Cisco Firepower 9300 Handbuch

Cisco Firepower 9300 Hardware Installation Guide

First Published: 2015-07-16

Last Modified: 2021-09-13

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,

INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,

EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH

THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,

CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.

CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF

MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT

LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS

HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network

topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional

and coincidental.

All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.

Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL:

https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a

partnership relationship between Cisco and any other company. (1721R)

CONTENTS

Overview 1

CHAPTER 1

Features 1

Chassis Components 4

Deployment Options 6

Package Contents 6

Serial Number Location 8

Front Panel 9

Rear Panel 10

Supervisor 11

Security Modules 13

Network Modules 15

10-Gb Network Module 16

40-Gb Network Module 17

100-Gb Network Module (Two Ports, Single Wide) 19

100-Gb Network Module (Four Ports, Single Wide) 20

100-Gb Network Module (Double Wide) 21

Hardware Bypass Network Modules 21

40-Gb Network Module with Hardware Bypass 23

10-Gb SR/10-Gb LR Network Module with Hardware Bypass 24

Power Supply Modules 26

Fan Modules 28

Supported SFP/SFP+ and QSFP Transceivers 28

Hardware Specifications 31

Product ID Numbers 33

Power Cord Specifications 36

Cisco Firepower 9300 Hardware Installation Guide

iii

Installation Preparation 43

CHAPTER 2

Installation Warnings 43

Safety Recommendations 46

Maintain Safety with Electricity 46

Prevent ESD Damage 47

Site Environment 47

Site Considerations 47

Power Supply Considerations 48

Rack Configuration Considerations 48

Rack-Mount and Ground the Chassis 51

CHAPTER 3

Unpack and Inspect the Chassis 51

Rack-Mount the Chassis 52

Ground the Chassis 56

Installation, Maintenance, and Upgrade 59

CHAPTER 4

Remove and Replace the Supervisor 59

Install, Remove, and Replace the Security Module 60

Remove and Replace the SSD 62

Install, Remove, and Replace the Single-Wide Network Module 63

Install, Remove, and Replace the Double-Wide Network Module 67

Remove and Replace the Power Supply Module 70

Connect the DC Power Supply Module 72

Connect the HVDC Power Supply Module 73

Remove and Replace the Fan Module 75

Install the FIPS Opacity Shield 77

Cisco Firepower 9300 Hardware Installation Guide

Contents

CHAPTER 1

Overview

•Features, on page 1

•Chassis Components, on page 4

•Deployment Options, on page 6

•Package Contents, on page 6

•Serial Number Location, on page 8

•Front Panel, on page 9

•Rear Panel, on page 10

•Supervisor, on page 11

•Security Modules, on page 13

•Network Modules, on page 15

•Hardware Bypass Network Modules, on page 21

•Power Supply Modules, on page 26

•Fan Modules, on page 28

•Supported SFP/SFP+ and QSFP Transceivers, on page 28

•Hardware Specifications, on page 31

•Product ID Numbers, on page 33

•Power Cord Specifications, on page 36

Features

The Cisco Firepower 9300 security appliance is a next generation network and content security platform. Its

modular standalone chassis offers high-performance and flexible I/O options, which enable it to run multiple

security services simultaneously.

The Firepower 9300 runs FXOS and can deploy multiple application types. See Cisco Firepower 4100/9300

FXOS Compatibility for more information about software version support for each component in the Firepower

9300. See Product ID Numbers, on page 33 for a list of the component product IDs (PIDs) associated with

the Firepower 9300.

The following figure shows a fully populated Firepower 9300.

Cisco Firepower 9300 Hardware Installation Guide

Figure 1: Firepower 9300

The following table lists the hardware features of the Firepower 9300.

Table 1: Firepower 9300 Features

DescriptionFeature

• Criteria Common Criteria Certification (CC) for the Network Device

Collaborative Protection Profile (NDcPPv2.1) for ASA 9.12.xand FX-OS

2.6.x

• Federal Information Processing Standards (FIPS) 140-2 on ASA 9.12.x,

FTD 6.4.x, and FX-OS 2.6.x

See the "Security Certifications Compliance" chapter in the Cisco

FXOS CLI Configuration Guide or Cisco FXOS Firepower Chassis

Manager Configuration Guide for the procedure to enable security

modes.

Note

Security standards

certifications

3 RUForm factor

Mount rails included (4-post EIA-310-D rack) with span between front and rear

rails of 24 to 36 in.

Rack mount

Front to rear

Cold aisle to hot aisle

Airflow

Cisco Firepower 9300 Supervisor with eight 10-Gigabit Ethernet ports and two

network module slots for I/O expansion

See Chassis Components, on page 4 for more information about the chassis

Supervisor.

Supervisor

ThreeSecurity module slots

Cisco Firepower 9300 Hardware Installation Guide

Overview

Features

DescriptionFeature

• SM-24—24-physical core CPU security module (NEBS ready)

• SM-36—36-physical core CPU high performance security module

• SM-40—40-physical core CPU Crypto security module (NEBS ready)

• SM-44—44-physical core CPU high performance security module (NEBS

ready)

• SM-48—48-physical core CPU Crypto security module (NEBS ready)

• SM-56—56-physical core CPU Crypto security module

See Security Modules, on page 13 for more information about the security

modules.

Supported security

modules

Two

Located in the Supervisor

Network module slots

• 8-port 10-Gigabit Ethernet SFP+

• 4-port 40-Gigabit Ethernet QSFP+

• 2-port 100-Gigabit Ethernet QSFP28 (double-wide, occupies both network

module slots)

• 2-port 100-Gigabit Ethernet QSFP28

• 4-port 100-Gigabit Ethernet QSFP28

• 2-port 40-Gigabit Ethernet QSFP+ (built-in) with hardware bypass

•6-port 10-Gigabit Ethernet SR/LR fiber SFP+ (built-in) with hardware bypass

You can deploy the Firepower 9300 as a dedicated threat sensor with

hardware bypass network modules.

Note

Supported network

modules

256-GB DDR4 DRAM per security moduleMemory

Up to twenty-four 10-Gigabit Ethernet (SFP+) interfaces; up to eight 40-Gigabit

Ethernet (QSFP+) interfaces with two network modules; up to eight 100-Gigabit

Ethernet (SFP+) interfaces

Maximum number of

interfaces

One Gigabit Ethernet port on the Supervisor

Supports 1-Gb fiber and copper SFPs

Management port

One RJ-45 consoleSerial port

One USB 2.0 Type AUSB port

Displays serial numberPullout asset card

On rear panelGrounding lug

Cisco Firepower 9300 Hardware Installation Guide

Overview

Features

DescriptionFeature

On front panelLocator beacon

On rear panel

The initial Firepower 9300 chassis does not have a power switch.

Note

Power switch

Two

On rear panel

Power supply slots

AC, DC, and HVDC

Do not mix power supply types or wattage.

Note

Power supply types

Yes 1 + 1Redundant power

Four (hot-swappable)

On rear panel

Fan slots

SM-24, SM-36, SM-44—Up to 2.4 TB per chassis (1.2 TB per security module

in RAID 1 configuration)

SM-40, SM-48, SM-56—UP to 4.8 TB per chassis (1.6 TB per security module

in RAID 1 Configuration)

Storage

Chassis Components

The Firepower 9300 chassis contains the following components:

• Firepower 9300 Supervisor—Chassis supervisor module

• Management port

• RJ-45 console port

• USB Type A port

• Eight ports for 1- or 10-Gigabit Ethernet small form-factor pluggable (SFP) ports (fiber and copper)

• Firepower 9300 Security Module—Up to three security modules

• Firepower Network Module—Two single-wide network modules or one double-wide network module

• Two power supply modules (AC or DC)

• Four fan modules

Cisco Firepower 9300 Hardware Installation Guide

Overview

Chassis Components

Power Switch

The initial Firepower 9300 AC chassis has no external power switch. You reset the Firepower 9300 using

CLI commands. To physically power cycle the 9300, you must unplug the power cord and then plug the

power cord back in.

Note

After removing power from the chassis either by moving the power switch to OFF or unplugging the

power cord, wait at least 10 seconds before turning power back ON.

Note

The Firepower 9300 chassis has a standby power switch at the rear of the chassis. It controls both power

supply modules. You must shut down the software applications gracefully before turning the switch to

OFF.

Turning the switch to OFF turns off the main power to the Supervisor and the security modules regardless

of the software status, which can result in the loss of any data in transit and the corruption of data on the

SSDs. You must shut down the software applications gracefully before turning the switch to OFF.

Warning

Graceful Shutdown of the Chassis

You can gracefully shut down the chassis from either the CLI or Chassis Manager.

See the "Powering Off the Firepower 4100/9300 Chassis" topic in the System Administration chapter in

the FXOS CLI Configuration Guide for your software version for the procedure to shut down the chassis

from the CLI. The graceful shutdown usually takes as little as a few seconds to as long as three minutes.

When the System Halted message appears, you can move the power switch on the rear of the chassis

to OFF.

See "Powering Off the Firepower 4100/9300 Chassis" topic in the System Administration chapter in the

FXOS Configuration Guide for your software version for the procedure to shut down the chassis from

the Chassis Manager. After the shutdown is completed, you can move the power switch on the rear of

the chassis to OFF.

When you shut down the chassis, the security modules are automatically shut down.

Graceful Shutdown of the Security Modules

You can shut down the security modules individually from the CLI, the Chassis Manager, or you can

use the power switch on the front of each security module. Push the power button briefly on the front

panel of each security module. When the power button changes to amber, you can move the power switch

on the rear of the chassis to OFF.

Shut the security modules down individually when you are replacing a security module.

You must push the power button on each security module installed in the 9300 chassis. You can have

up to three security modules installed in the chassis.

Note

Cisco Firepower 9300 Hardware Installation Guide

Overview

Chassis Components

See the "Power Off/On an Installed Module/Engine" in the Security/Module/Engine Management chapter

of the FXOS CLI Configuration Guide for your software version for the procedure to shut down the

security modules gracefully using CLI commands from the Supervisor. When you see Oper Power: off

for all slots, you can move the power switch on the rear of the chassis to OFF.

See the "Power Off/On an Installed Security Module/Engine" topic in the Security Module/Engine

Management chapter of the FXOS Configuration Guide for your software version for the procedure to

shut down the security module from the Chassis Manager. After the shutdown is complete, you can move

the power switch on the rear of the chassis to OFF.

Deployment Options

Here are some examples of how you can deploy the Firepower 9300:

• At the core/aggregation layer of a three-tier data center in a high availability configuration.

• As a dedicated multifunction security service within converged infrastructure stacks (vBlock, FlexPod,

for example) at the access layer.

• As a high-performance data center security appliance between the WAN edge and data center core in an

high availability configuration.

• As a leaf that exclusively offers security functions in a spine/leaf data center design.

Package Contents

The following figure shows the package contents for the Firepower 9300. Note that the contents are subject

to change and your exact contents might contain additional or fewer items.

Cisco Firepower 9300 Hardware Installation Guide

Overview

Deployment Options

Andere Handbücher für Firepower 9300

Inhaltsverzeichnis

Andere Cisco Netzwerk-Hardware Handbücher

Cisco

Cisco Aironet 340 Series Bedienungsanleitung

Cisco

Cisco ONS 15454 Handbuch

Cisco

Cisco Wide Area Virtualization Engine 274 Handbuch

Cisco

Cisco RSP4+ Bootflash Memory Upgrade to 16MB... Bedienerhandbuch

Cisco

Cisco VIP-4R/4T Bedienungs- und Wartungsanleitung

Cisco

Cisco IronPort C670 Bedienungsanleitung

Cisco

Cisco PC4000 Bedienungsanleitung

Cisco

Cisco DS-X9530-SF1-K9 - Supervisor-1 Module - Control... Bedienungsanleitung

Cisco

Cisco ONS 15454 Series Handbuch

Cisco

Cisco 5400 Series Bedienungsanleitung

Cisco

Cisco Catalyst 8300 Series Handbuch

Cisco

Cisco MERAKI CW9166D1 Bedienungsanleitung

Cisco

Cisco NAC3350-PROF-K9 - NAC Profiler Server Bedienungsanleitung

Cisco

Cisco C8510MSR-SKIT-DC - Catalyst 8510 Multiservice Switch... Bedienungsanleitung

Cisco

Cisco IAD1101 Bedienungsanleitung

Cisco

Cisco ONS 15454 SDH Handbuch

Cisco

Cisco DOC 785983 Bedienungsanleitung

Cisco

Cisco FPR1150-ASA-K9 Handbuch

Cisco

Cisco ISA500 Series Bedienungsanleitung

Cisco

Cisco GS7000 Betriebsanleitung

Cisco

Cisco N540X-6Z18G-SYS-A Bedienungsanleitung

Cisco

Cisco MXE 3000 Handbuch

Cisco

Cisco IPS 7.1 Bedienungsanleitung

Cisco

Cisco IP/VC 3500 Originalbetriebsanleitung

Beliebte Netzwerk-Hardware Handbücher anderer Marken

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Bedienungsanleitung

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Bedienungsanleitung

Yudor

Yudor YDS-16 Bedienungsanleitung

D-Link

D-Link ShareCenter DNS-320L Bedienungsanleitung

Samsung

Samsung ES1642dc Gebrauchsanweisung

Honeywell Home

Honeywell Home LTEM-PV Montageanleitung

evertz

evertz 7700 Series Bedienungsanleitung

D-Link

D-Link ShareCenter DNS-343 Bedienungsanleitung

Asante

Asante AsanteBridge 1012 Bedienungsanleitung

FireBrick

FireBrick FB2700 Bedienungsanleitung

Audiovox Electronics

Audiovox Electronics ARWH2T Bedienungsanleitung

ADC

ADC DSX-1 Handbuch

NetComm

NetComm NF2 Bedienungsanleitung

Alcatel-Lucent

Alcatel-Lucent 5620 Bedienungsanleitung

Dell EMC

Dell EMC XC6420 Series Bedienungsanleitung

Lanner

Lanner NCA-1020A Bedienungsanleitung

Allied Telesis

Allied Telesis AT-TN121-A Bedienungsanleitung

Arista

Arista CCA-ETM-Q12 Bedienungsanleitung