Cisco Firepower 2120
Superior business resiliency and protection
Gain business resiliency through superior security with sustained performance. The Firepower 2100 Series has an innovative dual multicore CPU architecture that optimizes firewall, cryptographic, and threat inspection functions simultaneously. Now, achieving security doesn’t come at the expense of network performance.
Threat-focused NGFW
Improve business resiliency and maintain performance with superior threat defense. Apply granular application control. Protect against malware. Shrink time to detection and remediation. Reduce complexity with the on-device management interface.
Optimized performance and port density
Firewall throughput speeds from 2 Gbps to 8.5 Gbps. Support for sixteen (16) 1 GE ports on the low-end models. The high-end models support up to twenty-four (24) 1 GE ports or up to twelve (12) 10 GE ports. All in a 1RU form factor.
Innovative architecture
With its unique dual-CPU, multicore architecture, the 2100 maintains throughput performance when threat inspection is activated by routing different workloads to different chips. And enabling the threat protection features does not affect the firewall throughput.
Integration adds value
Further strengthen your defenses. Share intelligence, context, and policy controls by integration with third-party and other Cisco security solutions. Enable automatic device quarantining and rapid threat containment with Cisco ISE.
Management to meet your needs
Cisco Firepower NGFW is now even less time-consuming to configure and less costly to manage. You can choose from local, centralized, and cloud-based managers that fit your environment and the way you work.
Table 1. Appliance Performance Highlights
Features | Cisco Firepower Model | |||||||||||
2110 | 2120 | 2130 | 2140 | 4110 | 4120 | 4140 | 4150 | 9300 with 1 SM-24 Module | 9300 with 1 SM-36 Module | 9300 with 1 SM-44 Module | 9300 with 3 SM-44 Modules | |
Throughput FW + AVC (Cisco Firepower Threat Defense) | 2.0 Gbps | 3 Gbps | 4.75 Gbps | 8.5 Gbps | 12 Gbps | 20 Gbps | 25 Gbps | 30 Gbps | 30 Gbps | 42 Gbps | 54 Gbps | 135 Gbps |
Throughput: FW + AVC + NGIPS (Cisco Firepower Threat Defense) | 2.0 Gbps | 3 Gbps | 4.75 Gbps | 8.5 Gbps | 10 Gbps | 15 Gbps | 20 Gbps | 24 Gbps | 24 Gbps | 34 Gbps | 53 Gbps | 133 Gbps |
Table 2. Performance Specifications and Feature Highlights for Physical and Virtual Appliances with the Cisco Firepower Threat Defense Image
Features | Cisco Firepower Model | |||||||||||||
NGFWv | 2110 | 2120 | 2130 | 2140 | 4110 | 4120 | 4140 | 4150 | 9300 with 1 SM‑24 Module | 9300 with 1 SM‑36 Module | 9300 with 1 SM‑44 Module | 9300 with 3 SM‑44 Modules | ||
Throughput: FW + AVC | 1.2 Gbps | 2.0 Gbps | 3 Gbps | 4.75 Gbps | 8.5 Gbps | 12 Gbps | 20 Gbps | 25 Gbps | 30 Gbps | 30 Gbps | 42 Gbps | 54 Gbps | 135 Gbps | |
Throughput: AVC + IPS | 1.1 Gbps | 2.0 Gbps | 3 Gbps | 4.75 Gbps | 8.5 Gbps | 10 Gbps | 15 Gbps | 20 Gbps | 24 Gbps | 24 Gbps | 34 Gbps | 53 Gbps | 133 Gbps | |
Maximum concurrent sessions, with AVC | 100,000 | 1 million | 1.2 million | 2 million | 3.0 million | 9 million | 15 million | 25 million | 30 million | 30 million | 30 million | 30 million | 60 million | |
Maximum new connections per second, with AVC | 10,000 | 12,000 | 16,000 | 24,000 | 40,000 | 68,000 | 120,000 | 160,000 | 200,000 | 120,000 | 160,000 | 300,000 | 900,000 | |
IPSec VPN Throughput (1024B TCP w/Fastpath) | - | 750 Mbps | 1 Gbps | 1.5 Gbps | 3 Gbps | 6 Gbps | 10 Gbps | 13 Gbps | 14 Gbps | 13.5 Gbps | 16 Gbps | 17 Gbps | 51 Gbps | |
Maximum VPN Peers | - | 1500 | 3500 | 7500 | 10000 | 10000 | 15000 | 20000 | 20000 | 20000 | 20000 | 20000 | 60000 | |
Cisco Firepower Device Manager (local management) | Yes (VMware only) | Yes | Yes | Yes | Yes | - | - | - | - | - | - | - | - | |
Centralized management | Centralized configuration, logging, monitoring, and reporting are performed by the Management Center or alternatively in the cloud with Cisco Defense Orchestrator | |||||||||||||
Application Visibility and Control (AVC) | Standard, supporting more than 4000 applications, as well as geolocations, users, and websites | |||||||||||||
AVC: OpenAppID support for custom, open source, application detectors | Standard | |||||||||||||
Cisco Security Intelligence | Standard, with IP, URL, and DNS threat intelligence | |||||||||||||
Cisco Firepower NGIPS | Available; can passively detect endpoints and infrastructure for threat correlation and Indicators of Compromise (IoC) intelligence | |||||||||||||
Cisco AMP for Networks | Available; enables detection, blocking, tracking, analysis, and containment of targeted and persistent malware, addressing the attack continuum both during and after attacks. Integrated threat correlation with Cisco AMP for Endpoints is also optionally available | |||||||||||||
Cisco AMP Threat Grid sandboxing | Available | |||||||||||||
URL Filtering: number of categories | More than 80 | |||||||||||||
URL Filtering: number of URLs categorized | More than 280 million | |||||||||||||
Automated threat feed and IPS signature updates | Yes: class-leading Collective Security Intelligence (CSI) from the Cisco Talos Group | |||||||||||||
Third-party and open-source ecosystem | Open API for integrations with third-party products; Snort® and OpenAppID community resources for new and specific threats | |||||||||||||
High availability and clustering | Active/Standby for ESXi and KVM | Active/standby; for Cisco Firepower 9300 intrachassis clustering of up to 5 chassis is allowed; Cisco Firepower 4100 Series allows clustering of up to 6 chassis | ||||||||||||
VLANs maximum | - | 1024 | ||||||||||||
Cisco Trust Anchor Technologies | - | ASA 5506-X, 5508-X, and 5516-X appliances, Firepower 2100 Series and Firepower 4100 Series and 9300 platforms include Trust Anchor Technologies for supply chain and software image assurance. Please see the section below for additional details |
Table 3. ASA Performance and Capabilities on Firepower Appliances
Features | Cisco Firepower Appliance Model | |||||||||||
2110 | 2120 | 2130 | 2140 | 4110 | 4120 | 4140 | 4150 | 9300 with 1 SM‑24 Module | 9300 with 1 SM‑36 Module | 9300 with 1 SM‑44 Module | 9300 with 3 SM‑44 Modules | |
Stateful inspection firewall throughput | 3 Gbps | 6 Gbps | 10 Gbps | 20 Gbps | 35 Gbps | 60 Gbps | 70 Gbps | 75 Gbps | 75 Gbps | 80 Gbps | 80 Gbps | 234 Gbps |
Stateful inspection firewall throughput (multiprotocol) | 1.5 Gbps | 3 Gbps | 5 Gbps | 10 Gbps | 15 Gbps | 30 Gbps | 40 Gbps | 50 Gbps | 50 Gbps | 60 Gbps | 60 Gbps | 130 Gbps |
Concurrent firewall connections | 1 million | 1.5 million | 2 million | 3 million | 10 million | 15 million | 25 million | 35 million | 55 million | 60 million | 60 million | 70 million |
Firewall latency (UDP 64B microseconds) | - | - | - | - | 3.5 | 3.5 | 3.5 | 3.5 | 3.5 | 3.5 | 3.5 | 3.5 |
New connections per second | 18000 | 28000 | 40000 | 75000 | 150,000 | 250,000 | 350,000 | 800,000 | 800,000 | 1.2 million | 1.8 million | 4 million |
IPsec VPN throughput (450B UDP L2L test) | 500 Mbps | 700 Mbps | 1 Gbps | 2 Gbps | 8 Gbps | 10 Gbps | 14 Gbps | 15 Gbps | 15 Gbps | 18 Gbps | 20 Gbps | 60 Gbps3/ 40 Gbps |
IPsec/Cisco AnyConnect/Apex site-to-site VPN peers | 1500 | 3500 | 7500 | 10000 | 10,000 | 15,000 | 20,000 | 20,000 | 20,000 | 20,000 | 20,000 | 60,0003 / 20,000 |
Maximum number of VLANs | 400 | 600 | 750 | 1024 | 1024 | 1024 | 1024 | 1024 | 1024 | 1024 | 1024 | 1024 |
Security contexts (included; maximum) | 2; 25 | 2; 25 | 2; 30 | 2; 40 | 10; 250 | 10; 250 | 10; 250 | 10; 250 | 10; 250 | 10; 250 | 10; 250 | 10; 250 |
High availability | Active/active and active/standby | Active/active and active/standby | Active/active and active/standby | Active/active and active/standby | Active/active and active/standby | Active/active and active/standby | Active/active and active/standby | Active/active and active/standby | Active/active and active/standby | Active/active and active/standby | Active/active and active/standby | Active/active and active/standby |
Clustering | - | - | - | - | Up to 16 appliances | Up to 16 appliances | Up to 16 appliances | Up to 16 appliances | Up to 5 appliances with 3 security modules each | Up to 5 appliances with three security modules each | Up to 5 appliances with three security modules each | Up to 5 appliances with 3 security modules each |
Scalability | VPN Load Balancing | VPN Load Balancing, Firewall Clustering | ||||||||||
Centralized management | Centralized configuration, logging, monitoring, and reporting are performed by Cisco Security Manager or alternatively in the cloud with Cisco Defense Orchestrator | |||||||||||
Adaptive Security Device Manager |
Web-based, local management for small-scale deployments |
Table 4. Operating Requirements for Firepower NGFWv Virtual Appliances
Platform Support | VMware, KVM, AWS, Azure |
Minimum systems requirements: VMware | 4 vCPU 8-GB memory 50-GB disk |
Minimum systems requirements: KVM | 4 vCPU 8-GB memory 50-GB disk |
Supported AWS instances | c3.xlarge |
Supported Azure instances | Standard_D3 |
Management options | Firepower Management Center Cisco Defense Orchestrator Firepower Device Manager (VMware) |
Table 5. Cisco Firepower 2100 Series Hardware Specifications
Features | Cisco Firepower Model | ||||||
2110 | 2120 | 2130 | 2140 | ||||
Dimensions (H x W x D) | 1.73 x 16.90 x 19.76 in. (4.4 x 42.9 x 50.2 cm) | ||||||
Form factor (rack units) | 1RU | ||||||
Security module slots | - | ||||||
I/O module slots | 0 | 1 NM slot | |||||
Integrated I/O | 12 x 10M/100M/1GBASE-T Ethernet interfaces (RJ-45), 4 x 1 Gigabit (SFP) Ethernet interfaces | 12 x 10M/100M/1GBASE-T Ethernet interfaces (RJ-45), 4 x 10 Gigabit (SFP+) Ethernet interfaces | |||||
Network modules | None | (FPR-NM-8X10G) 8 x 10 Gigabit Ethernet Enhanced Small Form-Factor Pluggable (SFP+) network module | |||||
Note: The 2100 Series appliances may also be deployed as dedicated threat sensors with fail-to-wire network modules. Please contact your Cisco representative for details. | |||||||
Maximum number of interfaces | Up to 16 total Ethernet ports | Up to 24 total Ethernet ports (12x1G RJ-45, 4x10G SFP+, and network module with 8x10G SFP+) | |||||
Integrated network management ports | 1 x 10M/100M/1GBASE-T Ethernet port (RJ-45) | ||||||
Serial port | 1 x RJ-45 console | ||||||
USB | 1 x USB 2.0 Type-A (500mA) | ||||||
Storage | 1x 100 GB, 1x spare slot (for MSP) | 1x 100 GB, 1x spare slot (for MSP) | 1x 200 GB, 1x spare slot (for MSP) | 1x 200 GB, 1x spare slot (for MSP) | |||
Power supplies | Configuration | Single integrated 250W AC power supply. | Single 400W AC, Dual 400W AC optional. Single/Dual 350W DC optional1 | Dual 400W AC. Single/dual 350W DC optional1 | |||
AC input voltage | 100 to 240V AC | 100 to 240V AC | |||||
AC maximum input current | < 2.7A at 100V | < 6A at 100V | |||||
AC maximum output power | 250W | 400W | |||||
AC frequency | 50 to 60 Hz | 50 to 60 Hz | |||||
AC efficiency | >88% at 50% load | >89% at 50% load | |||||
DC input voltage | - | -48V to -60VDC | |||||
DC maximum input current | - | < 12.5A at -48V | |||||
DC maximum output power | - | 350W | |||||
DC efficiency | - | >88% at 50% load | |||||
Redundancy | None | 1+1 AC or DC with dual supplies | |||||
Fans | 4 integrated (2 internal, 2 exhaust) fans2 | 1 hot-swappable fan module (with 4 fans)2 | |||||
Noise | 56 dBA @ 25C 74 dBA at highest system performance. | 56 dBA @ 25C 77 dBA at highest system performance. | |||||
Rack mountable | Yes. Fixed mount brackets included | Yes. Mount rails included (4-post EIA-310-D rack) | |||||
Weight | 16.1 lb (7.3 kg): with 2x SSDs | 19.4 lb (8.8 kg) 1 x power supplies, 1 x NM, 1 x fan module, 2x SSDs | 21 lb (9.53 kg) 2 x power supplies, 1 x NM, 1 x fan module, 2x SSDs | ||||
Temperature: operating | 32 to 104°F (0 to 40°C) | 32 to 104°F (0 to 40°C) or NEBS operation (see below)3 | 32 to 104°F (0 to 40°C) | ||||
Temperature: nonoperating | -4 to 149°F (-20 to 65°C) | ||||||
Humidity: operating | 10 to 85% noncondensing | ||||||
Humidity: nonoperating | 5 to 95% noncondensing | ||||||
Altitude: operating | 10,000 ft (max) | 10,000 ft (max) or NEBS operation (see below)3 | 10,000 ft (max) | ||||
Altitude: nonoperating | 40,000 ft (max) | ||||||
NEBS operation (FPR-2130 Only)3 | Operating altitude: 0 to 13,000 ft (3962 m) Operating temperature: Long term: 0 to 45°C, up to 6,000 ft (1829 m) Long term: 0 to 35°C, 6,000 to 13,000 ft (1829 to 3964 m) Short term: -5 to 55°C, up to 6,000 ft (1829 m) |
Table 6. Cisco Firepower 4100 Series Hardware Specifications
Features | Cisco Firepower Model | ||||||
4110 | 4120 | 4140 | 4150 | ||||
Dimensions (H x W x D) | 1.75 x 16.89 x 29.7 in. (4.4 x 42.9 x 75.4 cm) | ||||||
Form factor (rack units) | 1RU | ||||||
Security module slots | - | ||||||
I/O module slots | 2 | ||||||
Supervisor | Cisco Firepower 4000 Supervisor with 8 x 10 Gigabit Ethernet ports and 2 Network Module (NM) slots for I/O expansion | ||||||
Network modules | ● 8 x 10 Gigabit Ethernet Enhanced Small Form-Factor Pluggable (SFP+) network modules ● 4 x 40 Gigabit Ethernet Quad SFP+ network modules ● 8-port 1Gbps copper, FTW (fail to wire) Network Module Note: Firepower 4100 Series appliances may also be deployed as dedicated threat sensors, with fail-to-wire network modules. Please contact your Cisco representative for details. | ||||||
Maximum number of interfaces | Up to 24 x 10 Gigabit Ethernet (SFP+) interfaces; up to 8 x 40 Gigabit Ethernet (QSFP+) interfaces with 2 network modules | ||||||
Integrated network management ports | 1 x Gigabit Ethernet copper port | ||||||
Serial port | 1 x RJ-45 console | ||||||
USB | 1 x USB 2.0 | ||||||
Storage | 200 GB | 200 GB | 400 GB | 400 GB | |||
Power supplies | Configuration | Single 1100W AC, dual optional. Single/dual 950W DC optional1, 2 | Single 1100W AC, dual optional. Single/dual 950W DC optional1 | Dual 1100W AC1 | Dual 1100W AC1 | ||
AC input voltage | 100 to 240V AC | ||||||
AC maximum input current | 13A | ||||||
AC maximum output power | 1100W | ||||||
AC frequency | 50 to 60 Hz | ||||||
AC efficiency | >92% at 50% load | ||||||
DC input voltage | -40V to -60VDC | ||||||
DC maximum input current | 27A | ||||||
DC maximum output power | 950W | ||||||
DC efficiency | >92.5% at 50% load | ||||||
Redundancy | 1+1 | ||||||
Fans | 6 hot-swappable fans | ||||||
Noise | 78 dBA | ||||||
Rack mountable | Yes, mount rails included (4-post EIA-310-D rack) | ||||||
Weight | 36 lb (16 kg): 2 x power supplies, 2 x NMs, 6x fans; 30 lb (13.6 kg): no power supplies, no NMs, no fans | ||||||
Temperature: operating | 32 to 104°F | 32 to 104°F | 32 to 95°F (0 to 35°C), at sea level | 32 to 95°F (0 to 35°C), at sea level | |||
Temperature: nonoperating | -40 to 149°F (-40 to 65°C) | ||||||
Humidity: operating | 5 to 95% noncondensing | ||||||
Humidity: nonoperating | 5 to 95% noncondensing | ||||||
Altitude: operating | 10,000 ft (max) | 10,000 ft (max) or NEBS operation (see below) | 10,000 ft (max) | ||||
Altitude: nonoperating | 40,000 ft (max) | ||||||
NEBS operation (FPR 4120 only) | Operating altitude: 0 to 13,000 ft (3960 m) Operating temperature: Long term: 0 to 45°C, up to 6,000 ft (1829 m) Long term: 0 to 35°C, 6,000 to 13,000 ft (1829 to 3964 m) Short term: -5 to 50°C, up to 6,000 ft (1829 m) |
Table 7. Cisco Firepower 9300 Hardware Specifications
Specification | Description | |||
Dimensions (H x W x D) | 5.25 x 17.5 x 32 in. (13.3 x 44.5 x 81.3 cm) | |||
Form factor | 3 Rack Units (3RU), fits standard 19-in. (48.3-cm) square-hole rack | |||
Security module slots | 3 | |||
Network module slots | 2 (within supervisor) | |||
Supervisor | Cisco Firepower 9000 Supervisor with 8 x 10 Gigabit Ethernet ports and 2 network module slots for I/O expansion | |||
Security modules | ● Cisco Firepower 9000 Security Module 24 with 2 x SSDs in RAID-1 configuration ● Cisco Firepower 9000 Security Module 36 with 2 x SSDs in RAID-1 configuration | |||
Network modules | ● 8 x 10 Gigabit Ethernet Enhanced Small Form-Factor Pluggable (SFP+) network modules ● 4 x 40 Gigabit Ethernet Quad SFP+ network modules ● 2 x 100 Gigabit Ethernet Quad SFP28 network modules (double-wide, occupies both network module bays) Note: Firepower 9300 may also be deployed as a dedicated threat sensor, with fail-to-wire network modules. Please contact your Cisco representative for details. | |||
Maximum number of interfaces | Up to 24 x 10 Gigabit Ethernet (SFP+) interfaces; up to 8 x 40 Gigabit Ethernet (QSFP+) interfaces with 2 network modules | |||
Integrated network management ports | 1 x Gigabit Ethernet copper port (on supervisor) | |||
Serial port | 1 x RJ-45 console | |||
USB | 1 x USB 2.0 | |||
Storage | Up to 2.4 TB per chassis (800 GB per security module in RAID-1 configuration) | |||
Power supplies | AC power supply | -48V DC power supply | HVDC power supply | |
Input voltage | 200 to 240V AC | -40V to -60V DC* | 240 to 380V DC | |
Maximum input current | 15.5A to 12.9A | 69A to 42A | <14A at 200V | |
Maximum output power | 2500W | 2500W | 2500W | |
Frequency | 50 to 60 Hz | - | - | |
Efficiency (at 50% load) | 92% | 92% | 92% (at 50% load) | |
Redundancy | 1+1 | |||
Fans | 4 hot-swappable fans | |||
Noise | 75.5 dBA at maximum fan speed | |||
Rack mountable | Yes, mount rails included (4-post EIA-310-D rack) | |||
Weight | 105 lb (47.7 kg) with one security module; 135 lb (61.2 kg) fully configured | |||
Temperature: standard operating | Up to 10,000 ft (3000 M): 32 to 104°F (0 to 40°C) for SM-24 module 32 to 88°F (0 to 35°C) for SM-36 module at sea-level Altitude adjustment notes: For SM-36, maximum temp is 35⁰C, for every 1000 feet above sea level subtract 1⁰C | |||
Temperature: NEBS operating | Long term: 0 to 45°C, up to 6,000 ft (1829 m) Long term: 0 to 35°C, 6,000 to 13,000 ft (1829-3964 m) Short term: -5 to 55°C, up to 6,000 ft (1829 m) Note: Cisco Firepower 9300 NEBS compliance applies only to SM-24 configurations. | |||
Temperature: nonoperating | -40 to 149°F (-40 to 65°C); maximum altitude is 40,000 ft | |||
Humidity: operating | 5 to 95% noncondensing | |||
Humidity: nonoperating | 5 to 95% noncondensing | |||
Altitude: operating | SM-24: 0 to 13,000 ft (3962 m) SM-36: 0 to 10,000 ft (3048 m); please see above Operating Temperature section for temperature adjustment notes | |||
Altitude: nonoperating | 40,000 ft (12,192 m) |
* Minimum turn-on voltage is -44V DC
Table 8. Cisco Firepower 2100 Series, 4100 Series and Cisco Firepower 9300 NEBS, Regulatory, Safety, and EMC Compliance
Specification | Description |
NEBS | Cisco Firepower 9300 is NEBS compliant with SM-24 Security Modules. Cisco Firepower 4120 is NEBS compliant. |
Regulatory compliance | Products comply with CE markings per directives 2004/108/EC and 2006/108/EC |
Safety | ● UL 60950-1 ● CAN/CSA-C22.2 No. 60950-1 ● EN 60950-1 ● IEC 60950-1 ● AS/NZS 60950-1 ● GB4943 |
EMC: emissions | ● 47CFR Part 15 (CFR 47) Class A (FCC Class A) ● AS/NZS CISPR22 Class A ● CISPR22 CLASS A ● EN55022 Class A ● ICES003 Class A ● VCCI Class A ● EN61000-3-2 ● EN61000-3-3 ● KN22 Class A ● CNS13438 Class A ● EN300386 ● TCVN7189 |
EMC: Immunity | ● EN55024 ● CISPR24 ● EN300386 ● KN24 ● TVCN 7317 ● EN-61000-4-2 ● EN-61000-4-3 ● EN-61000-4-4 ● EN-61000-4-5 ● EN-61000-4-6 ● EN-61000-4-8 ● EN-61000-4-11 |
Cisco Trust Anchor Technologies
Cisco Trust Anchor Technologies provide a highly secure foundation for certain Cisco products. They enable hardware and software authenticity assurance for supply chain trust and strong mitigation against a man-in-the-middle compromise of software and firmware.
Trust Anchor capabilities include:
● Image signing: Cryptographically signed images provide assurance that the firmware, BIOS, and other software are authentic and unmodified. As the system boots, the system’s software signatures are checked for integrity.
● Secure Boot: Secure Boot anchors the boot sequence chain of trust to immutable hardware, mitigating threats against a system’s foundational state and the software that is to be loaded, regardless of a user’s privilege level. It provides layered protection against the persistence of illicitly modified firmware.
● Trust Anchor module: A tamper-resistant, strong-cryptographic, single-chip solution provides hardware authenticity assurance to uniquely identify the product so that its origin can be confirmed to Cisco, providing assurance that the product is genuine.
Firepower DDoS Mitigation
Firepower DDoS Mitigation is provided by Radware Virtual DefensePro (vDP), available and supported directly from Cisco on the following Cisco Firepower 9300 and 4100 series appliances:
Cisco Firepower Model | ASA image | FTD Image |
9300 – SM-44 | yes | yes |
9300 – SM-36 | yes | yes |
9300 – SM-24 | yes | yes |
4150 | yes | yes |
4140 | yes | yes |
4120 | yes | yes |
4110 | no | yes |
Radware vDP is an award-winning, real-time, behavioral DDoS attack mitigation solution that protects organizations against multiple DDoS threats. Firepower DDoS mitigation defends your application infrastructure against network and application degredation and outage.
DDoS Mitigation: Protection Set
Firepower’s vDP DDoS mitigation consists of patent-protected, adaptive, behavioral-based real-time signature technology that detects and mitigates zero-day network and application DDoS attacks in real time. It eliminates the need for human intervention and does not block legitimate user traffic when under attack.
The following attacks are detected and mitigated:
● SYN flood attacks
● Network DDoS attacks, including IP floods, ICMP floods, TCP floods, UDP floods, and IGMP floods
● Application DDoS attacks, including HTTP floods and DNS query floods
● Anomalous flood attacks, such as nonstandard and malformed packet attacks
Performance
The performance figures in Table 9 apply to all Cisco Firepower 4100 series models.
Table 9. Key DDoS Performance Metrics for Cisco Firepower 4100 Series
Parameter | Value |
Maximum mitigation capacity/throughput | 10 Gbps |
Maximum legitimate concurrent sessions | 209,000 Connections Per Second (CPS) |
Maximum DDoS flood attack prevention rate | 1,800,000 Packets Per Second (PPS) |
The performance figures in Table 10 are for Cisco Firepower 9300 with 1 to 3 Security Modules irrespective of Security Module type (SM-24, SM-36 or SM-44).
Table 10. Key DDoS Performance Metrics for Cisco Firepower 9300 with 1, 2, or 3 Security Modules.
Parameter | Firepower 9300 with 1 Security Module | Firepower 9300 with 2 Security Modules | Firepower 9300 with 3 Security Modules |
Maximum mitigation capacity/throughput | 10 Gbps | 20 Gbps | 30 Gbps |
Maximum legitimate concurrent sessions | 209,000 Connections Per Second (CPS) | 418,000 Connections Per Second (CPS) | 627,000 Connections Per Second (CPS) |
Maximum DDoS flood attack prevention rate | 1,800,000 Packets Per Second (PPS) | 3,600,000 Packets Per Second (PPS) | 5,400,000 Packets Per Second (PPS) |