catches the edge of the chassis and presses the security module all the way in.
Installation, Maintenance, and Upgrade
5
Installation, Maintenance, and Upgrade
Install, Remove, and Replace the Security Module

Step 10 Using your fingers, tighten the captive screw on the front of the security module; if using a screw driver, tighten to no
more than 3 in-lbs.
Tightening the captive screws with your fingers is unlikely to lead to stripped or damaged captive screws.
Remove and Replace the SSD
There are two SSDs in each security module. They are configured in a RAID 1 configuration. If one or both
SSDs fail, you must decommission the security module and acknowledge the slot to start the SSD installation
and update the inventory. See the "Security Module/Engine Management" chapter in the Cisco FXOS Firepower
Chassis Manager Configuration Guide for the instructions. After you decommission the security module, you
can remove the SSDs, install the new SSDs, and acknowledge the slot to bring the security module back
online.
Once you replace the SSD, the storage controller rebuilds the newly installed SSD and no loss of data
should occur. If both SSDs fail, no data can be recovered.
Note
The two SSDs in RAID 1 store each other's data. Breaking the RAID pair to use in another service
module causes the service module to fail discovery by the Supervisor.
Note
Safety Warnings
Take note of the following warnings:
Statement 1028—More Than One Power Supply
This unit might have more than one power supply connection. To reduce risk of electric shock,
remove all connections to de-energize the unit.
Warning
Statement 1030—Equipment Installation
Only trained and qualified personnel should be allowed to install, replace, or service this equipment.
Warning
Installation, Maintenance, and Upgrade
6
Installation, Maintenance, and Upgrade
Remove and Replace the SSD

Statement 1073—No User-Serviceable Parts
There are no serviceable parts inside. To avoid risk of electric shock, do not open.
Warning
Statement 1089—Instructed and Skilled Person Definitions
An instructed person is someone who has been instructed and trained by a skilled person and takes
the necessary precautions when working with equipment.
A skilled person or qualified personnel is someone who has training or experience in the equipment
technology and understands potential hazards when working with equipment.
Warning
Statement 1090—Installation by Skilled Person
Only a skilled person should be allowed to install, replace, or service this equipment. See statement
1089 for the definition of a skilled person.
Warning
Statement 1091—Installation by an Instructed Person
Only an instructed person or skilled person should be allowed to install, replace, or service this
equipment. See statement 1089 for the definition of an instructed or skilled person.
Warning
Step 1 Decommission the security module.
Step 2 To remove an SSD, face the front of the chassis, press the handle release on the SSD and gently pull it out of the slot.
Installation, Maintenance, and Upgrade
7
Installation, Maintenance, and Upgrade
Remove and Replace the SSD

Figure 3: Remove the SSD
Handle release2Handle1
Step 3 To replace the SSD, hold the SSD in front of slot 1, push it in gently until it is seated, and close the handle.
Step 4 Tighten the captive screws on either side of the SSD.
Step 5 Acknowledge the slot to start the SSD installation.
Install, Remove, and Replace the Single-Wide Network Module
This procedure describes how to install a network module into an empty slot that has never contained a network
module, and how to remove an installed network module and replace it with another network module.
Hot Swapping
Verify that you have the correct software to support hot swapping on the Firepower 10-Gb and 40-Gb
nonhardware bypass network modules. See Cisco Firepower 4100/9300 FXOS Compatibility for the
software compatibility matrix. You must hot swap with an identical network module, that is, a network
module with the same PID. See Product ID Numbers for a list of the network module PIDs. You must
bring the network module offline using the appropriate CLI commands before removing the network
module from the chassis so that all network module configuration is saved.
We do not recommend that you remove the network module without bringing it properly offline
using the appropriate CLI commands.
Caution
Installation, Maintenance, and Upgrade
8
Installation, Maintenance, and Upgrade
Install, Remove, and Replace the Single-Wide Network Module

Verify that you have the correct ROMMON on the Supervisor to support hot swapping. For
instructions on how to verify your firmware package version and to upgrade the firmware if
necessary, see the Cisco Firepower 4100/9300 FXOS Firmware Upgrade Guide.
Note
To remove and replace the network modules that do not currently support hot swapping, power off the chassis,
replace the network module, and then power the chassis back on.
Verify that you have the correct ROMMON on the Supervisor to support the 100-Gb network modules
(FPR9K-NM-4X100G and FPR9K-NM-2X100G). For instructions on how to verify your firmware
package version and to upgrade the firmware if necessary, see the Cisco Firepower 4100/9300 FXOS
Firmware Upgrade Guide.
Note
The following figure shows the front panel of the 10-Gb nonhardware bypass network module. The location
of the captive screw, ports, and LEDs is shown. See Network Modules for more information about the other
single-wide network modules.
Figure 4: Firepower Network Module 10 Gb
Ethernet X/12Captive screw/handle1
Ethernet X/54Ethernet X/33
Ethernet X/26Ethernet X/75
Ethernet X/68Ethernet X/47
Network activity LEDs
• Off—No connection or port is not in use.
• Amber—No link or network failure.
• Green—Link up.
• Green, flashing—Network activity.
10Ethernet X/89
Installation, Maintenance, and Upgrade
9
Installation, Maintenance, and Upgrade
Install, Remove, and Replace the Single-Wide Network Module

Safety Warnings
Take note of the following component replacement safety warnings:
Statement 1028—More Than One Power Supply
This unit might have more than one power supply connection. To reduce risk of electric shock,
remove all connections to de-energize the unit.
Warning
Statement 1030—Equipment Installation
Only trained and qualified personnel should be allowed to install, replace, or service this equipment.
Warning
Statement 1073—No User-Serviceable Parts
There are no serviceable parts inside. To avoid risk of electric shock, do not open.
Warning
Statement 1089—Instructed and Skilled Person Definitions
An instructed person is someone who has been instructed and trained by a skilled person and takes
the necessary precautions when working with equipment.
A skilled person or qualified personnel is someone who has training or experience in the equipment
technology and understands potential hazards when working with equipment.
Warning
Statement 1090—Installation by Skilled Person
Only a skilled person should be allowed to install, replace, or service this equipment. See statement
1089 for the definition of a skilled person.
Warning
Statement 1091—Installation by an Instructed Person
Only an instructed person or skilled person should be allowed to install, replace, or service this
equipment. See statement 1089 for the definition of an instructed or skilled person.
Warning
Installation, Maintenance, and Upgrade
10
Installation, Maintenance, and Upgrade
Install, Remove, and Replace the Single-Wide Network Module

Step 1 To install a new network module for the first time into an empty slot, do the following:
a) Power down the chassis by moving the power switch to the OFF position.
b) Follow Steps 5 through 7 to install the new network module.
c) Power on the chassis by moving the power switch to the ON position.
The state for the new network module is OIR Failed.
d) To change the status of the network module to Online, reboot the chassis. See the "Rebooting the Firepower 4100/9300
Chassis" topic in the System Administration chapter in the FXOS Configuration Guide for your software version.
Step 2 To remove and replace an existing network module, do one of the following:
a) Save your configuration.
b) Power down the chassis by moving the power switch to the OFF position (if removing a network module that does
not support hot swapping).
c) Bring the network module offline using the appropriate CLI command (if removing a network module that supports
hot swapping). All network module configuration is saved. See the “Taking a Network Module Offline or Online”
topic in the Security Module/Engine Management chapter in the FXOS Configuration Guide for your software version.
d) Continue with Step 3.
Step 3 To remove the network module, loosen the captive screw on the left of the network module, release the handle until it is
fully rotated, and then gently pull the network module out of the chassis.
Installation, Maintenance, and Upgrade
11
Installation, Maintenance, and Upgrade
Install, Remove, and Replace the Single-Wide Network Module

Figure 5: Remove and Replace the Single-Wide Network Module
If the slot is to remain empty, install a blank faceplate to ensure proper airflow and to keep dust out of the chassis;
otherwise, install another network module.
Step 4 (Optional) If you are installing a single-wide network module into a double-wide slot, you must install a divider. The
blank faceplates are for a single slot, so install the divider if you are covering two single network slots.
The original 9300 chassis and the newer 9300 chassis have different dividers. You can order FPR9K-NM-DIV=,
which contains a screw and both dividers in case you have lost the divider (part number 800-101936-01) for
the older chassis or you need the new divider (part number 700-112465-01) for the newer chassis.
Note
Step 5 To install a new network module, hold the network module in front of the network module slot on the right side of the
chassis with the handle fully extended. Slowly push the module into the network module slot until the handle catches on
the mating feature in the chassis. The handle should engage correctly.
Step 6 Gently push on the handle until it is fully seated on the network module faceplate and the module is fully seated in the
chassis.
Step 7 Tighten the captive screw on the left of the network module.
Step 8 Do one of the following:
Installation, Maintenance, and Upgrade
12
Installation, Maintenance, and Upgrade
Install, Remove, and Replace the Single-Wide Network Module

a) Power up the chassis so that the new network module is recognized (if the new network module does not support hot
swapping).
b) Bring the new network module online using the appropriate CLI command (if the new network module supports hot
swapping). The saved network module configuration is automatically reapplied when the network module is back
online.
If you install a network module that is a different PID than the original network module, the saved
configuration is deleted and the default configuration is applied. You must enter the acknowledge command
to confirm the network module PID change.
Note
Follow the procedures in the FXOS Configuration Guide to connect to the network module and make sure that it has
been discovered correctly by the Firepower 9300.
Install, Remove, and Replace the Double-Wide Network Module
This procedure describes how to install a network module into an empty slot that has never contained a network
module, and how to remove an installed network module and replace it with another network module.
Make sure your Firepower 9300 has the correct firmware package installed before you install the
Firepower 100-Gb network module. For instructions on how to verify your firmware package version
and to upgrade the firmware if necessary, see the Cisco Firepower 4100/9300 FXOS Firmware Upgrade
Guide.
Note
The Firepower 100-Gb network module is an optional, removable I/O module that provides two fiber 100
Gigabit Ethernet interfaces. It takes up two slots in the Firepower 9300 and supports single and multimode.
Verify that your software supports hot swapping. See Cisco Firepower 4100/9300 FXOS Compatibility for
the software compatibility matrix. After removing and replacing the network module, you must reboot the
system so that the Firepower 9300 discovers the new network module. See Network Modules for more
information about Firepower 9300 network modules.
The following figure shows the front panel view of the Firepower 9300 100-Gb network module.
Installation, Maintenance, and Upgrade
13
Installation, Maintenance, and Upgrade
Install, Remove, and Replace the Double-Wide Network Module

Figure 6: 100-Gb Network Module
100-Gigabit Ethernet QSFP28 fiber port
Ethernet X/1
2Captive screw on handle1
Network activity LEDs
• Off—No connection or port is not in use.
• Amber—No link or network failure.
• Green, flashing—Network activity.
4100-Gigabit Ethernet QSFP28 fiber port
Ethernet X/2
3
Safety Warnings
Take note of the following component replacement safety warnings:
Statement 1028—More Than One Power Supply
This unit might have more than one power supply connection. To reduce risk of electric shock,
remove all connections to de-energize the unit.
Warning
Statement 1030—Equipment Installation
Only trained and qualified personnel should be allowed to install, replace, or service this equipment.
Warning
Installation, Maintenance, and Upgrade
14
Installation, Maintenance, and Upgrade
Install, Remove, and Replace the Double-Wide Network Module

Statement 1073—No User-Serviceable Parts
There are no serviceable parts inside. To avoid risk of electric shock, do not open.
Warning
Statement 1089—Instructed and Skilled Person Definitions
An instructed person is someone who has been instructed and trained by a skilled person and takes
the necessary precautions when working with equipment.
A skilled person or qualified personnel is someone who has training or experience in the equipment
technology and understands potential hazards when working with equipment.
Warning
Statement 1090—Installation by Skilled Person
Only a skilled person should be allowed to install, replace, or service this equipment. See statement
1089 for the definition of a skilled person.
Warning
Statement 1091—Installation by an Instructed Person
Only an instructed person or skilled person should be allowed to install, replace, or service this
equipment. See statement 1089 for the definition of an instructed or skilled person.
Warning
Step 1 To install a new network module for the first time into an empty slot, do the following:
a) Power down the chassis by moving the power switch to the OFF position.
b) Follow Steps 4 through 6 to install the new network module.
c) Power on the chassis by moving the power switch to the ON position.
The state for the new network module is OIR Failed.
d) To change the status of the network module to Online, reboot the chassis. See the "Rebooting the Firepower 4100/9300
Chassis" topic in the System Administration chapter in the FXOS Configuration Guide for your software version.
Step 2 To remove and replace an existing network module, do one of the following:
a) Save your configuration.
b) Power down the chassis by moving the power switch to the OFF position.
c) Continue with Step 3.
Step 3 Do one of the following:
a) If you are removing single-wide network modules installed in the two network module slots, loosen the captive screw
on the left of the network modules, release the handles, and then gently pull the network modules out of the chassis.
Remove the divider between the two network modules by loosening the captive screw at the top of the divider and
then pull it out.
Installation, Maintenance, and Upgrade
15
Installation, Maintenance, and Upgrade
Install, Remove, and Replace the Double-Wide Network Module

Save the divider in case you ever want to replace the 100-Gb double-wide network module with one or two
single-wide network modules. Or you can order the divider kit (FPR9K-NM-DIV=), which contains two
dividers, one for the original 9300 chassis and one for the newer 9300 chassis.
Note
Figure 7: Remove the Network Module Divider
b) If you are removing a 100-Gb network module, loosen the captive screw on the left of the module, release the handle,
and gently pull it out.
If the slot is to remain empty, install a blank faceplate to ensure proper airflow and to keep dust out of the chassis;
otherwise, install another network module. The blank faceplates are for a single slot, so install the divider if you are
covering two single network slots.
Step 4 Hold the 100-Gb network module in front of the double network module slot on the right side of the chassis with the
handle rotated fully out. Slowly push the module into the network module slot until the handle catches on the mating
feature in the chassis. The handle should engage correctly.
Installation, Maintenance, and Upgrade
16
Installation, Maintenance, and Upgrade
Install, Remove, and Replace the Double-Wide Network Module

Figure 8: Install the 100-Gb Network Module
Step 5 Gently push on the handle until it is fully seated on the network module faceplate and the module is fully seated in the
chassis.
Step 6 Tighten the captive screw on the left of the network module.
Step 7 Power on the chassis so that the new network module is recognized.
Follow the procedures in the FXOS Configuration Guide to connect to the network module and make sure that it has
been discovered correctly by the Firepower 9300.
Remove and Replace the Power Supply Module
You can remove and replace the power supply module while the system is running. Make sure that at least
one of the power supply modules is active while hot-swapping.
Replace power supplies immediately. Power supply blanks are not available.
Note
Installation, Maintenance, and Upgrade
17
Installation, Maintenance, and Upgrade
Remove and Replace the Power Supply Module

Safety Warnings
Take note of the following power and component removal safety warnings:
Statement 347—Failure to Secure the Expansion Module
To reduce the risk of electric shock, secure the modules with the provided screws.
Warning
Statement 1003—DC Power Disconnection
Before performing any of the following procedures, ensure that power is removed from the DC
circuit.
Warning
Statement 1005—Circuit Breaker
This product relies on the building’s installation for short-circuit (overcurrent) protection. To reduce
risk of electric shock or fire, ensure that the protective device is rated not greater than:
AC: 20A
DC: 40A
Warning
Statement 1017—Restricted Area
This unit is intended for installation in restricted access areas. Only skilled, instructed, or qualified
personnel can access a restricted access area.
Warning
Statement 1018—Supply Circuit
To reduce risk of electric shock and fire, take care when connecting units to the supply circuit so
that wiring is not overloaded.
Warning
Statement 1022—Disconnect Device
To reduce risk of electric shock and fire, a readily accessible two-poled disconnect device must be
incorporated in the fixed wiring.
Warning
Statement 1025—Use Copper Conductors Only
To reduce risk of fire, use copper conductors only.
Warning
Installation, Maintenance, and Upgrade
18
Installation, Maintenance, and Upgrade
Remove and Replace the Power Supply Module

Statement 1028—More Than One Power Supply
This unit might have more than one power supply connection. To reduce risk of electric shock,
remove all connections to de-energize the unit.
Warning
Statement 1029—Blank Faceplates and Cover Panels
Blank faceplates and cover panels serve three important functions: they reduce the risk of electric
shock and fire, they contain electromagnetic interference (EMI) that might disrupt other equipment,
and they direct the flow of cooling air through the chassis. Do not operate the system unless all
cards, faceplates, front covers, and rear covers are in place.
Warning
Statement 1030—Equipment Installation
Only trained and qualified personnel should be allowed to install, replace, or service this equipment.
Warning
Statement 1073—No User-Serviceable Parts
There are no serviceable parts inside. To avoid risk of electric shock, do not open.
Warning
Statement 1046—Installing or Replacing the Unit
To reduce risk of electric shock, when installing or replacing the unit, the ground connection must
always be made first and disconnected last.
Warning
Statement 1089—Instructed and Skilled Person Definitions
An instructed person is someone who has been instructed and trained by a skilled person and takes
the necessary precautions when working with equipment.
A skilled person or qualified personnel is someone who has training or experience in the equipment
technology and understands potential hazards when working with equipment.
Warning
Installation, Maintenance, and Upgrade
19
Installation, Maintenance, and Upgrade
Remove and Replace the Power Supply Module

Statement 1090—Installation by Skilled Person
Only a skilled person should be allowed to install, replace, or service this equipment. See statement
1089 for the definition of a skilled person.
Warning
Statement 1091—Installation by an Instructed Person
Only an instructed person or skilled person should be allowed to install, replace, or service this
equipment. See statement 1089 for the definition of an instructed or skilled person.
Warning
Step 1 To remove the power supply module, face the front of the chassis, and loosen the captive screw on the right side of the
power supply module.
Step 2 Lift up the handle of the power supply to unseat it.
Step 3 Using the handle, pull the power supply module from its slot. Place your other hand under the power supply module to
support it while you slide it out of the chassis. Install the new power supply module immediately.
Installation, Maintenance, and Upgrade
20
Installation, Maintenance, and Upgrade
Remove and Replace the Power Supply Module