Cisco Firepower 9300 Manual

Cisco Firepower 9300 Hardware Installation Guide
First Published: 2015-07-16
Last Modified: 2019-09-30
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of
the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL:
https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a
partnership relationship between Cisco and any other company. (1721R)
©2015-2019 Cisco Systems, Inc. All rights reserved.

CONTENTS
Overview 1
CHAPTER 1
Features 1
机箱组件 4
Deployment Options 6
装箱清单 6
序列号位置 8
前面板 9
Rear Panel 10
管理引擎 11
安全模块 13
网络模块 16
10-Gb 网络模块 16
40-Gb 网络模块 18
100-Gb 网络模块（两端口单位宽） 18
100-Gb网络模块（四个端口，单个宽） 20
100-Gb 网络模块（双位宽） 21
硬件旁路网络模块 21
具有硬件旁路的 40-Gb 网络模块 23
10-Gb SR/10-Gb LR 网络模块（带硬件旁路） 24
电源模块 26
Fan Modules 28
支持的 SFP/SFP+ 和QSFP 收发器 28
硬件规格 31
产品 ID 编号 33
Cisco Firepower 9300 Hardware Installation Guide
iii

电源线规格 36
Installation Preparation 43
CHAPTER 2
Installation Warnings 43
安全建议 46
维护用电安全 46
防范 ESD 损害 47
现场环境 47
现场考虑因素 47
Power Supply Considerations 48
机架配置注意事项 48
Mount and Connect 49
CHAPTER 3
拆箱并检查机箱 49
将机箱安装到机架上 50
将机箱接地 54
安装 FIPS 不透明防护罩 56
连接电缆、打开电源并检验连通性 60
维护和升级 63
CHAPTER 4
拆卸和更换管理引擎 63
拆卸和更换安全模块 64
Remove and Replace the SSD 66
安装单宽网络模块 67
安装双宽网络模块 70
拆卸和更换电源模块 73
连接直流电源模块 75
连接 HVDC 电源模块 76
Remove and Replace the Fan Module 78
Cisco Firepower 9300 Hardware Installation Guide
iv
Contents

CHAPTER 1
Overview
•Features , on page 1
•机箱组件 ，第 4页
•Deployment Options, on page 6
•装箱清单 ，第 6页
•序列号位置 ，第 8页
•前面板 ，第 9页
•Rear Panel, on page 10
•管理引擎 ，第 11 页
•安全模块 ，第 13 页
•网络模块 ，第 16 页
•硬件旁路网络模块 ，第 21 页
•电源模块 ，第 26 页
•Fan Modules, on page 28
•支持的 SFP/SFP+ 和QSFP 收发器 ，第 28 页
•硬件规格 ，第 31 页
•产品 ID 编号 ，第 33 页
•电源线规格 ，第 36 页
Features
The Cisco Firepower 9300 security appliance is a next generation network and content security platform. Its
modular standalone chassis offers high-performance and flexible I/O options, which enable it to run multiple
security services simultaneously.
The Firepower 9300 runs FXOS and can deploy multiple application types. See Cisco Firepower 4100/9300
FXOS Compatibility for more information about software version support for each component in the Firepower
9300. See 产品 ID 编号, on page 33 for a list of the component product IDs (PIDs) associated with the
Firepower 9300.
The following figure shows a fully populated Firepower 9300.
Cisco Firepower 9300 Hardware Installation Guide
1

Figure 1: Firepower 9300
The following table lists the hardware features of the Firepower 9300.
Table 1: Firepower 9300 Features
DescriptionFeature
Common Criteria (CC) and Federal Information Processing Standards (FIPS)
For more information, see the "Security Certifications Compliance"
topic in the Security Certifications Compliance chapter in the FXOS
Configuration Guide for your software version.
Note
Security standards
certifications
3 RUForm factor
Cisco Firepower 9300 Hardware Installation Guide
2
Overview
Features

DescriptionFeature
Mount rails included (4-post EIA-310-D rack) with span between front and rear
rails of 24 to 36 in.
Rack mount
Front to rear
Cold aisle to hot aisle
Airflow
Cisco Firepower 9300 Supervisor with eight 10-Gigabit Ethernet ports and two
network module slots for I/O expansion
See 机箱组件, on page 4 for more information about the chassis Supervisor.
Supervisor
ThreeSecurity module slots
• SM-24—24-physical core CPU security module (NEBS ready)
• SM-36—36-physical core CPU high performance security module
• SM-40—40-physical core CPU Crypto security module (NEBS ready)
• SM-44—44-physical core CPU high performance security module (NEBS
ready)
• SM-48—48-physical core CPU Crypto security module (NEBS ready)
• SM-56—56-physical core CPU Crypto security module
See 安全模块, on page 13 for more information about the security modules.
Supported security
modules
Two
Located in the Supervisor
Network module slots
• 8-port 10-Gigabit Ethernet SFP+
• 4-port 40-Gigabit Ethernet QSFP+
• 2-port 100-Gigabit Ethernet QSFP28 (double-wide, occupies both network
module slots)
• 2-port 100-Gigabit Ethernet QSFP28
• 4-port 100-Gigabit Ethernet QSFP28
• 2-port 40-Gigabit Ethernet QSFP+ (built-in) with hardware bypass
•6-port 10-Gigabit Ethernet SR/LR fiber SFP+ (built-in) with hardware bypass
You can deploy the Firepower 9300 as a dedicated threat sensor with
hardware bypass network modules.
Note
Supported network
modules
256-GB DDR4 DRAM per security moduleMemory
Up to twenty-four 10-Gigabit Ethernet (SFP+) interfaces; up to eight 40-Gigabit
Ethernet (QSFP+) interfaces with two network modules; up to eight 100-Gigabit
Ethernet (SFP+) interfaces
Maximum number of
interfaces
Cisco Firepower 9300 Hardware Installation Guide
3
Overview
Features

DescriptionFeature
One Gigabit Ethernet port on the Supervisor
Supports 1-Gb fiber or copper SFPs
Management port
One RJ-45 consoleSerial port
One USB 2.0 Type AUSB port
Displays serial numberPullout asset card
On rear panelGrounding lug
On front panelLocator beacon
On rear panel
The initial Firepower 9300 chassis does not have a power switch.
Note
Power switch
Two
On rear panel
Power supply slots
AC, DC, and HVDC
Do not mix power supply types or wattage.
Note
Power supply types
Yes 1 + 1Redundant power
Four (hot-swappable)
On rear panel
Fan slots
SM-24, SM-36, SM-44—Up to 2.4 TB per chassis (1.2 TB per security module
in RAID 1 configuration)
SM-40, SM-48, SM-56—UP to 4.8 TB per chassis (1.6 TB per security module
in RAID 1 Configuration)
Storage
机箱组件
Firepower 9300 机箱包含以下组件：
• Firepower 9300 管理引擎 -机箱管理引擎模块
•管理端口
• RJ-45 控制台端口
• USB A 型端口
• 8 个端口，用于 1千兆或 10 千兆以太网 SFP（光纤和铜缆）
Cisco Firepower 9300 Hardware Installation Guide
4
Overview
机箱组件

• Firepower 9300 安全模块 -最多三个安全模块
• Firepower 网络模块 -两个单位宽网络模块或一个双位宽网络模块
•两个电源模块（交流或直流）
•四个风扇模块
电源开关
原始 Firepower 9300 AC 机箱不包含外部电源开关。使用 CLI 命令重置 Firepower 9300。要以物
理方式重启 9300，您必须拔掉电源线，然后重新插上电源线。
注释
关闭机箱电源（将电源开关切换至“关闭”(OFF) 位置，或拔掉电源线）后，至少等待 10 秒，再
重新开机。
注释
Firepower 9300 机箱在机箱后部具有备用电源开关，可用于控制两个电源模块。您必须先正常关
闭软件应用，再将开关切换至“关闭”(OFF) 位置。
如果将开关切换至“关闭”(OFF) 位置，无论软件状态如何，管理引擎和安全模块的主电源都将关
闭，这不仅会导致所有正在传输的数据发生丢失，而且可能损坏 SSD 中的数据。您必须先正常
关闭软件应用，再将开关切换至“关闭”(OFF) 位置。
警告
正常关闭机箱
您可以从 CLI 或机箱管理器正常关闭机箱。
请参阅FXOS CLI配置指南中系统管理一章中的“关闭Firepower 4100/9300机箱”小节，以获取符
合您软件版本的从CLI关闭机箱的流程。正常关闭通常只需要几秒，但是最长可能需要三分钟。
当屏幕上显示 System Halted 消息时，您可以将机箱后部的电源开关切换至“关闭”(OFF) 位置。
请参阅FXOS CLI配置指南中系统管理一章中的“关闭Firepower 4100/9300机箱”小节，以获取符
合您软件版本的从CLI关闭机箱的流程。完成关机后，您可以将机箱背面的电源开关切换至“关
闭”(OFF) 位置。
当您关闭机箱时，安全模块将自动关闭。
正常关闭安全模块
您可以从 CLI 或机箱管理器单独关闭安全模块，也可以使用每个安全模块正面的电源开关。短
暂按住每个安全模块前面板上的电源按钮。当电源按钮变为琥珀色后，您即可将机箱后部的电
源开关切换至“关闭”(OFF) 位置。
在更换安全模块时，可单独关闭安全模块。
Cisco Firepower 9300 Hardware Installation Guide
5
Overview
机箱组件

您必须按下安装在9300机箱中每个安全模块上的电源按钮。您最多可以在机箱中安装三个安全
模块。
注释
请参阅FXOS CLI配置指南Security/Module/Engine一章中的“打开/关闭已安装模块/引擎”内容，以
获取符合您软件版本的用主管CLI命令关闭安全模块的流程。当系统对所有插槽显示 Oper Power:
off 后，您可以将机箱后部的电源开关切换至“关闭”(OFF) 位置。
请参阅FXOS CLI配置指南Security/Module/Engine一章中的“打开/关闭已安装模块/引擎”内容，以
获取符合您软件版本的用主管 CLI 命令关闭安全模块的流程。完成关机后，您可以将机箱背面
的电源开关切换至“关闭”(OFF) 位置。
Deployment Options
Here are some examples of how you can deploy the Firepower 9300:
• At the core/aggregation layer of a three-tier data center in a high availability configuration.
• As a dedicated multifunction security service within converged infrastructure stacks (vBlock, FlexPod,
for example) at the access layer.
• As a high-performance data center security appliance between the WAN edge and data center core in an
high availability configuration.
• As a leaf that exclusively offers security functions in a spine/leaf data center design.
装箱清单
下图显示了 Firepower 9300 的装箱清单。请注意，装箱清单可能有所变动，实际配件的数量可能多
于或少于装箱清单上所列的内容。
Cisco Firepower 9300 Hardware Installation Guide
6
Overview
Deployment Options