Cisco Firepower 9300 Manuale

Cisco Firepower 9300 Hardware Installation Guide

First Published: 2015-07-16

Last Modified: 2019-09-30

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,

INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,

EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH

THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,

CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.

CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF

MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT

LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS

HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network

topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional

and coincidental.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL:

https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a

partnership relationship between Cisco and any other company. (1721R)

CONTENTS

Overview 1

CHAPTER 1

Features 1

机箱组件 4

Deployment Options 6

装箱清单 6

序列号位置 8

前面板 9

Rear Panel 10

管理引擎 11

安全模块 13

网络模块 16

10-Gb 网络模块 16

40-Gb 网络模块 18

100-Gb 网络模块（两端口单位宽） 18

100-Gb网络模块（四个端口，单个宽） 20

100-Gb 网络模块（双位宽） 21

硬件旁路网络模块 21

具有硬件旁路的 40-Gb 网络模块 23

10-Gb SR/10-Gb LR 网络模块（带硬件旁路） 24

电源模块 26

Fan Modules 28

支持的 SFP/SFP+ 和QSFP 收发器 28

硬件规格 31

产品 ID 编号 33

Cisco Firepower 9300 Hardware Installation Guide

iii

电源线规格 36

Installation Preparation 43

CHAPTER 2

Installation Warnings 43

安全建议 46

维护用电安全 46

防范 ESD 损害 47

现场环境 47

现场考虑因素 47

Power Supply Considerations 48

机架配置注意事项 48

Mount and Connect 49

CHAPTER 3

拆箱并检查机箱 49

将机箱安装到机架上 50

将机箱接地 54

安装 FIPS 不透明防护罩 56

连接电缆、打开电源并检验连通性 60

维护和升级 63

CHAPTER 4

拆卸和更换管理引擎 63

拆卸和更换安全模块 64

Remove and Replace the SSD 66

安装单宽网络模块 67

安装双宽网络模块 70

拆卸和更换电源模块 73

连接直流电源模块 75

连接 HVDC 电源模块 76

Remove and Replace the Fan Module 78

Cisco Firepower 9300 Hardware Installation Guide

Contents

CHAPTER 1

Overview

•Features , on page 1

•机箱组件，第 4页

•Deployment Options, on page 6

•装箱清单，第 6页

•序列号位置，第 8页

•前面板，第 9页

•Rear Panel, on page 10

•管理引擎，第 11 页

•安全模块，第 13 页

•网络模块，第 16 页

•硬件旁路网络模块，第 21 页

•电源模块，第 26 页

•Fan Modules, on page 28

•支持的 SFP/SFP+ 和QSFP 收发器，第 28 页

•硬件规格，第 31 页

•产品 ID 编号，第 33 页

•电源线规格，第 36 页

Features

The Cisco Firepower 9300 security appliance is a next generation network and content security platform. Its

modular standalone chassis offers high-performance and flexible I/O options, which enable it to run multiple

security services simultaneously.

The Firepower 9300 runs FXOS and can deploy multiple application types. See Cisco Firepower 4100/9300

FXOS Compatibility for more information about software version support for each component in the Firepower

9300. See 产品 ID 编号, on page 33 for a list of the component product IDs (PIDs) associated with the

Firepower 9300.

The following figure shows a fully populated Firepower 9300.

Cisco Firepower 9300 Hardware Installation Guide

Figure 1: Firepower 9300

The following table lists the hardware features of the Firepower 9300.

Table 1: Firepower 9300 Features

DescriptionFeature

Common Criteria (CC) and Federal Information Processing Standards (FIPS)

For more information, see the "Security Certifications Compliance"

topic in the Security Certifications Compliance chapter in the FXOS

Configuration Guide for your software version.

Note

Security standards

certifications

3 RUForm factor

Cisco Firepower 9300 Hardware Installation Guide

Overview

Features

DescriptionFeature

Mount rails included (4-post EIA-310-D rack) with span between front and rear

rails of 24 to 36 in.

Rack mount

Front to rear

Cold aisle to hot aisle

Airflow

Cisco Firepower 9300 Supervisor with eight 10-Gigabit Ethernet ports and two

network module slots for I/O expansion

See 机箱组件, on page 4 for more information about the chassis Supervisor.

Supervisor

ThreeSecurity module slots

• SM-24—24-physical core CPU security module (NEBS ready)

• SM-36—36-physical core CPU high performance security module

• SM-40—40-physical core CPU Crypto security module (NEBS ready)

• SM-44—44-physical core CPU high performance security module (NEBS

ready)

• SM-48—48-physical core CPU Crypto security module (NEBS ready)

• SM-56—56-physical core CPU Crypto security module

See 安全模块, on page 13 for more information about the security modules.

Supported security

modules

Two

Located in the Supervisor

Network module slots

• 8-port 10-Gigabit Ethernet SFP+

• 4-port 40-Gigabit Ethernet QSFP+

• 2-port 100-Gigabit Ethernet QSFP28 (double-wide, occupies both network

module slots)

• 2-port 100-Gigabit Ethernet QSFP28

• 4-port 100-Gigabit Ethernet QSFP28

• 2-port 40-Gigabit Ethernet QSFP+ (built-in) with hardware bypass

•6-port 10-Gigabit Ethernet SR/LR fiber SFP+ (built-in) with hardware bypass

You can deploy the Firepower 9300 as a dedicated threat sensor with

hardware bypass network modules.

Note

Supported network

modules

256-GB DDR4 DRAM per security moduleMemory

Up to twenty-four 10-Gigabit Ethernet (SFP+) interfaces; up to eight 40-Gigabit

Ethernet (QSFP+) interfaces with two network modules; up to eight 100-Gigabit

Ethernet (SFP+) interfaces

Maximum number of

interfaces

Cisco Firepower 9300 Hardware Installation Guide

Overview

Features

DescriptionFeature

One Gigabit Ethernet port on the Supervisor

Supports 1-Gb fiber or copper SFPs

Management port

One RJ-45 consoleSerial port

One USB 2.0 Type AUSB port

Displays serial numberPullout asset card

On rear panelGrounding lug

On front panelLocator beacon

On rear panel

The initial Firepower 9300 chassis does not have a power switch.

Note

Power switch

Two

On rear panel

Power supply slots

AC, DC, and HVDC

Do not mix power supply types or wattage.

Note

Power supply types

Yes 1 + 1Redundant power

Four (hot-swappable)

On rear panel

Fan slots

SM-24, SM-36, SM-44—Up to 2.4 TB per chassis (1.2 TB per security module

in RAID 1 configuration)

SM-40, SM-48, SM-56—UP to 4.8 TB per chassis (1.6 TB per security module

in RAID 1 Configuration)

Storage

机箱组件

Firepower 9300 机箱包含以下组件：

• Firepower 9300 管理引擎 -机箱管理引擎模块

•管理端口

• RJ-45 控制台端口

• USB A 型端口

• 8 个端口，用于 1千兆或 10 千兆以太网 SFP（光纤和铜缆）

Cisco Firepower 9300 Hardware Installation Guide

Overview

机箱组件

• Firepower 9300 安全模块 -最多三个安全模块

• Firepower 网络模块 -两个单位宽网络模块或一个双位宽网络模块

•两个电源模块（交流或直流）

•四个风扇模块

电源开关

原始 Firepower 9300 AC 机箱不包含外部电源开关。使用 CLI 命令重置 Firepower 9300。要以物

理方式重启 9300，您必须拔掉电源线，然后重新插上电源线。

注释

关闭机箱电源（将电源开关切换至“关闭”(OFF) 位置，或拔掉电源线）后，至少等待 10 秒，再

重新开机。

注释

Firepower 9300 机箱在机箱后部具有备用电源开关，可用于控制两个电源模块。您必须先正常关

闭软件应用，再将开关切换至“关闭”(OFF) 位置。

如果将开关切换至“关闭”(OFF) 位置，无论软件状态如何，管理引擎和安全模块的主电源都将关

闭，这不仅会导致所有正在传输的数据发生丢失，而且可能损坏 SSD 中的数据。您必须先正常

关闭软件应用，再将开关切换至“关闭”(OFF) 位置。

警告

正常关闭机箱

您可以从 CLI 或机箱管理器正常关闭机箱。

请参阅FXOS CLI配置指南中系统管理一章中的“关闭Firepower 4100/9300机箱”小节，以获取符

合您软件版本的从CLI关闭机箱的流程。正常关闭通常只需要几秒，但是最长可能需要三分钟。

当屏幕上显示 System Halted 消息时，您可以将机箱后部的电源开关切换至“关闭”(OFF) 位置。

请参阅FXOS CLI配置指南中系统管理一章中的“关闭Firepower 4100/9300机箱”小节，以获取符

合您软件版本的从CLI关闭机箱的流程。完成关机后，您可以将机箱背面的电源开关切换至“关

闭”(OFF) 位置。

当您关闭机箱时，安全模块将自动关闭。

正常关闭安全模块

您可以从 CLI 或机箱管理器单独关闭安全模块，也可以使用每个安全模块正面的电源开关。短

暂按住每个安全模块前面板上的电源按钮。当电源按钮变为琥珀色后，您即可将机箱后部的电

源开关切换至“关闭”(OFF) 位置。

在更换安全模块时，可单独关闭安全模块。

Cisco Firepower 9300 Hardware Installation Guide

Overview

机箱组件

您必须按下安装在9300机箱中每个安全模块上的电源按钮。您最多可以在机箱中安装三个安全

模块。

注释

请参阅FXOS CLI配置指南Security/Module/Engine一章中的“打开/关闭已安装模块/引擎”内容，以

获取符合您软件版本的用主管CLI命令关闭安全模块的流程。当系统对所有插槽显示 Oper Power:

off 后，您可以将机箱后部的电源开关切换至“关闭”(OFF) 位置。

请参阅FXOS CLI配置指南Security/Module/Engine一章中的“打开/关闭已安装模块/引擎”内容，以

获取符合您软件版本的用主管 CLI 命令关闭安全模块的流程。完成关机后，您可以将机箱背面

的电源开关切换至“关闭”(OFF) 位置。

Deployment Options

Here are some examples of how you can deploy the Firepower 9300:

• At the core/aggregation layer of a three-tier data center in a high availability configuration.

• As a dedicated multifunction security service within converged infrastructure stacks (vBlock, FlexPod,

for example) at the access layer.

• As a high-performance data center security appliance between the WAN edge and data center core in an

high availability configuration.

• As a leaf that exclusively offers security functions in a spine/leaf data center design.

装箱清单

下图显示了 Firepower 9300 的装箱清单。请注意，装箱清单可能有所变动，实际配件的数量可能多

于或少于装箱清单上所列的内容。

Cisco Firepower 9300 Hardware Installation Guide

Overview

Deployment Options

Altri manuali per Firepower 9300

Indice

Lingue:

Altri manuali Cisco Hardware di rete

Cisco

Cisco GS7000 Istruzioni operative

Cisco

Cisco EXPLORER 3100 Manuale utente

Cisco

Cisco Catalyst 2960-XR Manuale utente

Cisco

Cisco NTP-E157 Manuale elenco delle parti

Cisco

Cisco VPN 3002 Hardware Client Manager Manuale utente

Cisco

Cisco Remote PHY Shelf 7200 Manuale di installazione

Cisco

Cisco ONS 15454 Manuale utente

Cisco

Cisco Aironet 340 Series Come usare

Cisco

Cisco TelePresence Manuale di servizio

Cisco

Cisco NCS 1002 Aggiornamento firmware

Cisco

Cisco ONS 15200 Series Manuale utente

Cisco

Cisco Cisco ASA Series Manuale utente

Cisco

Cisco ONS 15310-MA SDH Manuale

Cisco

Cisco MultiRIP Ethernet Card Manuale utente

Cisco

Cisco AGS+ Manuale di istruzioni

Cisco

Cisco MDS 9500 Series Manuale

Cisco

Cisco Firepower 1010 FPR1010-NGFW-K9 Manuale

Cisco

Cisco MX60 Manuale utente

Cisco

Cisco IAD1101 Manuale utente

Cisco

Cisco 3600 Series Istruzioni operative e di sicurezza

Cisco

Cisco Edge 300 Series Guida rapida

Cisco

Cisco Aironet 340 Series Manuale utente

Cisco

Cisco ISE - Line Card ISE Manuale utente

Cisco

Cisco Firepower 1010 Series Manuale

Manuali Hardware di rete popolari di altre marche

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manuale utente

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manuale utente

Yudor

Yudor YDS-16 Manuale utente

D-Link

D-Link ShareCenter DNS-320L Manuale utente

Samsung

Samsung ES1642dc Istruzioni per l’uso

Honeywell Home

Honeywell Home LTEM-PV Istruzioni per il montaggio

evertz

evertz 7700 Series Manuale utente

D-Link

D-Link ShareCenter DNS-343 Manuale utente

Asante

Asante AsanteBridge 1012 Manuale utente

FireBrick

FireBrick FB2700 Manuale utente

Audiovox Electronics

Audiovox Electronics ARWH2T Manuale utente

ADC

ADC DSX-1 Manuale

NetComm

NetComm NF2 Manuale utente

Alcatel-Lucent

Alcatel-Lucent 5620 Manuale utente

Dell EMC

Dell EMC XC6420 Series Manuale utente

Lanner

Lanner NCA-1020A Manuale utente

Allied Telesis

Allied Telesis AT-TN121-A Manuale utente

Arista

Arista CCA-ETM-Q12 Manuale utente