Cisco AMP8050 Manual

Cisco Systems, Inc.
www.cisco.com
Cisco has more than 200 offices worldwide.
Addresses, phone numbers, and fax numbers
are listed on the Cisco website at
www.cisco.com/go/offices.
Firepower 8000 Series Hardware
Installation Guide
First Published: July 22, 2016
Last Updated: May 5, 2017

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this
URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display
output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in
illustrative content is unintentional and coincidental.
© 2017 Cisco Systems, Inc. All rights reserved.

i
Firepower 8000 Series Hardware Installation Guide
CONTENTS
About This Guide v
Organization v
Document Conventions vi
Installation Warnings vii
Where to Find Safety and Warning Information ix
Related Documentation x
Obtaining Documentation and Submitting a Service Request x
About the Firepower 8000 Series 1-1
Firepower 8000 Series Managed Devices Delivered with Firepower System 1-1
Firepower 8000 Series Device Chassis Designations 1-2
Hardware Specifications 2-1
Rack and Cabinet Mounting Options 2-1
Firepower 8000 Series Devices 2-1
Firepower 8000 Series Chassis Front View 2-2
Firepower 8000 Series Chassis Rear View 2-6
Firepower 8000 Series Physical and Environmental Parameters 2-9
Firepower 8000 Series Modules 2-12
Installing a Firepower 8000 Series Device 3-1
Unpacking and Inspecting the Appliance 3-1
Security Considerations 3-2
Identifying the Management Interfaces 3-2
Firepower 8000 Series 3-2
Identifying the Sensing Interfaces 3-3
Firepower 8000 Series 3-3
Using Devices in a Stacked Configuration 3-10
Connecting the Firepower 8140 3-11
Connecting the Firepower 82xx Family and Firepower and AMP 83xx Family 3-11
Using the 8000 Series Stacking Cable 3-14
Managing Stacked Devices 3-15
Installing the Firepower Device in a Rack 3-16

Contents
ii
Firepower 8000 Series Hardware Installation Guide
Testing an Inline Bypass Interface Installation 3-18
Using the LCD Panel on a Firepower Device 4-1
Understanding LCD Panel Components 4-2
Using the LCD Multi-Function Keys 4-3
Idle Display Mode 4-3
Network Configuration Mode 4-4
Allowing Network Reconfiguration Using the LCD Panel 4-6
System Status Mode 4-6
Information Mode 4-8
Error Alert Mode 4-9
Deploying on a Management Network 5-1
Management Deployment Considerations 5-1
Understanding Management Interfaces 5-2
Single Management Interface 5-2
Multiple Management Interfaces 5-2
Deployment Options 5-3
Deploying with Traffic Channels 5-3
Deploying with Network Routes 5-4
Security Considerations 5-5
Special Case: Connecting 8000 Series Devices 5-5
Deploying Firepower Managed Devices 6-1
Sensing Deployment Considerations 6-1
Understanding Sensing Interfaces 6-1
Passive Interfaces 6-2
Inline Interfaces 6-2
Switched Interfaces 6-3
Routed Interfaces 6-3
Hybrid Interfaces 6-4
Connecting Devices to Your Network 6-4
Using a Hub 6-4
Using a Span Port 6-5
Using a Network Tap 6-5
Cabling Inline Deployments on Copper Interfaces 6-5
Special Case: Connecting Firepower 8000 Series Devices 6-6
Deployment Options 6-7
Deploying with a Virtual Switch 6-7

Contents
iii
Firepower 8000 Series Hardware Installation Guide
Deploying with a Virtual Router 6-8
Deploying with Hybrid Interfaces 6-9
Deploying a Gateway VPN 6-10
Deploying with Policy-Based NAT 6-11
Deploying with Access Control 6-11
Using Multiple Sensing Interfaces on a Managed Device 6-16
Complex Network Deployments 6-18
Integrating with VPNs 6-18
Detecting Intrusions on Other Points of Entry 6-19
Deploying in Multi-Site Environments 6-20
Integrating Multiple Management Interfaces within a Complex Network 6-22
Integrating Managed Devices within Complex Networks 6-23
Power Requirements for Firepower 8000 Series Devices A-1
Warnings and Cautions A-1
Static Control A-1
Firepower 81xx Family Appliances A-1
AC Installation A-2
DC Installation A-3
Grounding/Earthing Requirements A-4
Firepower 82xx Family Appliances A-5
AC Installation A-6
DC Installation A-7
Grounding/Earthing Requirements A-8
Firepower and AMP 83xx Family Appliances A-9
AC Installation A-10
DC Installation A-11
Grounding/Earthing Requirements A-12
Inserting and Removing Firepower 8000 Series Network Modules B-1
About Firepower 8000 Series Modules B-1
Identify the Module Parts B-1
Module Slots on the Firepower 8000 Series Devices B-2
Stacking Configuration Considerations B-3
Included Items B-3
Power Down the Appliance B-4
Remove the Module or Slot Cover B-5
Insert the Module or Slot Cover B-6
Restart the Appliance B-9

Contents
iv
Firepower 8000 Series Hardware Installation Guide
Verify the NetMod from the Firepower Management Center B-9
Apply Changes to the Appliance B-9
Installing a Malware Storage Pack C-1
Malware Storage Pack Overview C-1
Supported Devices C-2
Before You Begin C-2
Malware Storage Pack Kit for 1U Devices C-3
Malware Storage Pack Kit for 2U Devices C-3
Installation C-4
Installing a Malware Storage Pack During an Upgrade C-4
Installing a Malware Storage Pack on a Version 6.0.1 Device C-5
Instructions for the 81xx Family Devices C-5
Instructions for the 82xx Family and 83xx Family Devices C-8
Post Installation C-11
Removing a Malware Storage Pack C-12
Monitoring a Malware Storage Pack C-13

v
Firepower 8000 Series Hardware Installation Guide
About This Guide
Updated: July 22, 2016
This guide describes how to install and maintain the Cisco Firepower 8000 Series appliances.
Information in this guide applies to the Cisco 80xx Family, 81xx Family, and the 83xx Family models.
This preface includes the following sections:
Organization, page v
Document Conventions, page vi
Installation Warnings, page vii
Where to Find Safety and Warning Information, page ix
Related Documentation, page x
Obtaining Documentation and Submitting a Service Request, page x
Organization
This guide is organized as follows:
Chapter Title Description
Chapter 1 About the Firepower 8000 Series Provides an overview of the devices
included in the 8000 Series.
Chapter 2 Hardware Specifications Describes the hardware specifications for the
Firepower 8000 Series models.
Chapter 3 Installing a Firepower 8000 Series
Device
Describes how to install a Firepower
8000 Series device in a rack, how to connect
the management interface, and how to power
on the chassis.
Chapter 4 Using the LCD Panel on a Firepower
Device
Describes how to view device information or
configure certain settings using an LCD
panel on the front of the device instead of the
system’s web interface.
Chapter 5 Deploying on a Management Network Describes Firepower System deployment
options available to accommodate the needs
of unique network architectures.

vi
Firepower 8000 Series Hardware Installation Guide
About This Guide
Document Conventions
Document Conventions
This document uses the following conventions:
Note Means reader take note.
Chapter 6 Deploying Firepower Managed
Devices
Describes how different sensing interfaces
affect the capabilities of the Firepower
System, including passive, inline, routed,
switched, and hybrid interfaces.
Appendix A Power Requirements for Firepower
8000 Series Devices
Describes AC and DC power requirements
for Firepower 8000 Series devices.
Appendix B Inserting and Removing Firepower
8000 Series Modules
Describes how to insert a new module or
how to remove or replace a preinstalled
module in Firepower 8000 Series devices.
Appendix C Installing a Malware Storage Pack Describes how to install a malware storage
pack in Firepower 8000 Series devices.
Chapter Title Description
Convention Indication
bold type Commands and keywords and user-entered text appear in bold type.
italic type Document titles, new or emphasized terms, and arguments for which you supply
values are in italic type.
[ ] Elements in square brackets are optional.
{x | y | z } Required alternative keywords are grouped in braces and separated by
vertical bars.
[ x | y | z ] Optional alternative keywords are grouped in brackets and separated by
vertical bars.
string An unquoted set of characters. Do not use quotation marks around the string, or
the string will include the quotation marks.
monospace type Terminal sessions and information the system displays appear in monospace
type.
monospace bold type Commands and keywords and user-entered text appear in monospace courier
type.
monospace italic
type
Arguments for which you supply values are in monospace italic type.
< > Non-printing characters such as passwords are presented in angle brackets.
[ ] Default responses to system prompts are presented in square brackets.
!, # An exclamation point (!) or a hash sign (#) at the beginning of a line of code
indicates a comment line.

vii
Firepower 8000 Series Hardware Installation Guide
About This Guide
Installation Warnings
Tip Means the following information will help you solve a problem.
Caution Means reader be careful. In this situation, you might perform an action that could result in equipment
damage or loss of data.
Installation Warnings
Be sure to read the Regulatory Compliance and Safety Information document
(http://www.cisco.com/c/en/us/td/docs/security/firesight/hw-docs/regulatory/compliance/firesight-firep
ower-rcsi.html) before installing the device.
This section presents these important safety warnings:
•Power Supply Disconnection Warning, page vii
•Jewelry Removal Warning, page vii
•Wrist Strap Warning, page viii
•Work During Lightning Warning, page viii
•Installation Instructions Warning, page viii
•Chassis Warning for Rack-Mounting and Servicing, page viii
•Short-Circuit Protection Warning, page viii
•SELV Circuit Warning, page viii
•Ground Conductor Warning, page viii
•Faceplates and Cover Panels Warning, page ix
•Product Disposal Warning, page ix
•Compliance with Local and National Electrical Codes Warning, page ix
•Grounded Equipment Warning, page ix
•Safety Cover Requirement, page ix
Power Supply Disconnection Warning
Warning Before working on a chassis or working near power supplies, unplug the power cord on AC units;
disconnect the power at the circuit breaker on DC units. Statement 12
Jewelry Removal Warning
Warning Before working on equipment that is connected to a power source, remove jewelry (including rings,
necklaces, and watches). Metal objects will heat when connected to power and ground, and can
cause serious burns or weld the metal object to the terminals. Statement 43

viii
Firepower 8000 Series Hardware Installation Guide
About This Guide
Installation Warnings
Wrist Strap Warning
Warning During this procedure, wear grounding wrist straps to avoid ESD damage to the card. Do not directly
touch the backplane with your hand or any metal tool, or you could receive a shock. Statement 94
Work During Lightning Warning
Warning Do not work on the system, or connect or disconnect cables during periods of lightning. Statement
1001
Installation Instructions Warning
Warning Read all installation instructions before connecting the system to a power source. Statement 1004
Chassis Warning for Rack-Mounting and Servicing
Warning To prevent bodily injury when mounting or servicing this unit in a rack, you must take special precautions to
ensure that the system remains stable. The following guidelines are provided to ensure your safety: This unit
should be mounted at the bottom of the rack if it is the only unit in the rack. When mounting this unit in a partially
filled rack, load the rack from the bottom to the top with the heaviest component at the bottom of the rack.If the
rack is provided with stabilizing devices, install the stabilizers before mounting or servicing the unit in the rack.
Statement 1006
Short-Circuit Protection Warning
Warning This product requires short-circuit (overcurrent) protection, to be provided as part of the building
installation. Install only in accordance with national and local wiring regulations. Statement 1045
SELV Circuit Warning
To avoid electric shock, do not connect safety extra-low voltage (SELV) circuits to telephone-network
voltage (TNV) circuits. LAN ports contain SELV circuits, and WAN ports contain TNV circuits. Some
LAN and WAN ports both use RJ-45 connectors. Use caution when connecting cables.
Statement 1021
Ground Conductor Warning
Warning This equipment must be grounded. Never defeat the ground conductor, or operate the equipment in the
absence of a suitably installed ground conductor. Contact the appropriate electrical inspection
authority, or an electrician if you are not certain that suitable grounding is available. Statement 1024