Cisco Firepower 9000 Series

New Cisco Firepower 9000 Series

Modular security platform for service providers
This carrier-grade next-generation firewall (NGFW) is ideal for data centers and other high-performance settings that require low latency and high throughput. Deliver scalable, consistent security to workloads and data flows across physical, virtual, and cloud environments. With tightly integrated services, the Firepower 9000 Series lowers costs and supports open, programmable networks.

Firepower 9300
1.2 Tbps clustered throughput
10/40/100 Gb Network Interfaces
57 million concurrent connections, with application control
500,000 new connections per second
Security services options: AVC, NGIPS, AMP, URL Filtering, DDos Mitigation

Scalable multiservice security
Eliminate security gaps. Integrate and provision multiple Cisco and Cisco partner security services dynamically across the network fabric. See and correlate policy, traffic, and events across multiple services.

Expandable security modules
Flexibly scale your security performance. Meet business agility needs and enable rapid provisioning.

Carrier-grade performance
NEBS-compliant configurations available. Elevate threat defense and network performance with low-latency, large flow handling, and orchestration of security services. Protect Evolved Programmable Network, Evolved Services Platform, and Application Centric Infrastructure architectures.

Write a review

Note: HTML is not translated!
    Bad           Good

Table 1.       Appliance Performance Highlights

Features

Cisco Firepower Model

2110

2120

2130

2140

4110

4120

4140

4150

9300 with 1 SM-24 Module

9300 with 1 SM-36 Module

9300 with 1 SM-44 Module

9300 with 3 SM-44 Modules

Throughput FW + AVC (Cisco Firepower Threat Defense)

2.0 Gbps

3 Gbps

4.75 Gbps

8.5 Gbps

12 Gbps

20 Gbps

25 Gbps

30 Gbps

30 Gbps

42 Gbps

54 Gbps

135 Gbps

Throughput: FW + AVC + NGIPS (Cisco Firepower Threat Defense)

2.0 Gbps

3 Gbps

4.75 Gbps

8.5 Gbps

10 Gbps

15 Gbps

20 Gbps

24 Gbps

24 Gbps

34 Gbps

53 Gbps

133 Gbps

 

Table 2.       Performance Specifications and Feature Highlights for Physical and Virtual Appliances with the Cisco Firepower Threat Defense Image

Features

Cisco Firepower Model

NGFWv

2110

2120

2130

2140

4110

4120

4140

4150

9300 with 1 SM‑24 Module

9300 with 1 SM‑36 Module

9300 with 1 SM‑44 Module

9300 with 3 SM‑44 Modules

Throughput: FW + AVC

1.2 Gbps

2.0 Gbps

3 Gbps

4.75 Gbps

8.5 Gbps

12 Gbps

20 Gbps

25 Gbps

30 Gbps

30 Gbps

42 Gbps

54 Gbps

135 Gbps

Throughput: AVC + IPS

1.1 Gbps

2.0 Gbps

3 Gbps

4.75 Gbps

8.5 Gbps

10 Gbps

15 Gbps

20 Gbps

24 Gbps

24 Gbps

34 Gbps

53 Gbps

133 Gbps

Maximum concurrent sessions, with AVC

100,000

1 million

1.2 million

2 million

3.0 million

9 million

15 million

25 million

30 million

30 million

30 million

30 million

60 million

Maximum new connections per second, with AVC

10,000

12,000

16,000

24,000

40,000

68,000

120,000

160,000

200,000

120,000

160,000

300,000

900,000

IPSec VPN Throughput (1024B TCP w/Fastpath)

-

750 Mbps

1 Gbps

1.5 Gbps

3 Gbps

6 Gbps

10 Gbps

13 Gbps

14 Gbps

13.5 Gbps

16 Gbps

17 Gbps

51 Gbps

Maximum VPN Peers

-

1500

3500

7500

10000

10000

15000

20000

20000

20000

20000

20000

60000

Cisco Firepower Device Manager (local management)

Yes (VMware only)

Yes

Yes

Yes

Yes

-

-

-

-

-

-

-

-

Centralized management

Centralized configuration, logging, monitoring, and reporting are performed by the Management Center or alternatively in the cloud with Cisco Defense Orchestrator

Application Visibility and Control (AVC)

Standard, supporting more than 4000 applications, as well as geolocations, users, and websites

AVC: OpenAppID support for custom, open source, application detectors

Standard

Cisco Security Intelligence

Standard, with IP, URL, and DNS threat intelligence

Cisco Firepower NGIPS

Available; can passively detect endpoints and infrastructure for threat correlation and Indicators of Compromise (IoC) intelligence

Cisco AMP for Networks

Available; enables detection, blocking, tracking, analysis, and containment of targeted and persistent malware, addressing the attack continuum both during and after attacks. Integrated threat correlation with Cisco AMP for Endpoints is also optionally available

Cisco AMP Threat Grid sandboxing

Available

URL Filtering: number of categories

More than 80

URL Filtering: number of URLs categorized

More than 280 million

Automated threat feed and IPS signature updates

Yes: class-leading Collective Security Intelligence (CSI) from the Cisco Talos Group

Third-party and open-source ecosystem

Open API for integrations with third-party products; Snort® and OpenAppID community resources for new and specific threats

High availability and clustering

Active/Standby for ESXi and KVM

Active/standby; for Cisco Firepower 9300 intrachassis clustering of up to 5 chassis is allowed; Cisco Firepower 4100 Series allows clustering of up to 6 chassis

VLANs maximum

-

1024

Cisco Trust Anchor Technologies

-

ASA 5506-X, 5508-X, and 5516-X appliances, Firepower 2100 Series and Firepower 4100 Series and 9300 platforms include Trust Anchor Technologies for supply chain and software image assurance. Please see the section below for additional details

 

Table 3.       ASA Performance and Capabilities on Firepower Appliances

Features

Cisco Firepower Appliance Model

2110

2120

2130

2140

4110

4120

4140

4150

9300 with 1 SM‑24 Module

9300 with 1 SM‑36 Module

9300 with 1 SM‑44 Module

9300 with 3 SM‑44 Modules

Stateful inspection firewall throughput

3 Gbps

6 Gbps

10 Gbps

20 Gbps

35 Gbps

60 Gbps

70 Gbps

75 Gbps

75 Gbps

80 Gbps

80 Gbps

234 Gbps

Stateful inspection firewall throughput (multiprotocol)

1.5 Gbps

3 Gbps

5 Gbps

10 Gbps

15 Gbps

30 Gbps

40 Gbps

50 Gbps

50 Gbps

60 Gbps

60 Gbps

130 Gbps

Concurrent firewall connections

1 million

1.5 million

2 million

3 million

10 million

15 million

25 million

35 million

55 million

60 million

60 million

70 million

Firewall latency (UDP 64B microseconds)

-

-

-

-

3.5

3.5

3.5

3.5

3.5

3.5

3.5

3.5

New connections per second

18000

28000

40000

75000

150,000

250,000

350,000

800,000

800,000

1.2 million

1.8 million

4 million

IPsec VPN throughput (450B UDP L2L test)

500 Mbps

700 Mbps

1 Gbps

2 Gbps

8 Gbps

10 Gbps

14 Gbps

15 Gbps

15 Gbps

18 Gbps

20 Gbps

60 Gbps3/ 40 Gbps

IPsec/Cisco AnyConnect/Apex site-to-site VPN peers

1500

3500

7500

10000

10,000

15,000

20,000

20,000

20,000

20,000

20,000

60,0003

/ 20,000

Maximum number of VLANs

400

600

750

1024

1024

1024

1024

1024

1024

1024

1024

1024

Security contexts (included; maximum)

2; 25

2; 25

2; 30

2; 40

10; 250

10; 250

10; 250

10; 250

10; 250

10; 250

10; 250

10; 250

High availability

Active/active and active/standby

Active/active and active/standby

Active/active and active/standby

Active/active and active/standby

Active/active and active/standby

Active/active and active/standby

Active/active and active/standby

Active/active and active/standby

Active/active and active/standby

Active/active and active/standby

Active/active and active/standby

Active/active and active/standby

Clustering

-

-

-

-

Up to 16 appliances

Up to 16 appliances

Up to 16 appliances

Up to 16 appliances

Up to 5 appliances with 3 security modules each

Up to 5 appliances with three security modules each

Up to 5 appliances with three security modules each

Up to 5 appliances with 3 security modules each

Scalability

VPN Load Balancing

VPN Load Balancing, Firewall Clustering

Centralized management

Centralized configuration, logging, monitoring, and reporting are performed by Cisco Security Manager or alternatively in the cloud with Cisco Defense Orchestrator

Adaptive Security Device Manager

 

Web-based, local management for small-scale deployments

 

 Table 4.       Operating Requirements for Firepower NGFWv Virtual Appliances

Platform Support

VMware, KVM, AWS, Azure

Minimum systems requirements: VMware

4 vCPU

8-GB memory

50-GB disk

Minimum systems requirements: KVM

4 vCPU

8-GB memory

50-GB disk

Supported AWS instances

c3.xlarge

Supported Azure instances

Standard_D3

Management options

Firepower Management Center

Cisco Defense Orchestrator

Firepower Device Manager (VMware)

 

Table 5.       Cisco Firepower 2100 Series Hardware Specifications

Features

Cisco Firepower Model

2110

2120

2130

2140

Dimensions (H x W x D)

1.73 x 16.90 x 19.76 in. (4.4 x 42.9 x 50.2 cm)

Form factor (rack units)

1RU

Security module slots

-

I/O module slots

0

1 NM slot

Integrated I/O

12 x 10M/100M/1GBASE-T Ethernet interfaces (RJ-45), 4 x 1 Gigabit (SFP) Ethernet interfaces

12 x 10M/100M/1GBASE-T Ethernet interfaces (RJ-45), 4 x 10 Gigabit (SFP+) Ethernet interfaces

Network modules

None

(FPR-NM-8X10G) 8 x 10 Gigabit Ethernet Enhanced Small Form-Factor Pluggable (SFP+) network module

Note: The 2100 Series appliances may also be deployed as dedicated threat sensors with fail-to-wire network modules. Please contact your Cisco representative for details.

Maximum number of interfaces

Up to 16 total Ethernet ports
(12x1G RJ-45, 4x1G SFP)

Up to 24 total Ethernet ports (12x1G RJ-45, 4x10G SFP+, and network module with 8x10G SFP+)

Integrated network management ports

1 x 10M/100M/1GBASE-T Ethernet port (RJ-45)

Serial port

1 x RJ-45 console

USB

1 x USB 2.0 Type-A (500mA)

Storage

1x 100 GB, 1x spare slot (for MSP)

1x 100 GB, 1x spare slot (for MSP)

1x 200 GB, 1x spare slot (for MSP)

1x 200 GB, 1x spare slot (for MSP)

Power supplies

Configuration

Single integrated 250W AC power supply.

Single 400W AC, Dual 400W AC optional. Single/Dual 350W DC optional1

Dual 400W AC. Single/dual 350W DC optional1

AC input voltage

100 to 240V AC

100 to 240V AC

AC maximum input current

< 2.7A at 100V

< 6A at 100V

AC maximum output power

250W

400W

AC frequency

50 to 60 Hz

50 to 60 Hz

AC efficiency

>88% at 50% load

>89% at 50% load

DC input voltage

-

-48V to -60VDC

DC maximum input current

-

< 12.5A at -48V

DC maximum output power

-

350W

DC efficiency

-

>88% at 50% load

Redundancy

None

1+1 AC or DC with dual supplies

Fans

4 integrated (2 internal, 2 exhaust) fans2

1 hot-swappable fan module (with 4 fans)2

Noise

56 dBA @ 25C

74 dBA at highest system performance.

56 dBA @ 25C

77 dBA at highest system performance.

Rack mountable

Yes. Fixed mount brackets included
(2-post). Mount rails optional (4-post EIA-310-D rack)

Yes. Mount rails included (4-post EIA-310-D rack)

Weight

16.1 lb (7.3 kg): with 2x SSDs

19.4 lb (8.8 kg) 1 x power supplies, 1 x NM, 1 x fan module, 2x SSDs

21 lb (9.53 kg) 2 x power supplies, 1 x NM, 1 x fan module, 2x SSDs

Temperature: operating

32 to 104°F (0 to 40°C)

32 to 104°F (0 to 40°C) or NEBS operation (see below)3

32 to 104°F (0 to 40°C)

Temperature: nonoperating

-4 to 149°F (-20 to 65°C)

Humidity: operating

10 to 85% noncondensing

Humidity: nonoperating

5 to 95% noncondensing

Altitude: operating

10,000 ft (max)

10,000 ft (max) or NEBS operation (see below)3

10,000 ft (max)

Altitude: nonoperating

40,000 ft (max)

NEBS operation (FPR-2130 Only)3

Operating altitude: 0 to 13,000 ft (3962 m)

Operating temperature:

Long term: 0 to 45°C, up to 6,000 ft (1829 m)

Long term: 0 to 35°C, 6,000 to 13,000 ft (1829 to 3964 m)

Short term: -5 to 55°C, up to 6,000 ft (1829 m)

1 Dual power supplies are hot-swappable.
2 Fans operate in a 3+1 redundant configuration where the system will continue to function with only 3 operational fans. The 3 remaining fans will run at full speed.
3 FPR-2130 platform is designed to be NEBS ready. The availability of NEBS certification is pending.
 

Table 6.       Cisco Firepower 4100 Series Hardware Specifications

Features

Cisco Firepower Model

4110

4120

4140

4150

Dimensions (H x W x D)

1.75 x 16.89 x 29.7 in. (4.4 x 42.9 x 75.4 cm)

Form factor (rack units)

1RU

Security module slots

-

I/O module slots

2

Supervisor

Cisco Firepower 4000 Supervisor with 8 x 10 Gigabit Ethernet ports and 2 Network Module (NM) slots for I/O expansion

Network modules

  8 x 10 Gigabit Ethernet Enhanced Small Form-Factor Pluggable (SFP+) network modules
  4 x 40 Gigabit Ethernet Quad SFP+ network modules
  8-port 1Gbps copper, FTW (fail to wire) Network Module

Note: Firepower 4100 Series appliances may also be deployed as dedicated threat sensors, with fail-to-wire network modules. Please contact your Cisco representative for details.

Maximum number of interfaces

Up to 24 x 10 Gigabit Ethernet (SFP+) interfaces; up to 8 x 40 Gigabit Ethernet (QSFP+) interfaces with 2 network modules

Integrated network management ports

1 x Gigabit Ethernet copper port

Serial port

1 x RJ-45 console

USB

1 x USB 2.0

Storage

200 GB

200 GB

400 GB

400 GB

Power supplies

Configuration

Single 1100W AC, dual optional. Single/dual 950W DC optional1, 2

Single 1100W AC, dual optional. Single/dual 950W DC optional1

Dual 1100W AC1

Dual 1100W AC1

AC input voltage

100 to 240V AC

AC maximum input current

13A

AC maximum output power

1100W

AC frequency

50 to 60 Hz

AC efficiency

>92% at 50% load

DC input voltage

-40V to -60VDC

DC maximum input current

27A

DC maximum output power

950W

DC efficiency

>92.5% at 50% load

Redundancy

1+1

Fans

6 hot-swappable fans

Noise

78 dBA

Rack mountable

Yes, mount rails included (4-post EIA-310-D rack)

Weight

36 lb (16 kg): 2 x power supplies, 2 x NMs, 6x fans; 30 lb (13.6 kg): no power supplies, no NMs, no fans

Temperature: operating

32 to 104°F
(0 to 40°C)

32 to 104°F
(0 to 40°C) or NEBS operation (see below)

32 to 95°F (0 to 35°C), at sea level

32 to 95°F (0 to 35°C), at sea level

Temperature: nonoperating

-40 to 149°F (-40 to 65°C)

Humidity: operating

5 to 95% noncondensing

Humidity: nonoperating

5 to 95% noncondensing

Altitude: operating

10,000 ft (max)

10,000 ft (max) or NEBS operation (see below)

10,000 ft (max)

Altitude: nonoperating

40,000 ft (max)

NEBS operation (FPR 4120 only)

Operating altitude: 0 to 13,000 ft (3960 m)

Operating temperature:

Long term: 0 to 45°C, up to 6,000 ft (1829 m)

Long term: 0 to 35°C, 6,000 to 13,000 ft (1829 to 3964 m)

Short term: -5 to 50°C, up to 6,000 ft (1829 m)

1 Dual power supplies are hot-swappable.

 

Table 7.       Cisco Firepower 9300 Hardware Specifications

Specification

Description

Dimensions (H x W x D)

5.25 x 17.5 x 32 in. (13.3 x 44.5 x 81.3 cm)

Form factor

3 Rack Units (3RU), fits standard 19-in. (48.3-cm) square-hole rack

Security module slots

3

Network module slots

2 (within supervisor)

Supervisor

Cisco Firepower 9000 Supervisor with 8 x 10 Gigabit Ethernet ports and 2 network module slots for I/O expansion

Security modules

  Cisco Firepower 9000 Security Module 24 with 2 x SSDs in RAID-1 configuration
  Cisco Firepower 9000 Security Module 36 with 2 x SSDs in RAID-1 configuration

Network modules

  8 x 10 Gigabit Ethernet Enhanced Small Form-Factor Pluggable (SFP+) network modules
  4 x 40 Gigabit Ethernet Quad SFP+ network modules
  2 x 100 Gigabit Ethernet Quad SFP28 network modules (double-wide, occupies both network module bays)

Note: Firepower 9300 may also be deployed as a dedicated threat sensor, with fail-to-wire network modules. Please contact your Cisco representative for details.

Maximum number of interfaces

Up to 24 x 10 Gigabit Ethernet (SFP+) interfaces; up to 8 x 40 Gigabit Ethernet (QSFP+) interfaces with 2 network modules

Integrated network management ports

1 x Gigabit Ethernet copper port (on supervisor)

Serial port

1 x RJ-45 console

USB

1 x USB 2.0

Storage

Up to 2.4 TB per chassis (800 GB per security module in RAID-1 configuration)

Power supplies

AC power supply

-48V DC power supply

HVDC power supply

Input voltage

200 to 240V AC

-40V to -60V DC*

240 to 380V DC

Maximum input current

15.5A to 12.9A

69A to 42A

<14A at 200V

Maximum output power

2500W

2500W

2500W

Frequency

50 to 60 Hz

-

-

Efficiency (at 50% load)

92%

92%

92% (at 50% load)

Redundancy

1+1

Fans

4 hot-swappable fans

Noise

75.5 dBA at maximum fan speed

Rack mountable

Yes, mount rails included (4-post EIA-310-D rack)

Weight

105 lb (47.7 kg) with one security module; 135 lb (61.2 kg) fully configured

Temperature: standard operating

Up to 10,000 ft (3000 M): 32 to 104°F (0 to 40°C) for SM-24 module

32 to 88°F (0 to 35°C) for SM-36 module at sea-level

Altitude adjustment notes:

For SM-36, maximum temp is 35C, for every 1000 feet above sea level subtract 1C

Temperature: NEBS operating

Long term: 0 to 45°C, up to 6,000 ft (1829 m)

Long term: 0 to 35°C, 6,000 to 13,000 ft (1829-3964 m)

Short term: -5 to 55°C, up to 6,000 ft (1829 m)

Note: Cisco Firepower 9300 NEBS compliance applies only to SM-24 configurations.

Temperature: nonoperating

-40 to 149°F (-40 to 65°C); maximum altitude is 40,000 ft

Humidity: operating

5 to 95% noncondensing

Humidity: nonoperating

5 to 95% noncondensing

Altitude: operating

SM-24: 0 to 13,000 ft (3962 m)

SM-36: 0 to 10,000 ft (3048 m); please see above Operating Temperature section for temperature adjustment notes

Altitude: nonoperating

40,000 ft (12,192 m)

 * Minimum turn-on voltage is -44V DC

 

Table 8.       Cisco Firepower 2100 Series, 4100 Series and Cisco Firepower 9300 NEBS, Regulatory, Safety, and EMC Compliance

Specification

Description

NEBS

Cisco Firepower 9300 is NEBS compliant with SM-24 Security Modules. Cisco Firepower 4120 is NEBS compliant.

Regulatory compliance

Products comply with CE markings per directives 2004/108/EC and 2006/108/EC

Safety

  UL 60950-1
  CAN/CSA-C22.2 No. 60950-1
  EN 60950-1
  IEC 60950-1
  AS/NZS 60950-1
  GB4943

EMC: emissions

  47CFR Part 15 (CFR 47) Class A (FCC Class A)
  AS/NZS CISPR22 Class A
  CISPR22 CLASS A
  EN55022 Class A
  ICES003 Class A
  VCCI Class A
  EN61000-3-2
  EN61000-3-3
  KN22 Class A
  CNS13438 Class A
  EN300386
  TCVN7189

EMC: Immunity

  EN55024
  CISPR24
  EN300386
  KN24
  TVCN 7317
  EN-61000-4-2 
  EN-61000-4-3 
  EN-61000-4-4
  EN-61000-4-5
  EN-61000-4-6
  EN-61000-4-8
  EN-61000-4-11

Cisco Trust Anchor Technologies

Cisco Trust Anchor Technologies provide a highly secure foundation for certain Cisco products. They enable hardware and software authenticity assurance for supply chain trust and strong mitigation against a man-in-the-middle compromise of software and firmware.

 

Trust Anchor capabilities include:

   Image signing: Cryptographically signed images provide assurance that the firmware, BIOS, and other software are authentic and unmodified. As the system boots, the system’s software signatures are checked for integrity.

   Secure Boot: Secure Boot anchors the boot sequence chain of trust to immutable hardware, mitigating threats against a system’s foundational state and the software that is to be loaded, regardless of a user’s privilege level. It provides layered protection against the persistence of illicitly modified firmware.

   Trust Anchor module: A tamper-resistant, strong-cryptographic, single-chip solution provides hardware authenticity assurance to uniquely identify the product so that its origin can be confirmed to Cisco, providing assurance that the product is genuine.

Firepower DDoS Mitigation

Firepower DDoS Mitigation is provided by Radware Virtual DefensePro (vDP), available and supported directly from Cisco on the following Cisco Firepower 9300 and 4100 series appliances:

Cisco Firepower Model

ASA image

FTD Image

9300 – SM-44

yes

yes

9300 – SM-36

yes

yes

9300 – SM-24

yes

yes

4150

yes

yes

4140

yes

yes

4120

yes

yes

4110

no

yes

Radware vDP is an award-winning, real-time, behavioral DDoS attack mitigation solution that protects organizations against multiple DDoS threats. Firepower DDoS mitigation defends your application infrastructure against network and application degredation and outage.

DDoS Mitigation: Protection Set

Firepower’s vDP DDoS mitigation consists of patent-protected, adaptive, behavioral-based real-time signature technology that detects and mitigates zero-day network and application DDoS attacks in real time. It eliminates the need for human intervention and does not block legitimate user traffic when under attack.

 

The following attacks are detected and mitigated:

   SYN flood attacks

   Network DDoS attacks, including IP floods, ICMP floods, TCP floods, UDP floods, and IGMP floods

   Application DDoS attacks, including HTTP floods and DNS query floods

   Anomalous flood attacks, such as nonstandard and malformed packet attacks

Performance

The performance figures in Table 9 apply to all Cisco Firepower 4100 series models.

Table 9.       Key DDoS Performance Metrics for Cisco Firepower 4100 Series

Parameter

Value

Maximum mitigation capacity/throughput

10 Gbps

Maximum legitimate concurrent sessions

209,000 Connections Per Second (CPS)

Maximum DDoS flood attack prevention rate

1,800,000 Packets Per Second (PPS)

The performance figures in Table 10 are for Cisco Firepower 9300 with 1 to 3 Security Modules irrespective of Security Module type (SM-24, SM-36 or SM-44).

Table 10.     Key DDoS Performance Metrics for Cisco Firepower 9300 with 1, 2, or 3 Security Modules.

Parameter

Firepower 9300 with 1 Security Module

Firepower 9300 with 2 Security Modules

Firepower 9300 with 3 Security Modules

Maximum mitigation capacity/throughput

10 Gbps

20 Gbps

30 Gbps

Maximum legitimate concurrent sessions

209,000 Connections Per Second (CPS)

418,000 Connections Per Second (CPS)

627,000 Connections Per Second (CPS)

Maximum DDoS flood attack prevention rate

1,800,000 Packets Per Second (PPS)

3,600,000 Packets Per Second (PPS)

5,400,000 Packets Per Second (PPS)

  • Views: 3808
  • Brand: Cisco
  • Product Code: Cisco Firepower 9000
  • Rack: 3U
    Hotline: 0904092014
    Warranty: 1 Year
  • Availability: In Stock
  • Contact us

Tags: Cisco, Firepower, 9000 Series, 9000