Cisco Firepower 9300 Manual

Cisco Firepower 9300 Hardware Installation Guide
First Published: 2015-07-16
Last Modified: 2021-09-13
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of
the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.
Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL:
https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a
partnership relationship between Cisco and any other company. (1721R)
©2015-2021 Cisco Systems, Inc. All rights reserved.

CONTENTS
Overview 1
CHAPTER 1
Features 1
Chassis Components 4
Deployment Options 6
Package Contents 6
Serial Number Location 8
Front Panel 9
Rear Panel 10
Supervisor 11
Security Modules 13
Network Modules 15
10-Gb Network Module 16
40-Gb Network Module 17
100-Gb Network Module (Two Ports, Single Wide) 19
100-Gb Network Module (Four Ports, Single Wide) 20
100-Gb Network Module (Double Wide) 21
Hardware Bypass Network Modules 21
40-Gb Network Module with Hardware Bypass 23
10-Gb SR/10-Gb LR Network Module with Hardware Bypass 24
Power Supply Modules 26
Fan Modules 28
Supported SFP/SFP+ and QSFP Transceivers 28
Hardware Specifications 31
Product ID Numbers 33
Power Cord Specifications 36
Cisco Firepower 9300 Hardware Installation Guide
iii

Installation Preparation 43
CHAPTER 2
Installation Warnings 43
Safety Recommendations 46
Maintain Safety with Electricity 46
Prevent ESD Damage 47
Site Environment 47
Site Considerations 47
Power Supply Considerations 48
Rack Configuration Considerations 48
Rack-Mount and Ground the Chassis 51
CHAPTER 3
Unpack and Inspect the Chassis 51
Rack-Mount the Chassis 52
Ground the Chassis 56
Installation, Maintenance, and Upgrade 59
CHAPTER 4
Remove and Replace the Supervisor 59
Install, Remove, and Replace the Security Module 60
Remove and Replace the SSD 62
Install, Remove, and Replace the Single-Wide Network Module 63
Install, Remove, and Replace the Double-Wide Network Module 67
Remove and Replace the Power Supply Module 70
Connect the DC Power Supply Module 72
Connect the HVDC Power Supply Module 73
Remove and Replace the Fan Module 75
Install the FIPS Opacity Shield 77
Cisco Firepower 9300 Hardware Installation Guide
iv
Contents

CHAPTER 1
Overview
•Features, on page 1
•Chassis Components, on page 4
•Deployment Options, on page 6
•Package Contents, on page 6
•Serial Number Location, on page 8
•Front Panel, on page 9
•Rear Panel, on page 10
•Supervisor, on page 11
•Security Modules, on page 13
•Network Modules, on page 15
•Hardware Bypass Network Modules, on page 21
•Power Supply Modules, on page 26
•Fan Modules, on page 28
•Supported SFP/SFP+ and QSFP Transceivers, on page 28
•Hardware Specifications, on page 31
•Product ID Numbers, on page 33
•Power Cord Specifications, on page 36
Features
The Cisco Firepower 9300 security appliance is a next generation network and content security platform. Its
modular standalone chassis offers high-performance and flexible I/O options, which enable it to run multiple
security services simultaneously.
The Firepower 9300 runs FXOS and can deploy multiple application types. See Cisco Firepower 4100/9300
FXOS Compatibility for more information about software version support for each component in the Firepower
9300. See Product ID Numbers, on page 33 for a list of the component product IDs (PIDs) associated with
the Firepower 9300.
The following figure shows a fully populated Firepower 9300.
Cisco Firepower 9300 Hardware Installation Guide
1

Figure 1: Firepower 9300
The following table lists the hardware features of the Firepower 9300.
Table 1: Firepower 9300 Features
DescriptionFeature
• Criteria Common Criteria Certification (CC) for the Network Device
Collaborative Protection Profile (NDcPPv2.1) for ASA 9.12.xand FX-OS
2.6.x
• Federal Information Processing Standards (FIPS) 140-2 on ASA 9.12.x,
FTD 6.4.x, and FX-OS 2.6.x
See the "Security Certifications Compliance" chapter in the Cisco
FXOS CLI Configuration Guide or Cisco FXOS Firepower Chassis
Manager Configuration Guide for the procedure to enable security
modes.
Note
Security standards
certifications
3 RUForm factor
Mount rails included (4-post EIA-310-D rack) with span between front and rear
rails of 24 to 36 in.
Rack mount
Front to rear
Cold aisle to hot aisle
Airflow
Cisco Firepower 9300 Supervisor with eight 10-Gigabit Ethernet ports and two
network module slots for I/O expansion
See Chassis Components, on page 4 for more information about the chassis
Supervisor.
Supervisor
ThreeSecurity module slots
Cisco Firepower 9300 Hardware Installation Guide
2
Overview
Features

DescriptionFeature
• SM-24—24-physical core CPU security module (NEBS ready)
• SM-36—36-physical core CPU high performance security module
• SM-40—40-physical core CPU Crypto security module (NEBS ready)
• SM-44—44-physical core CPU high performance security module (NEBS
ready)
• SM-48—48-physical core CPU Crypto security module (NEBS ready)
• SM-56—56-physical core CPU Crypto security module
See Security Modules, on page 13 for more information about the security
modules.
Supported security
modules
Two
Located in the Supervisor
Network module slots
• 8-port 10-Gigabit Ethernet SFP+
• 4-port 40-Gigabit Ethernet QSFP+
• 2-port 100-Gigabit Ethernet QSFP28 (double-wide, occupies both network
module slots)
• 2-port 100-Gigabit Ethernet QSFP28
• 4-port 100-Gigabit Ethernet QSFP28
• 2-port 40-Gigabit Ethernet QSFP+ (built-in) with hardware bypass
•6-port 10-Gigabit Ethernet SR/LR fiber SFP+ (built-in) with hardware bypass
You can deploy the Firepower 9300 as a dedicated threat sensor with
hardware bypass network modules.
Note
Supported network
modules
256-GB DDR4 DRAM per security moduleMemory
Up to twenty-four 10-Gigabit Ethernet (SFP+) interfaces; up to eight 40-Gigabit
Ethernet (QSFP+) interfaces with two network modules; up to eight 100-Gigabit
Ethernet (SFP+) interfaces
Maximum number of
interfaces
One Gigabit Ethernet port on the Supervisor
Supports 1-Gb fiber and copper SFPs
Management port
One RJ-45 consoleSerial port
One USB 2.0 Type AUSB port
Displays serial numberPullout asset card
On rear panelGrounding lug
Cisco Firepower 9300 Hardware Installation Guide
3
Overview
Features

DescriptionFeature
On front panelLocator beacon
On rear panel
The initial Firepower 9300 chassis does not have a power switch.
Note
Power switch
Two
On rear panel
Power supply slots
AC, DC, and HVDC
Do not mix power supply types or wattage.
Note
Power supply types
Yes 1 + 1Redundant power
Four (hot-swappable)
On rear panel
Fan slots
SM-24, SM-36, SM-44—Up to 2.4 TB per chassis (1.2 TB per security module
in RAID 1 configuration)
SM-40, SM-48, SM-56—UP to 4.8 TB per chassis (1.6 TB per security module
in RAID 1 Configuration)
Storage
Chassis Components
The Firepower 9300 chassis contains the following components:
• Firepower 9300 Supervisor—Chassis supervisor module
• Management port
• RJ-45 console port
• USB Type A port
• Eight ports for 1- or 10-Gigabit Ethernet small form-factor pluggable (SFP) ports (fiber and copper)
• Firepower 9300 Security Module—Up to three security modules
• Firepower Network Module—Two single-wide network modules or one double-wide network module
• Two power supply modules (AC or DC)
• Four fan modules
Cisco Firepower 9300 Hardware Installation Guide
4
Overview
Chassis Components

Power Switch
The initial Firepower 9300 AC chassis has no external power switch. You reset the Firepower 9300 using
CLI commands. To physically power cycle the 9300, you must unplug the power cord and then plug the
power cord back in.
Note
After removing power from the chassis either by moving the power switch to OFF or unplugging the
power cord, wait at least 10 seconds before turning power back ON.
Note
The Firepower 9300 chassis has a standby power switch at the rear of the chassis. It controls both power
supply modules. You must shut down the software applications gracefully before turning the switch to
OFF.
Turning the switch to OFF turns off the main power to the Supervisor and the security modules regardless
of the software status, which can result in the loss of any data in transit and the corruption of data on the
SSDs. You must shut down the software applications gracefully before turning the switch to OFF.
Warning
Graceful Shutdown of the Chassis
You can gracefully shut down the chassis from either the CLI or Chassis Manager.
See the "Powering Off the Firepower 4100/9300 Chassis" topic in the System Administration chapter in
the FXOS CLI Configuration Guide for your software version for the procedure to shut down the chassis
from the CLI. The graceful shutdown usually takes as little as a few seconds to as long as three minutes.
When the System Halted message appears, you can move the power switch on the rear of the chassis
to OFF.
See "Powering Off the Firepower 4100/9300 Chassis" topic in the System Administration chapter in the
FXOS Configuration Guide for your software version for the procedure to shut down the chassis from
the Chassis Manager. After the shutdown is completed, you can move the power switch on the rear of
the chassis to OFF.
When you shut down the chassis, the security modules are automatically shut down.
Graceful Shutdown of the Security Modules
You can shut down the security modules individually from the CLI, the Chassis Manager, or you can
use the power switch on the front of each security module. Push the power button briefly on the front
panel of each security module. When the power button changes to amber, you can move the power switch
on the rear of the chassis to OFF.
Shut the security modules down individually when you are replacing a security module.
You must push the power button on each security module installed in the 9300 chassis. You can have
up to three security modules installed in the chassis.
Note
Cisco Firepower 9300 Hardware Installation Guide
5
Overview
Chassis Components

See the "Power Off/On an Installed Module/Engine" in the Security/Module/Engine Management chapter
of the FXOS CLI Configuration Guide for your software version for the procedure to shut down the
security modules gracefully using CLI commands from the Supervisor. When you see Oper Power: off
for all slots, you can move the power switch on the rear of the chassis to OFF.
See the "Power Off/On an Installed Security Module/Engine" topic in the Security Module/Engine
Management chapter of the FXOS Configuration Guide for your software version for the procedure to
shut down the security module from the Chassis Manager. After the shutdown is complete, you can move
the power switch on the rear of the chassis to OFF.
Deployment Options
Here are some examples of how you can deploy the Firepower 9300:
• At the core/aggregation layer of a three-tier data center in a high availability configuration.
• As a dedicated multifunction security service within converged infrastructure stacks (vBlock, FlexPod,
for example) at the access layer.
• As a high-performance data center security appliance between the WAN edge and data center core in an
high availability configuration.
• As a leaf that exclusively offers security functions in a spine/leaf data center design.
Package Contents
The following figure shows the package contents for the Firepower 9300. Note that the contents are subject
to change and your exact contents might contain additional or fewer items.
Cisco Firepower 9300 Hardware Installation Guide
6
Overview
Deployment Options