Cisco ISA 3000 User manual

Product Overview
This chapter provides an overview of the features available for the Cisco ISA 3000
•General Description, on page 1
•Hardware Features, on page 7
•Alarm Ports, on page 11
•Power Supply, on page 11
•Temperature Sensor, on page 12
General Description
The Cisco ISA 3000 is a DIN Rail mounted ruggedized industrial security appliance that provides firewall,
threat defense, and VPN services. The term DIN Rail describes a metal rail of a standard type widely used
for mounting circuit breakers and industrial control equipment inside equipment racks. The term derives from
the original specifications published by Deutsches Institut für Normung (DIN) in Germany. The device can
run either the ASA or Firepower Threat Defense operating system.
The Cisco ISA 3000 is low-power, fan-less, with Gigabit Ethernet and a dedicated management port. There
are two SKUs:
• ISA3000-4C-K9 — Copper SKU with 4x10/100/1000Base-T with a management port.
• ISA3000-2C2F-K9 — Fiber SKU with 2x1GbE SFP and 2x10/100/1000Base-T with a management
port.
The following figures show the front panel details of the two SKUs
Product Overview
1

Figure 1: Cisco ISA 3000 Copper SKU
The following figure describes the front panel features:
Product Overview
2
Product Overview
General Description

Figure 2: Cisco ISA 3000 Fiber SKU
Product Overview
3
Product Overview
General Description

Figure 3: Cisco ISA 3000 Front Panel
DescriptionPINDescriptionPIN
RJ45 10/100/100 BaseT
Connectors 1&2
10Reset Pinhole Access1
On the ISA-3000-2C2F SKU,
these are the SFP sockets.
On the ISA-3000-4C SKU,
these are RJ45 10/100/100
BaseT Connectors 3&4
11Console LED2
1GB removable SD flash
memory card slot
12System LED3
Alarm Connectors13Console connector (RJ-45)4
Grounding Point14Console connector (mini-USB)5
Alarm LEDs15USB connectors6
Product Overview
4
Product Overview
General Description

DescriptionPINDescriptionPIN
DC Power LEDs16Management Interface7
Gigabit Ethernet LEDs17DC power connection A8
Management LED18DC power connection B9
ISA 3000 Shutdown
There is a new graceful shutdown option supported for Firepower Threat Defense as of 7.0.2/7.2. There is
also an LED change new for 7.0.5/7.3. Use shutdown when you intend to remove the device from the network,
for example to replace it, or for any scheduled maintenance.
There is no change to procedures with ASA.
It is recommended to wait for10 seconds after the System LED is switched OFF to unplug the power
from the device.
Note
After shutting down the device, you can turn it back on only by Power cycling the device. There is no hardware
On/Off switch for the device on the chassis. Power up the device to restart the device again.
LEDs
The following table describes the LEDs for the Cisco ISA 3000.
Table 1: LED Descriptions
DescriptionActivityLED
Off — No power
Green Steady on — Normal operation
Green Flashing — Boot up phase
Red Flashing — BIOS and POST
Red — System is not functioning properly.
Power StatusSystem
Off — No link (default)
Green Steady on — Port link with no activity
Green Flashing — Transmitting and Receiving data
Management Port StatusMGMT
Off — Power is not present
Green Steady on — Power is present on the associated circuit. (Hardware controlled)
Red Steady on — Power is not present on the associated circuit, and the system is
configured for dual-input power
DC Power StatusDC_A
DC_B
Product Overview
5
Product Overview
ISA 3000 Shutdown

DescriptionActivityLED
Off — Alarm Out not configured or the system is off (Default)
Green Steady on — Alarm Out is configured, no alarm detected.
Red Steady on — Minor alarm detected
Red Flashing — Major alarm detected
Alarm monitoringAlarm Out
Off — Alarm In not configured or the system is off (Default)
Green Steady on — Alarm In is configured, no alarm detected.
Red Steady on — Minor alarm detected
Red Flashing — Major alarm detected
Alarm monitoringAlarm In
1&2
Off — No link
Green Steady on — Link is up
Green Flashing — Transmitting and Receiving data
Amber — Fault, check log
Port 1&2 and in the copper SKU, 3&4 LEDs fast blink amber together — Those two ports
are in bypass mode.
Link StatusEthernet
Ports
Off — RJ-45 is being used for console
Green — Mini USB is being used for console
Console connection
Status
Console
Memory and Storage
The Cisco ISA 3000 has the following:
• 8-GB DRAM (soldered down).
• 16-GB onboard flash memory
• 64-GB mSATA solid state drive (SSD)
• 1-GB removable SD flash memory card - industrial temp
USB Ports
The Cisco ISA 3000 has two externally accessible Type-A USB (4-pin) connectors. Each USB port will
support output powering of 5 volts and up to a maximum of 500 mA.
Management Ethernet Port
A management-only 10/100/1000 BaseT Ethernet port is provided. This port will be the only port able to be
used for booting over the network, or for initial setup and management of the system. This port is Management
1/1 in the configuration.
Product Overview
6
Product Overview
Memory and Storage

Console Port
The Cisco ISA 3000 can be configured through a web interface, or through the console port. The console port
is either a RJ45 or a Mini USB connector. A standard management cable (Part number 72-3383-01) can be
used to convert the RJ45 to DB9 connector.
The default configuration settings for the RJ45 console port are:
• 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control.
• If the USB Console Port is active (cable inserted and remote PC drivers are enabled) by default the
console will switch from RJ45 to USB when the USB cable is detected. If both ports are connected, the
Mini USB console port is used.
If your laptop or PC warns you that you do not have the proper drivers to communicate with the device, you
can obtain them from your computers manufacturer, or go here:
https://software.cisco.com/download/home/282774227/type/282855122/release/3.1
The following table shows the pin-outs for the CON/AUX RJ-45 connector:
Table 2: RJ-45 Pinouts
DirectionSignalPin
OutputDTR1
Output3.32
OutputTXD3
-GND4
-GND5
InputRXD6
NC-7
NC-8
The console port will not support a remote dial-in modem.
Note
Hardware Features
This section provides an overview of the following hardware features for the Cisco ISA 3000.
Platform Features for the Cisco ISA 3000
The following lists the hardware platform features.
Product Overview
7
Product Overview
Console Port

• CPU Intel 4 Core 1.25Ghz
• 8 GB of 1333MHz DDR3 Memory
• Dedicated management-only Gigabit Ethernet port
• Mini-USB and RJ45 Console port
• +/- 12 to 48VDC Rated (9.6 to 60VDC Maximum) redundant power connectors with 24-12 AWG screw
cage terminals
• Two external USB-A ports for addition of memory cards, security tokens, modems, or other USB 2.0
compliant devices
• DIN Rail mount incorporated into the chassis
• Fan-less design
• Fault relay outputs and 2 alarm inputs
• Industrial temperature SDHC card support
• Redundant power inputs
• Secure boot support
• Bypass Relay (only available on copper ports)
Reset Button
The Reset button resets the security appliance configuration to the default configuration set by the factory.
To restore the security appliance configuration to the default configuration set by the factory, use a standard
size #1 paper clip with wire gauge 0.033 inch or smaller and simultaneously press the reset button while
applying power to the security appliance.
When depressed the push-button follows these actions:
• Depressed 0 to < 3 seconds or > 15 seconds — No action is taken.
• Depressed > 3 seconds < 15 seconds — ASA: After reboot, the unit will be running the original factory
default configuration, including ROMMON variables.
• Depressed > 3 seconds < 15 seconds — FTD (7.0+) using Firepower Management Center: If you have
a backup configuration on an SD card, a zero-touch restore is initiated.
Power Supply
The Cisco ISA 3000 comes with redundant external power connector. the connector supports 12 - 48 VDC.
The connectors are Molex 5.00mm Pitch Eurostyle™Horizontal Plug, with Retention Screws.
The power supply does not support reverse polarity, but does have reverse polarity protection. This means if
you reverse + & - connections, the system will not power on but there will be no damage.
The + terminal always has to be greater than the - terminal for the system to operate. The difference is in the
system grounding scheme used.
The ISA 3000 supports 3 basic schemes:
Product Overview
8
Product Overview
Reset Button

• Isolated DC in, neither + nor - terminal is tied to chassis GND
• Positive DC in, negative (-) terminal is tied to chassis GND
• Negative DC in, positive (+) terminal is tied to chassis GND
To ensure uninterrupted operation the redundant power connections must be connected to independently
separated power sources.
Note
1GB Removable SD Flash Memory Card
The Cisco ISA 3000 has a removable SD flash memory slot (referred to as SD). This is primarily to allow
easy updates, copying of logs and crash-dumps. The device does not come with a removable SD flash memory
card installed, this is an optional spare item, Cisco part number SD-IE-1GB=. Contact your Cisco Marketing
Representative for ordering information.
Check the software guide for the operating system you are running for information on SD memory
support.
Note
Installing or Removing the SD Card (Optional)
Do not insert or remove the SD card while power is on; an electrical arc can occur. This could cause an
explosion in hazardous location installations. Be sure that power is removed or the area is nonhazardous
before proceeding. Statement 379
Warning
The SD card is hidden under a protective cover:
Product Overview
9
Product Overview
1GB Removable SD Flash Memory Card

Figure 4: SD Card Cover
Phillips screw1
Door pivot point2
For hazardous locations environments, if you are installing or removing the flash card or alarm wiring, follow
these warnings:
When you connect or disconnect the power and/or alarm connector with power applied, an electrical
arc can occur. This could cause an explosion in hazardous area installations. Be sure that all power is
removed from the device and any other circuits. Be sure that power cannot be accidentally turned on or
verify that the area is nonhazardous before proceeding. Statement 1058
Warning
Do not insert or remove the flash card while power is on; an electrical arc can occur. This could cause
an explosion in hazardous location installations. Be sure that power is removed or the area is nonhazardous
before proceeding. Statement 379
Warning
Product Overview
10
Product Overview
Installing or Removing the SD Card (Optional)

Use a ratcheting torque flathead screwdriver to torque the power connector captive screws to 5 in-lb
(0.6 N-m), the maximum recommended torque.
Caution
To install or replace the SD card, follow these steps:
1. On the front of the device, locate the door that protects the SD card slot. Loosen the captive screw at the
top of the door using a Phillips screwdriver to open the door.
• To install a card, slide it into the slot, and press it in until it clicks in place. The card is keyed so that
you cannot insert it the wrong way.
• To remove the card, push it in until it releases for it to pop out. Place it in an antistatic bag to protect
it from static discharge.
2. After the card is installed, close the guard door and fasten the captive screw using a Phillips screwdriver
to keep the door in place.
Alarm Ports
The Cisco ISA 3000 has alarm ports. There are two conditions that generate an alarm:
• When dual power supply is configured, and there is a failed or missing power supply.
• When the CPU temperature is in critical condition (below -40°C or above 105°C)
When either condition is met, the alarm LED turns red, and a syslog message and SNMP trap is triggered.
Check the software guide for the operating system you are running for information on alarm port support.
Note
Power Supply
The device can be configured to run dual power supplies. When set, the system expects to see both power
supplies functioning properly.
Check the software guide for the operating system you are running for information on dual power supply
configuration and support.
Note
When configured for dual power supply, and a failure occurs, the Alarm Out LED turns red. The alarm relay
is also energized. A syslog message is generated:
Syslog: %ASA-1-735006: Power Supply Unit Redundancy Lost
When configured for dual power supply, and a failure recovers, the Alarm Out LED turns off. A syslog
message is generated:
Syslog: %ASA-1-735005: Power Supply Unit Redundancy OK
Product Overview
11
Product Overview
Alarm Ports

Temperature Sensor
The operating system monitors the CPU temperature when it is running.
If the CPU temperature is in a critical condition (below -40°C or above 105°C), the Alarm Out LED turns
red.
When the CPU temperature returns to a normal condition, the Alarm Out LED turns off.
The critical range of temperature is not configurable. It is hard coded as below -40°C or above 105°C.
Note
Product Overview
12
Product Overview
Temperature Sensor