Cisco Firepower 2100 Series Manual

Cisco Firepower 2100 Series Hardware Installation Guide
First Published: 2017-05-25
Last Modified: 2018-12-07
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of
the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.
Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com
go trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any
other company. (1721R)
©2017-2018 Cisco Systems, Inc. All rights reserved.

CONTENTS
Overview 1
CHAPTER 1
Features 1
Deployment Options 4
Package Contents 4
Serial Number Location 6
Front Panel 7
Front Panel LEDs 10
Rear Panel 15
Network Modules 17
10-G Network Module 17
1-G Network Module 18
Hardware Bypass Network Modules 19
1-G SX/10-G SR/10-G LR Network Module with Hardware Bypass 20
Power Supply Modules 23
Fan Modules 25
SSDs 26
Supported SFP/SFP+ Transceivers 26
Hardware Specifications 29
Product ID Numbers 30
Power Cord Specifications 32
Installation Preparation 39
CHAPTER 2
Installation Warnings 39
Safety Recommendations 42
Maintain Safety with Electricity 42
Prevent ESD Damage 43
Cisco Firepower 2100 Series Hardware Installation Guide
iii

Site Environment 43
Site Considerations 43
Power Supply Considerations 43
Rack Configuration Considerations 44
Mount and Connect 45
CHAPTER 3
Unpack and Inspect the Chassis 45
Rack-Mount the Chassis 46
Rack-Mount the Chassis Using Slide Rails 48
Ground the Chassis 54
Connect Cables, Turn on Power, and Verify Connectivity for Cisco Firepower Threat Defense 57
Connect Cables, Turn on Power, and Verify Connectivity Using Cisco Firepower Management Center
60
Connect Cables, Turn on Power, and Verify Connectivity for Cisco ASA 62
Maintenance and Upgrade 67
CHAPTER 4
Remove and Replace the Network Module 67
Remove and Replace the SSD 68
Remove and Replace the Power Supply Module 70
Connect the DC Power Supply Module 72
Secure the Power Cord on the Power Supply Module 75
Remove and Replace the Fan Tray 78
Cisco Firepower 2100 Series Hardware Installation Guide
iv
Contents

CHAPTER 1
Overview
•Features, on page 1
•Deployment Options, on page 4
•Package Contents, on page 4
•Serial Number Location, on page 6
•Front Panel, on page 7
•Front Panel LEDs, on page 10
•Rear Panel, on page 15
•Network Modules, on page 17
•Hardware Bypass Network Modules, on page 19
•Power Supply Modules, on page 23
•Fan Modules, on page 25
•SSDs, on page 26
•Supported SFP/SFP+ Transceivers, on page 26
•Hardware Specifications, on page 29
•Product ID Numbers, on page 30
•Power Cord Specifications, on page 32
Features
The Cisco Firepower 2100 series security appliance is a standalone modular security services platform. The
series includes the Firepower 2110, 2120, 2130, and 2140. See Product ID Numbers, on page 30 for a list of
the product IDs (PIDs) associated with the 2100 series.
The Firepower 2100 supports Cisco Firepower Threat Defense and Cisco ASA software. The Firepower 2100
is certified for the following security standards on ASA 9.8.xand FTD 6.2.x.
• Common Criteria (CC)
• Federal Information Processing Standards (FIPS)
• Department of Defense Information Network Approved Product List (DoDIN APL)
• US Government Compliance for IPv6 (USGv6)
Cisco Firepower 2100 Series Hardware Installation Guide
1

The Firepower 2130 is Network Equipment Building Systems (NEBS)-certified.
Note
Figure 1: Firepower 2110/2120 and Firepower 2130/2140
See the Cisco Interactive Library for a video that displays the features and components of the Firepower 2100.
The following table lists the features for the Firepower 2100 series.
Table 1: Firepower 2100 Series Features
2140213021202110Feature
1 RU
Fits standard 19-in. (48.3-cm) square-hole rack.
Form factor
Yes
4-post EIA-310-D rack
(Optional) Two 2--post mount brackets
Yes
Two 2-post mount brackets
(Optional) 4-post EIA-310-D rack
Rack mount
Front to rear
Cold aisle to hot aisle
Airflow
Single 16-core at 1.3
G
Single 8-core at 2.0
G
Single 6-core at 1.9
G
Single 4-core at 1.8
G
Intel x86 processor
64 GB DDR4
DRAM
32 GB DDR4
DRAM
16 GB DDR4 DRAMIntel x86 memory
Single 16-core at 1.8
G
Single 12-core at 1.2
G
Single 8-core at 1.2
G
Single 6-core at 1.2
G
Cavium Network
Processor Unit
(NPU)
16G8 GCavium NPU RAM
8 G (nominal)Flash
24
16Maximum number
of interfaces
1 Gigabit Ethernet (10 M/100 M/1 G Base-T)Management port
RJ-45 serial portConsole port
USB 2.0 Type A (500 mA)USB port
Cisco Firepower 2100 Series Hardware Installation Guide
2
Overview
Features

2140213021202110Feature
12 fixed RJ-45 1 G/100 M/10 M ports (named Ethernet 1/1 through 1/12 )Network ports
Four fixed 1-G/10-G SFP+ ports
Four fixed 1-G SFP portsSFP ports
Yes
Displays serial number
Pullout asset card
Yes
On rear panel
Grounding lug
Yes
On front panel
Locator beacon
Yes
On rear panel
Power switch
One
Not hot-swappable
NoNetwork module
slots
8-port 1-Gigabit Ethernet SFP+
8-port 10-Gigabit Ethernet SFP+
6-port 1-Gigabit Ethernet SX fiber
fail-to-wire
6-port 10-Gigabit Ethernet SR fiber
fail-to-wire
6-port 10-Gigabit Ethernet LR fiber
fail-to-wire
—Network modules
Two power supply
slots
Ships with two
400-W AC power
supply modules
Hot-swappable
Two power supply
slots
Ships with one
400-W AC power
supply modules
Hot-swappable
One fixed AC power supply moduleAC power supply
Yes (optional)NoDC power supply
YesNoRedundant power
One hot-swappable fan tray with four fansFour fixed fansFan
Cisco Firepower 2100 Series Hardware Installation Guide
3
Overview
Features

2140213021202110Feature
Two SSD slots (200 GB )
Ships with one 200-GB SSD installed in
slot 1.
Slot 2 is reserved for the MSP.
Two SSD slots (100 GB )
Ships with one 100-GB SSD installed in
slot 1.
Slot 2 is reserved for the Malware Storage
Pack (MSP).
Storage
Yes
Installed in SSD slot 2.
MSP
Deployment Options
Here are some examples of how you can deploy the Firepower 2100:
• As a firewall:
• At the enterprise Internet edge deployed in a high availability configuration
• At branch offices in either a high availability pair or standalone
• As a device that provides additional application control, URL filtering, or IPS/threat-centric capabilities:
•Behind an enterprise internet edge firewall in an inline in a transparent bump-in-the-wire configuration
or as a standalone (requires hardware fail open network module support)
• Deployed passively off a SPAN port on a switch or a tap on a network, or standalone
• As a VPN device:
• For remote access VPN
• For site-to-site VPN
Package Contents
The following figure shows the package contents for the Firepower 2110 and 2120. The contents are subject
to change and your exact contents will contain additional or fewer items depending on whether you order the
optional parts. See Product ID Numbers, on page 30 for a list of the PIDs associated with the 2110 and 2120
package contents.
Cisco Firepower 2100 Series Hardware Installation Guide
4
Overview
Deployment Options

Figure 2: Firepower 2110 and 2120 Package Contents
Blue console cable PC terminal adapter2Firepower 2110 or 2120 chassis1
SFP transceiver
(Optional; in package if ordered)
41 power cord (country-specific)3
1 ground lug kit
#6 AWG lug, two 10-32 x .38-in. screws
62 rack-mount brackets and six 8-32,
0.281-in. screws
5
2 user documents:
• Useful Links Cisco Firepower 2100
Series document
• Start Here document
8Cable management bracket kit
2 cable management brackets and four 8-32
x 0.375-in. screws
(Optional; in package if ordered)
7
Rack-mount screws:
• Four 12-24, 0.75 in.
• Four 10-32, 0.75 in.
• Four M6, 19 mm
9
The following figure shows the package contents for the Firepower 2130 and 2140. The contents are subject
to change and your exact contents will contain additional or fewer items depending on whether you order the
optional parts. See Product ID Numbers, on page 30 for a list of the product IDs (PIDs) associated with the
2130 and 2140 package contents.
Cisco Firepower 2100 Series Hardware Installation Guide
5
Overview
Package Contents

Figure 3: Firepower 2130 and 2140 Package Contents
Blue console cable PC terminal adapter2Firepower 2130 or 2140 chassis1
SFP transceiver
(Optional; in package if ordered)
41 or 2 power cords (country-specific)3
Six 8-32 x .25-in. slide rail locking bracket
screws
6Slide rail kit
Left and right slide rails and two M3x6
mm wafer head screws
5
1 ground lug kit
#6 AWG lug, two 10-32 x .38-in. screws
82 slide rail locking brackets7
2 user documents:
• Useful Links Cisco Firepower 2100
Series document
• Start Here document
10Cable management bracket kit
2 cable management brackets and four 8-32
x 0.375-in. screws
(Optional; in package if ordered)
9
2 power supply module tie wraps and
clamps
11
Serial Number Location
The serial number for the Firepower 2100 series chassis is located on the pullout asset card on the front panel.
Cisco Firepower 2100 Series Hardware Installation Guide
6
Overview
Serial Number Location

Figure 4: Serial Number on the Chassis
You can also view additional model information on the compliance label located on the bottom of the chassis.
Figure 5: Compliance Label on the Chassis
Front Panel
The following figure shows the front panel of the Firepower 2110 and 2120. See Front Panel LEDs, on page
10 for a description of the LEDs.
Cisco Firepower 2100 Series Hardware Installation Guide
7
Overview
Front Panel

Figure 6: Firepower 2110 and 2120 Front Panel
Gigabit Ethernet management port:
• Firepower Threat
Defense—Management 0 (also
referred to as Management 1/1 and
Diagnostic 1/1)
• ASA—Management 1/1
2Power LED1
SSD 1 (slot 1)412 RJ-45 1 G/100 M/10 M auto
duplex/auto MDI-X Base-T ports
Ethernet 1/1 through 1/12 labeled top to
bottom, left to right
3
System LEDs6Locator beacon5
RJ-45 console port8Type A USB 2.0 port7
4 fixed SFP (1 G) ports
Fiber ports 1/13 through 1/16 labeled left
to right
10Pullout asset card with chassis serial
number
9
SSD (slot 2)11
The following figure shows the front panel of the Firepower 2130 and 2140. See Front Panel LEDs, on page
10 for a description of the LEDs.
Figure 7: Firepower 2130 and 2140 Front Panel
Locator beacon2Power LED1
Cisco Firepower 2100 Series Hardware Installation Guide
8
Overview
Front Panel

12 RJ-45 1 G/100 M/10 M auto
duplex/auto MDI-X Base-T ports
Ethernet 1/1 through 1/12 labeled top to
bottom, left to right
4Gigabit Ethernet management port:
• Firepower Threat
Defense—Management 0 (also
referred to as Management 1/1 and
Diagnostic 1/1)
• ASA—Management 1/1
3
SSD 26SSD 15
Type A USB 2.0 port8System LEDs7
Pullout asset card with chassis serial
number
10RJ-45 console port9
Network module (network module slot 1)124 fixed SFP+ (1 G/10 G) ports
Fiber ports 1/13 through 1/16 labeled left
to right
11
Management Port
The Firepower 2100 chassis has an RJ-45 copper management port.
RJ-45 Console Port
The Firepower 2100 chassis has a standard RJ-45 console port. You can use the CLI to configure your
2100 through the RJ-45 serial console port by using a terminal server or a terminal emulation program
on a computer.
The RJ-45 (8P8C) port supports RS-232 signaling to an internal UART controller. The console port does
not have any hardware flow control, and does not support a remote dial-in modem. The baud rate is 9600.
You can use the standard cable found in your accessory kit to convert the RJ-45 to DB-9 if necessary.
Type A USB Port
You can use the external Type A USB port to attach a data-storage device. The external USB drive
identifier is disk1:. The Type A USB port supports the following:
• Hot swapping
• USB drive formatted with FAT32
• Boot kickstart image from ROMMON for discovery recovery purposes
• Copy files to and from workspace:/ and volatile:/ within local-mgmt. The most relevant files are:
• Core files
• Ethanalyzer packet captures
• Tech-support files
• Security module log files
• Platform bundle image upload using download image usbA:
The Type A USB port does not support Cisco Secure Package (CSP) image upload support.
Cisco Firepower 2100 Series Hardware Installation Guide
9
Overview
Front Panel

Network Ports
The Firepower 2100 chassis has 12 fixed RJ-45 1 G/100 M/10 M) ports. They are numbered from top
to bottom, left to right starting with 1 and are named Ethernet 1/1 through Ethernet 1/12.
The 2110 and 2120 also have 4 fixed SFP (1 G) ports, and the 2130 and 2140 have 4 fixed SFP+ (1 G/10
G) ports. They are fiber ports numbered left to right (1/13 through 1/16).
Each port has LEDs that represent Link/Activity status.
Front Panel LEDs
The following figure shows the Firepower 2110 and 2120 front panel LEDs.
Figure 8: Firepower 2110 and 2120 Front Panel LEDs
Cisco Firepower 2100 Series Hardware Installation Guide
10
Overview
Front Panel LEDs

Locator Beacon
• Off—Locate is off.
• Blue—Locate is on.
The Locator beacon helps you
locate a unit that needs physical
service attention. This feature
is activated in the software.
Note
2PWR
• Off—Input power is not detected.
Standby power is off.
• Green, flashing—The system has
detected a power switch toggle event,
and initiated the shutdown sequence.
If the power switch is in the OFF
position, the system powers off after
shutdown is completed. Do not
remove the AC or DC power source
while this LED is blinking so that the
system has time to perform a graceful
shutdown.
• Amber—The system is powering up
(before the BIOS boots). This takes
one to five seconds at most.
• Green—The system is fully powered
up.
1
ACT (Role of a high-availability pair)
• Off—The unit is not configured or
enabled in a high-availability pair.
• Green—The unit is in active mode.
•Amber—The unit is in standby mode.
4SYS (Health)
• Off—The system has not booted up
yet.
• Green, flashing—The system is
booting up or in bootloader stage.
• Green—The system has fully booted.
• Amber—The system boot up has
failed.
• Amber, flashing—Alarm condition,
system needs service or attention and
may not boot properly.
3
SSD2 ACT
• Off—SSD is not present.
• Green—SSD is present; no activity.
• Green, flashing—SSD is active.
6SSD1 ACT
• Off—SSD is not present.
• Green—SSD is present; no activity.
• Green, flashing—SSD is active.
5
Cisco Firepower 2100 Series Hardware Installation Guide
11
Overview
Front Panel LEDs

SSD1 Alert Status
• Off—SSD has normal activity.
• Amber—SSD failure.
8FAN
• Off—The environmental subsystem
is not active yet.
• Green—The fans are running
normally. It may take up to one
minute for the LED status to turn
green after power is on.
• Amber—One fan has failed. The
system can continue to operate
normally, but fan service is required.
• Amber, flashing—Two or more fans
have failed, or the fan tray has been
removed from the system. Immediate
attention is required.
7
Ethernet Link
• Green—The link partner is detected;
no activity.
• Green, flashing—Network activity is
detected.
10SSD2 Alert Status
• Off—SSD has normal activity.
• Amber—SSD failure.
9
Fiber Port
• Green—Port is enabled, the link
partner is detected.
• Amber—Port is enabled, but the link
partner is not detected.
• Green, flashing—Port is enabled;
network activity is detected.
12Ethernet Speed
• Green, flashing—The number of
flashes determines link speed; 1
flash=10 Mbit, 2=100 Mbit, 3=1 Gbit.
11
The following figure shows the Firepower 2130 and 2140 front panel LEDs.
Cisco Firepower 2100 Series Hardware Installation Guide
12
Overview
Front Panel LEDs

Figure 9: Firepower 2130 and 2140 Front Panel LEDs
Locator LED
• Off—Locate is off.
• Blue—Locate is on.
The Locator beacon helps you
locate a unit that needs physical
service attention. This feature
is activated in the software.
Note
2Power
• Off—Input power is not detected.
Standby power is off.
• Green, flashing—The system has
detected a power switch toggle event,
and initiated the shutdown sequence.
If the power switch is in the OFF
position, the system powers off after
shutdown is completed. Do not
remove the AC or DC power source
while this LED is blinking so that the
system has time to perform a graceful
shutdown.
• Amber—The system is powering up
(before the BIOS boots). This takes
one to five seconds at most.
• Green—The system is fully powered
up.
1
Cisco Firepower 2100 Series Hardware Installation Guide
13
Overview
Front Panel LEDs

ACT (Role of a high-availability pair)
• Off—The unit is not configured or
enabled in a high-availability pair.
• Green—The unit is in active mode.
•Amber—The unit is in standby mode.
4SYS (Health)
• Off—The system has not booted up
yet.
• Green, flashing—The system is
booting up or in bootloader stage.
• Green—The system has fully booted.
• Amber—The system boot up has
failed.
• Amber, flashing—Alarm condition,
system needs service or attention and
may not boot properly.
3
SSD2 ACT
• Off—The SSD is not present.
• Green—The SSD is present; no
activity.
• Green, flashing—The SSD is active.
6SSD1 ACT
• Off—The SSD is not present.
• Green—The SSD is present; no
activity.
• Green, flashing—The SSD is active.
5
PSU-2
•Off—The power supply module is not
present or not detected.
• Green—The power supply module is
present and working properly.
• Amber—The power supply module
is present but a fault or problem has
been detected.
8PSU-1
•Off—The power supply module is not
present or not detected.
• Green—The power supply module is
present and working properly.
• Amber—The power supply module
is present but a fault or problem has
been detected.
7
SSD1 Alert Status
• Off—SSD has normal activity.
• Amber—SSD failure.
10FAN
• Off—The environmental subsystem
is not active yet.
• Green—The fans are running
normally. It may take up to one
minute for the LED status to turn
green after power is on.
• Amber—One fan has failed. The
system can continue to operate
normally, but fan service is required.
• Amber, flashing—Two or more fans
have failed, or the fan tray has been
removed from the system. Immediate
attention is required.
9
Cisco Firepower 2100 Series Hardware Installation Guide
14
Overview
Front Panel LEDs

Ethernet Link
• Green—The link partner is detected;
no activity.
• Green, flashing—Network activity is
detected.
12SSD2 Alert Status
• Off—SSD has normal activity.
• Amber—SSD failure.
11
Fiber Port
• Green—Port is enabled, the link
partner is detected.
• Amber—Port is enabled, but the link
partner is not detected.
• Green, flashing—Port is enabled;
network activity is detected.
14Ethernet Speed
• Green, flashing—The number of
flashes determines link speed; 1
flash=10 Mbit, 2=100 Mbit, 3=1 Gbit.
13
Rear Panel
The following figure shows the rear panel of the Firepower 2110 and 2120.
Figure 10: Firepower 2110 and 2120 Rear Panel
Fixed power supply module2Power on/off switch1
2-post grounding lug
The 2-post grounding lug is
included in the accessory kit.
Note
4Fixed fans3
The following figure shows the rear panel of the Firepower 2130 and 2140.
Cisco Firepower 2100 Series Hardware Installation Guide
15
Overview
Rear Panel

Figure 11: Firepower 2130 and 2140 Rear Panel
Power supply module 1 FAIL LED2Power on/off switch1
Power supply module 14Power supply module 2 FAIL LED3
Fan tray6Power supply module 1 OK LED5
Power supply module 2 OK LED8Power supply module 27
2-post grounding lug
The 2-post grounding lug is
included in the accessory kit.
Note
9
Power Switch
The power switch is located to the left of power supply module 1 on the rear of the chassis. It is a toggle
switch that controls power to the system. If the power switch is in standby position, only the 3.3-V
standby power is enabled from the power supply module and the 12-V main power is OFF. When the
switch is in the ON position, the 12-V main power is turned on and the system boots.
Before you move the power switch to the OFF position, use the shutdown commands so that the system
can perform a graceful shutdown. This may take several minutes to complete. After the graceful shutdown
is completed, the front panel power LED is unlit and the console displays Power Down. See the FXOS
Configuration Guide for more information on using these commands.
If you move the power switch to the OFF position before the shutdown command sequence has completed
or if you remove the system power cords before the graceful shutdown is complete, disk corruption can
occur.
Caution
After removing power from the chassis by unplugging the power cord, wait at least 10 seconds before
turning power back ON.
Note
For More Information
• See Remove and Replace the Power Supply Module, on page 70 for the procedure for removing and
replacing the power supply module in the Firepower 2130 and 2140.
Cisco Firepower 2100 Series Hardware Installation Guide
16
Overview
Rear Panel