The Cisco Firepower 2100 Series provides 4 platforms. Model Firewall NGFW NGIPS Interfaces Optional interfaces FPR-2110 3G 2.3G 2.3G 12 x RJ45, 4 x SFP N/A FPR-2120 6G 3G 3G 12 x RJ45, 4 x SFP N/A FPR-2130 10G 5G 5G 12 x RJ45, 4 x SFP+ 10G SFP+, 1/10G FTW. Cisco Firepower 2100 Series Pdf User Manuals. View online or download Cisco Firepower 2100 Series Getting Started Manual, Hardware Installation Manual. Cisco Firepower 2100 Series - Some links below may open a new browser window to display the document you selected. DigitalTech.ae is one of the top APC Switches distributors in Dubai, UAE. We are APC Switches reseller of at a competitive price in Dubai, UAE. Call us +971 52 705 4498.
I am about to take you on a tour of the last few generations of Cisco firewall and their architecture to give insight in why the Firepower 2100 is not at all like the Firepower 4100 and not like a ASA5516-X either.
First, I would like to make a note of the lack of presenting the architecture of the ASA5505 and ASA5585-X even though they are still being used today. This is because they differ too much from the architectural evolution of Cisco firewalls and will not help with understanding why Cisco is choosing this specific path for the Firepower 2100 series.
I will start from the top down, with the best performing firewalls continuing to the least performing firewalls and why Cisco is replacing these.
High end architecture - Firepower 9300
A couple of years ago Cisco released a new architectural platform going away from the well-known ASA platform. We were first introduced to Firepower 9300 and subsequently to the Firepower 4100, primarily focused at data center deployments. These models are born with supervisors to make them modular, like several other high-end Cisco platforms. I hope that it will be possible to upgrade the supervisor to enable the use of two single-width 2x 100Gbit network modules (NM) in the 9300, or even to enable the use of future security modules requiring more than two 40Gbit links to the internal switch fabric. I am hoping for these theoretical wishes to come true.
Looking at the block diagram of the 9300 above you see that the supervisor has its own CPU and RAM for controlling the operating system (FX-OS), which is used to deploy Firepower Threat Defense or ASA software to a security module and manage the network interfaces.
Downscaling great architecture - Firepower 4100
Cisco Firepower 2100 Series User Manual Pdf
Firepower 4100 came to be due to the exorbitant cost of the 9300 series. The one thing not supported on the 4100 platform is the 100Gbit interfaces. There are 8x 10Gbit interfaces soldered in the chassis and it is possible to buy additional 1, 10 or 40Gbit interfaces in a network module. Fail-to-wire network modules is also a possibility on this platform.
As seen on the image above, the 4100 series only have one security module compared to the possible three security modules in the 9300, but the architecture is the same as in its older brother.
Legacy firewalling - ASA5512-X to ASA5555-X
This ASA platform is probably the most used today. The reason for this is the performance and modularity. It does support three different IPS engines and the possibility to add more 1Gbit interfaces on the higher end devices.
This block diagram above depicts the architecture of the ASA5512-X through ASA5555-X. The ASA5512-X and ASA5515-X have already been replaced with the newer ASA5508-X and ASA5516-X platform, and now the Firepower 2100 is supposed to relieve the ASA5525-X, ASA5545-X and ASA5555-X platforms of their duties.
Legacy upgrades - ASA5508-X and ASA5516-X
The replacing of the ASA5512-X and ASA5515-X was long overdue, but Cisco hit a soft spot with the customers with the ASA5508-X and ASA5516-X. The price-performance ratio was great for small customers and branches with the option to install Firepower Threat Defense for increased security.
You should make a note of the placement of the NPU and compare it to the ASA5512-X to ASA5555-X platform. The NPU on this platform is doing most crypto tasks for IPSec and SSL VPN, just like the crypto engine used to do without the limitation of a system bus connecting the external NICs.
Finding the sweet spot – Firepower 2100
With Firepower 2100 being the youngest brother in the Firepower appliance series, Cisco took a step back towards the ASA X-series architecture. In this we have no supervisor in charge of the switching fabric or the networking interfaces. Everything is owned by the security module itself and this gives us an advantage in the direction of single box deployment management. On-box management is possible on the new Firepower 2100 series appliances but it is not possible on the 4100 nor the 9300 series. Under the hood of the operating system on the 2100 there is a small subset of the FXOS features needed to handle the interface configuration. The main difference (secret sauce) between the 5516-X architecture and the Firepower 2100 is that the NPU is not just used for crypto operations anymore. The new line also uses this NPU for layer 2 – 4 firewall operations and “fast path” traffic offloading. This is a great architectural step forward, but it is of course not as streamlined as the 4100 or 9300 series, where the Smart NIC is doing the traffic offloading and yet another NPU is handling the crypto operations. Personally, I like that every chip is made for specific problems, in opposite to one chip doing all kinds of tasks it was not optimized for.
As of Firepower Threat Defense 6.2 Active/Standby failover is possible on both the 2100, 4100 and 9300. Active/Active will be possible when the multi-context feature will be included in the FTD image. Clustering is unfortunately only supported on the 4100 and the 9300 appliances. Five 9300 chassis can be clustered with three security modules each, while sixteen 4100 appliances can be clustered.
The Firepower 2110 and 2120 appliances come with 12 x 1Gbit RJ-45 ports and 4 x 1Gbit SFP ports with no options to expand this. This is a great rip and replace option for the current owners of the ASA5525-X, ASA5545-X and ASA5555-X firewalls. If you need to upgrade the edge firewall to 10Gbit you will need to buy either the 2130 or 2140 appliances. The Firepower 2130 and 2140 also come with the same 12 x 1Gbit RJ-45 ports as the lower end Firepower 2100 models. Along with this there is 4 x 10Gbit SFP+ ports and the option to put a network module (NM) card to add an additional 8 x 10Gbit SFP+ ports. Fail-to-wire network modules will be available. I do not expect 40Gbit interfaces to be available for this platform.
The Firepower 2100 is a great next generation firewall. As I see it the popularity of this will depend on two things;
1. The price. If it is too expensive customers will find another firewall manufacturer and buy a cheaper model with the same specifications.
2. The feature set. If the features of the ASA software is not implemented in FTD in haste the customer is forced to keep buying ASA X series or, again, go to another manufacturer.
Learn more about the Firepower 2100 appliances at Cisco.com.
If you liked this post, please click 'Like' so that others can find it.
About:Dennis Perto is an enthusiastic security consultant who places great honour in genuinely humble consulting. He believes in serving the client with expert knowledge, and in not being afraid to admit when he is not the right expert anymore. He enjoys configuring Cisco Firepower for every special need.
Feel free to connect with me here on LinkedIn, and follow me on Twitter: @PertoDK
The latest Cisco Next-Generation Firewall, the Firepower 2100 Series, has been introduced on February 22, 2017.
The 2100 series is designed for businesses that perform high volumes of sensitive transactions, such as banking and retail, and supports their need to maintain uptime and protect critical business functions and data.
The series aims to end the industry tug of war between performance and protection–with incorporation of a new scalable architecture and improvements of up to 200 percent greater throughput to eliminate bottlenecks – from the Internet edge to the data center.
The new Cisco Firepower 2100 Series provides businesses with the confidence to pursue new digitization opportunities, knowing they have a security architecture designed to protect against the greatest threats, without affecting the performance of critical business functions.
As the industry’s first architecture with dual multicore CPU complexes that accelerate key cryptographic, firewall, and threat defense functions, the 2100s are purpose-built to meet customers’ ongoing protection and performance needs without compromise.
The Cisco Firepower 2100 Series delivers up to 200 percent greater throughput than similarly priced offerings, even when threat inspection is turned on.
“The Cisco Next-Generation Firewalls have been proven to be the most effective on the market, but we also know that businesses everywhere are struggling with a number of factors, including lack of talent and expanding attack surfaces, which can impact the effectiveness of even the best solutions. The New Cisco Firepower 2100 Series addresses these challenges, making it easier for enterprises to manage their architecture and ensure that they have the best performance at all times.”
– David Ulevitch, Vice President and General Manager, Security Business Group, Cisco
The Cisco Firepower 2100 Series appliances can be deployed either as a Next-Generation Firewall (NGFW) or as a Next-Generation IPS (NGIPS). They are perfect for the Internet edge and all the way in to the data center. Four new models are available. Their maximum stateful firewall throughput, ranges from 1.9-8 Gbps.
The 2100 Series addresses mid-market use cases from the Internet edge to the data center. The 2100 Series NGFWs deliver superior threat defense, at faster speeds, with a smaller footprint than their predecessors the ASA-5525-X. ASA 5545-X, ASA 5555-X, ASA 5585-X S10 and FirePOWER 70XX and 71XX appliances.
- The Firepower 2110 and 2120 models offer 1.9 and 3 Gbps of firewall throughput, respectively. They provide increased port density and can provide up to sixteen (16) 1 Gbps ports in a 1 rack unit (RU) form factor.
- The Firepower 2130 and 2140 models provide 5 and 8.5 Gbps of firewall throughput, respectively. These models differ from the others in that they can be customized through the use of network modules, or NetMods. They can provide up to twenty-four (24) 1 Gbps ports in a 1 RU appliance, or to provide up to twelve (12) 10 Gbps ports.
- Firepower 2100 NGFWs uniquely provide sustained performance when supporting threat functions, such as IPS. This is done using an innovative dual multi-core architecture. Layer 2 and 3 functionality is processed on one NPU (Network Processing Unit). Threat inspection and other services are processed on a separate multi-core x86 CPU. By splitting the workload, we eliminate the performance degradation that you see with competing solutions when turning on threat inspection.
A ‘No Compromises’ Security Architecture
Key to the performance sustaining abilities of the Firepower 2100 Series is a dual, multi-core CPU architecture and software optimization that enables:
- Sustained throughput performance when threat functions are enabled vs. competing designs
- Flexibility and future-proofing versus ASIC-based designs that inhibit the ability to add new defenses and functions
- Fast path accelerates flows not requiring threat inspection, further enhancing performance through the appliance
By applying purpose-built processing for the tasks at hand, the Firepower 2100 Series NGFWs optimize performance and threat protection, without burdening network operators to architect around security bottlenecks. This reduces the need to overprovision and fosters deeper inspection levels than otherwise might be possible.
The design employs Intel multi-core CPUs for Layer 7 threat inspections (app visibility, intrusion detection, URL filtering, malware and file inspection, user identity, etc.) and a combination of merchant and a Network Processing Unit (NPU) for layer 2-4 traffic (stateful firewall, NAT, VPN-SSL encryption/decryption, and more.).
Traffic first traverses the NPU, and may be blocked based on access controls, obviating the need to inspect further. Flows requiring advanced inspection are copied and sent to the x86 complex – and flow handling is optimized regarding required inspection services, utilizing security group tags as one method to make this determination. In addition, a ‘fast path’ option allows intelligent re-routing of trusted traffic dynamically.
If it isn’t obvious by now, Cisco Firepower NGFW isn’t just another firewall. Across the entire family – and now the new 2100 Series – Cisco Firepower NGFW combines our effective security architecture with the power of the network for superior business resilience and protection.
Compare Firepower 2100 Models
Firepower 2110 vs. Firepower 2120
Firepower 2130 vs. Firepower 2140
Get the Best Prices on Cisco Firepower 2100 Series
Watch the video below to learn more about the various form factors, speeds and feeds, and more.
Cisco Firepower 2100 Series User Manual Free
More Related Topics