Cisco Firepower 2100 Series User Manual

Cisco Firepower 2100 Series Hardware Installation Guide
Cisco Firepower 2100 Series User Manuals Pdf
Cisco Firepower 2100 Series User Manual Pdf
Cisco Firepower 2100 Series User Manually

We live in a time when lines in IT are blurring, and the line between security and network operations is just one example. When organizations are breached, their network is imperiled and business can suffer. Resiliency, performance, and threat defense are increasingly intertwined. No one understands this better than Cisco, with our decades of network leadership and our innovation in security.

Cisco is enabling our customers to maintain network performance while they keep their data safe. Our latest Firepower 2100 Series NGFWs are a testament to this, delivering business resiliency through superior threat defense and unmatched price-performance. With Firepower 2100 Series, enabling advanced threat functions does not mean compromised performance – you can maximize throughput while maintaining robust threat inspection.

Cisco Firepower 2100 Series Appliances The Cisco Firepower 2100 Series is a family of four threat-focused NGFW security platforms that deliver business resiliency through superior threat defense. It offers exceptional sustained performance when advanced threat functions are enabled. Cisco Firepower 2100 Series User Manual 2015 Dodge Ram 1500 User Manual Ricoh Service Manual Free Download Dragon Naturallyspeaking 11 Premium User Manual Pdf. Cisco ISA 500 Series; Cisco Firepower 2100 Series. Power Output frequency regulation 50/60 Hz Input operation voltage (min) 170 V.

Business resiliency is job one for network operations teams – but they can’t do their jobs if security is a choke point. On the Cisco Firepower 2100 Series, when you enable advanced threat functions, they won’t become a network bottleneck like competitors. Cisco’s innovative dual, multi-core CPU architecture and software optimizations maximize firewall, cryptographic, and threat inspection performance simultaneously.

Hot Sauce challenge to kick off Cisco's new Firepower 2100 series Next Generation Firewall. Cisco Firepower 2100 Series Pdf User Manuals. View online or download Cisco Firepower 2100 Series Getting Started Manual, Hardware Installation Manual.

From preliminary testing, we’re seeing minimal impact on large packet firewall throughput when enabling intrusion inspection. In fact, with IPS fully enabled, we see with large packets less than 1% throughput degradation to network traffic. Contrast that with the typical 50% or greater impact in competing designs. With Cisco’s design, you don’t have to choose between security and network performance – you get both!

A ‘No Compromises’ Security Architecture

Key to the performance sustaining abilities of the Firepower 2100 Series is a dual, multi-core CPU architecture and software optimization that enables:

Sustained throughput performance when threat functions are enabled vs. competing designs
Flexibility and future-proofing versus ASIC-based designs that inhibit the ability to add new defenses and functions
Fast path accelerates flows not requiring threat inspection, further enhancing performance through the appliance

By applying purpose-built processing for the tasks at hand, the Firepower 2100 Series NGFWs optimize performance and threat protection, without burdening network operators to architect around security bottlenecks. This reduces the need to overprovision and fosters deeper inspection levels than otherwise might be possible.

The design employs Intel multi-core CPUs for Layer 7 threat inspections (app visibility, intrusion detection, URL filtering, malware and file inspection, user identity, etc.) and a combination of merchant and a Network Processing Unit (NPU) for layer 2-4 traffic (stateful firewall, NAT, VPN-SSL encryption/decryption, and more.).

Traffic first traverses the NPU, and may be blocked based on access controls, obviating the need to inspect further. Flows requiring advanced inspection are copied and sent to the x86 complex – and flow handling is optimized regarding required inspection services, utilizing security group tags as one method to make this determination. In addition, a ‘fast path’ option allows intelligent re-routing of trusted traffic dynamically.

If it isn’t obvious by now, Cisco Firepower NGFW isn’t just another firewall. Across the entire family – and now the new 2100 Series – Cisco Firepower NGFW combines our effective security architecture with the power of the network for superior business resilience and protection.

Watch the video below, visit the Cisco Firepower 2100 Series NGFW product page, and take a virtual tour to learn more about the various form factors, speeds and feeds, and more.

I am about to take you on a tour of the last few generations of Cisco firewall and their architecture to give insight in why the Firepower 2100 is not at all like the Firepower 4100 and not like a ASA5516-X either.

First, I would like to make a note of the lack of presenting the architecture of the ASA5505 and ASA5585-X even though they are still being used today. This is because they differ too much from the architectural evolution of Cisco firewalls and will not help with understanding why Cisco is choosing this specific path for the Firepower 2100 series.

I will start from the top down, with the best performing firewalls continuing to the least performing firewalls and why Cisco is replacing these.

High end architecture - Firepower 9300

A couple of years ago Cisco released a new architectural platform going away from the well-known ASA platform. We were first introduced to Firepower 9300 and subsequently to the Firepower 4100, primarily focused at data center deployments. These models are born with supervisors to make them modular, like several other high-end Cisco platforms. I hope that it will be possible to upgrade the supervisor to enable the use of two single-width 2x 100Gbit network modules (NM) in the 9300, or even to enable the use of future security modules requiring more than two 40Gbit links to the internal switch fabric. I am hoping for these theoretical wishes to come true.

Looking at the block diagram of the 9300 above you see that the supervisor has its own CPU and RAM for controlling the operating system (FX-OS), which is used to deploy Firepower Threat Defense or ASA software to a security module and manage the network interfaces.

Downscaling great architecture - Firepower 4100

Firepower 4100 came to be due to the exorbitant cost of the 9300 series. The one thing not supported on the 4100 platform is the 100Gbit interfaces. There are 8x 10Gbit interfaces soldered in the chassis and it is possible to buy additional 1, 10 or 40Gbit interfaces in a network module. Fail-to-wire network modules is also a possibility on this platform.

As seen on the image above, the 4100 series only have one security module compared to the possible three security modules in the 9300, but the architecture is the same as in its older brother.

Legacy firewalling - ASA5512-X to ASA5555-X

This ASA platform is probably the most used today. The reason for this is the performance and modularity. It does support three different IPS engines and the possibility to add more 1Gbit interfaces on the higher end devices.

This block diagram above depicts the architecture of the ASA5512-X through ASA5555-X. The ASA5512-X and ASA5515-X have already been replaced with the newer ASA5508-X and ASA5516-X platform, and now the Firepower 2100 is supposed to relieve the ASA5525-X, ASA5545-X and ASA5555-X platforms of their duties.

Legacy upgrades - ASA5508-X and ASA5516-X

The replacing of the ASA5512-X and ASA5515-X was long overdue, but Cisco hit a soft spot with the customers with the ASA5508-X and ASA5516-X. The price-performance ratio was great for small customers and branches with the option to install Firepower Threat Defense for increased security.

You should make a note of the placement of the NPU and compare it to the ASA5512-X to ASA5555-X platform. The NPU on this platform is doing most crypto tasks for IPSec and SSL VPN, just like the crypto engine used to do without the limitation of a system bus connecting the external NICs.

Finding the sweet spot – Firepower 2100

With Firepower 2100 being the youngest brother in the Firepower appliance series, Cisco took a step back towards the ASA X-series architecture. In this we have no supervisor in charge of the switching fabric or the networking interfaces. Everything is owned by the security module itself and this gives us an advantage in the direction of single box deployment management. On-box management is possible on the new Firepower 2100 series appliances but it is not possible on the 4100 nor the 9300 series. Under the hood of the operating system on the 2100 there is a small subset of the FXOS features needed to handle the interface configuration. The main difference (secret sauce) between the 5516-X architecture and the Firepower 2100 is that the NPU is not just used for crypto operations anymore. The new line also uses this NPU for layer 2 – 4 firewall operations and “fast path” traffic offloading. This is a great architectural step forward, but it is of course not as streamlined as the 4100 or 9300 series, where the Smart NIC is doing the traffic offloading and yet another NPU is handling the crypto operations. Personally, I like that every chip is made for specific problems, in opposite to one chip doing all kinds of tasks it was not optimized for.

As of Firepower Threat Defense 6.2 Active/Standby failover is possible on both the 2100, 4100 and 9300. Active/Active will be possible when the multi-context feature will be included in the FTD image. Clustering is unfortunately only supported on the 4100 and the 9300 appliances. Five 9300 chassis can be clustered with three security modules each, while sixteen 4100 appliances can be clustered.

The Firepower 2110 and 2120 appliances come with 12 x 1Gbit RJ-45 ports and 4 x 1Gbit SFP ports with no options to expand this. This is a great rip and replace option for the current owners of the ASA5525-X, ASA5545-X and ASA5555-X firewalls. If you need to upgrade the edge firewall to 10Gbit you will need to buy either the 2130 or 2140 appliances. The Firepower 2130 and 2140 also come with the same 12 x 1Gbit RJ-45 ports as the lower end Firepower 2100 models. Along with this there is 4 x 10Gbit SFP+ ports and the option to put a network module (NM) card to add an additional 8 x 10Gbit SFP+ ports. Fail-to-wire network modules will be available. I do not expect 40Gbit interfaces to be available for this platform.

The Firepower 2100 is a great next generation firewall. As I see it the popularity of this will depend on two things;

1. The price. If it is too expensive customers will find another firewall manufacturer and buy a cheaper model with the same specifications.

Cisco Firepower 2100 Series Hardware Installation Guide

2. The feature set. If the features of the ASA software is not implemented in FTD in haste the customer is forced to keep buying ASA X series or, again, go to another manufacturer.