The Cisco Secure Firewall 4200 is a standalone modular security services platform that includes the Secure Firewall 4215, 4225, and 4245.

The Secure Firewall 4200 supports Cisco Secure Firewall Threat Defense and Cisco ASA software. See the Cisco Secure Firewall Threat Defense Compatibility Guide and the Cisco Secure Firewall ASA Compatibility guide, which provide Cisco software and hardware compatibility, including operating system and hosting environment requirements, for each supported version.

The following figure shows the Secure Firewall 4200.

The following table lists the features for the Secure Firewall 4200.

Here are some examples of how you can deploy the Secure Firewall 4200:

• As a firewall:

  • At the enterprise internet edge in a redundant configuration

  • At branch offices in either a high availability pair or standalone

  • At data centers in a high availability pair or clustered, which serves the needs of smaller enterprises

• As a device that provides additional application control, URL filtering, or IPS/threat-centered capabilities:

  • Behind an enterprise internet edge firewall in an inline configuration or as a standalone (requires hardware fail-open network module support)

  • Deployed passively off a SPAN port on a switch or a tap on a network, or standalone

• As a branch native SD-WAN solution that offers remote deployment and can be managed over a 4G LTE

• As a VPN device:

  • For remote access VPN

  • For site-to-site VPN

The following figure shows the front panel of the Secure Firewall 4200. See Front Panel LEDs for a description of the LEDs.

Management Port

The Secure Firewall 4200 chassis management port is a 1/10/25-Gb SFP port that supports fiber as well as DAC or GLC-TE.

RJ-45 Console Port

The Secure Firewall 4200 does not ship with an RJ-45 serial cable unless you order it with the chassis. You can obtain a cable, for example, a USB-to-RJ-45 serial cable. You can use the CLI to configure your 4200 through the RJ-45 serial console port by using a terminal server or a terminal emulation program on a computer.

The RJ-45 (8P8C) port supports RS-232 signaling to an internal UART controller. The console port does not have any hardware flow control, and does not support a remote dial-in modem. The default console port settings are displayed as follows:

• 9,600 bits per second

• 8 data bits

• No parity

• 1 stop bit

• No flow control

Type A USB 3.0 Port

You can use the external Type A USB port to attach a data-storage device. The external USB drive identifier is usb:. The Type A USB port supports the following:

• Hot swapping

• USB drive formatted with FAT32

• Boot kickstart image from ROMMON for discovery recovery purposes

• Copy files to and from workspace:/ and volatile:/ within local-mgmt. The most relevant files are:

  • Core files

  • Ethanalyzer packet captures

  • Tech-support files

  • Security module log files

• Platform bundle image upload using download image usbA:

The Type A USB port does not support Cisco Secure Package (CSP) image upload support.

Network Ports

The Secure Firewall 4200 chassis has two network module slots that support the following network modules:

• 4-port 40-Gb QSFP/QSFP+ (FPR-X-NM-4X40G)

• 4-port 40/100/200-Gb QSFP28/QSFP (FPR-X-NM-4X200G)

• 2-port 100-Gb QSFP56/QSFP28/QSFP (FPR-X-NM-2X100G)

• 8-port 1/10-Gb SFP (FPR-X-NM-8X10G)

• 8-port 1/10/25-Gb ZSFP (FPR-X-NM-8X25G)

• 6-port 10-Gb SFP SR multimode hardware bypass (FPR-X-NM-6X10SR-F)

• 6-port 10-Gb SFP LR single mode hardware bypass (FPR-X-NM-6X10LR-F)

• 6-port 25-Gb SFP SR multimode hardware bypass (FPR-X-NM-6X25SR-F)

• 6-port 25-Gb SFP LR single mode hardware bypass (FPR-X-NM-6X25LR-F)

• 8-port 1-Gb 1000Base-T hardware bypass (FPR-X-NM-8X1G-F)

Factory Reset Button

The Secure Firewall 4200 chassis has a recessed reset button that resets the system to the factory default. Pressing the button down for five seconds deletes the current configuration and current files.

Note	Use the reset button if the current credentials are lost and you want to initialize the box without having console access.

The following occurs:

• ROMMON NVRAM is cleared and returned to default.

• All extra images are removed; the current running image remains.

• FXOS logs, core files, SSH keys, certificates, FXOS configuration, and Apache configuration are removed.

Note	If power is lost between when you pushed the reset button and when the reset process is complete, the process stops and you have to push the button again after the system powers back on.

The following figure shows the Secure Firewall 4200 front panel LEDs.

The following figure shows the rear panel of the Secure Firewall 4200.

Power Switch

The power switch is located to the left of PSU-1 on the rear of the chassis. It is a toggle switch that controls power to the system. Turning the switch to OFF starts the graceful shutdown process. During the shutdown process the power LEDs flash green indicating that the process has started.  Once the shutdown is complete, the system is powered off. Wait for the system power LEDs to turn off before unplugging the AC power cables. See Front Panel LEDs for the power status LED description.

Note	Threat defense requires a graceful shutdown. See the Cisco Secure 4200 Getting Started Guide for the procedure.

Caution

If you remove the system power cords before the graceful shutdown is complete, disk corruption can occur. You can move the power switch to OFF before the shutdown. The system ignores it.

Note	After removing power from the chassis by unplugging the power cord, wait at least 10 seconds before turning power back ON. You want to keep the system power off, including the standby power, for 10 seconds.

The Secure Firewall 4200 chassis has two network module slots named NM-2 and NM-3 (left to right on the front panel). Network modules are optional, removable I/O modules that provide either additional ports or different interface types. The network module plugs into the chassis on the front panel. See Front Panel for the location of the network module slots on the chassis.

FPR4K-XNM-8X1GF is an 8-port 1000Base-T hardware bypass network module. The eight ports are numbered from top to bottom, left to right. Ports 1 and 2, 3 and 4, 5 and 6, and 7 and 8 are paired for hardware bypass mode. In hardware bypass mode, data is not processed by the Secure Firewall 4200 but is routed to the paired port.

Hardware bypass (also known as fail-to-wire) is a physical layer (Layer 1) bypass that allows paired interfaces to go into bypass mode so that the hardware forwards packets between these port pairs without software intervention. Hardware bypass provides network connectivity when there are software or hardware failures. Hardware bypass is useful on ports where the secure firewall is only monitoring or logging traffic. The hardware bypass network modules have a switch that is capable of connecting the two ports when needed.

Note	Hardware bypass is only supported with threat defense, although you can use these modules in nonbypass mode in threat defense or ASA.

Hardware bypass is supported only on a fixed set of ports. You can pair Port 1 with Port 2, Port 3 with Port 4, but you cannot pair Port 1 with Port 4 for example.

Note

When the appliance switches from normal operation to hardware bypass or from hardware bypass back to normal operation, traffic may be interrupted for several seconds. A number of factors can affect the length of the interruption; for example, behavior of the link partner such as how it handles link faults and debounce timing; spanning tree protocol convergence; dynamic routing protocol convergence; and so on. During this time, you may experience dropped connections.

Note	If you have an inline interface set with a mix of hardware bypass and nonhardware bypass interfaces, you cannot enable hardware bypass on this inline interface set. You can only enable hardware bypass on an inline interface set if all the pairs in the inline set are valid hardware bypass pairs.

Note

The hardware and the system support hot swapping if you are replacing a network module with the same type of network module. If you replace the 8-port 10/100/1000Base-T network module with another supported network module, you must reboot the chassis so that the new network module is recognized. See the configuration guide for your operating system for the detailed procedures for managing network modules.

Note

Make sure you have the correct firmware package and software version installed to support this network module. See the configuration guide for your software for the procedures for updating the firmware package and verifying the software version. See the Cisco Secure Firewall Threat Defense Compatibility Guide and the Cisco Secure Firewall ASA Compatibility guide, which provide Cisco software and hardware compatibility, including operating system and hosting environment requirements, for each supported version.

For More Information

• See 6-Port 10-Gb SR/10-Gb LR/25-Gb SR/25-Gb LR Network Module with Hardware Bypass for a description of the 1/10/25-Gb network module.

• See 4-Port 40-Gb Network Module for a description of the 40-Gb network module.

• See 8-Port 1/10/25-Gb Network Module for a description of the 1/10/25-Gb network module.

• See Install, Remove, and Replace the Network Module for the procedure for removing and replacing network modules.

The Secure Firewall 4200 chassis has two network module slots named NM-2 and NM-3 (left to right on the front panel). Network modules are optional, removable I/O modules that provide either additional ports or different interface types. The network module plugs into the chassis on the front panel. See Front Panel for the location of the network module slots on the chassis.

The FPR-X-NM-6X10SRF, FPR-X-NM-6X10LRF, FPR-X-NM-6X25SRF, and FPR-X-NM-6X25LRF hardware bypass network modules have six ports that are numbered from top to bottom, left to right. Pair ports 1 and 2, 3 and 4, and 5 and 6 to form hardware bypass paired sets. In hardware bypass mode, data is not processed by the Secure Firewall 4200 but is routed to the paired port. This network module has built-in SPF transceivers. Hot swapping and field replacement of transceivers are not supported.

Hardware bypass (also known as fail-to-wire) is a physical layer (Layer 1) bypass that allows paired interfaces to go into bypass mode so that the hardware forwards packets between these port pairs without software intervention. Hardware bypass provides network connectivity when there are software or hardware failures. Hardware bypass is useful on ports where the secure firewall is only monitoring or logging traffic. The hardware bypass network modules have a switch that is capable of connecting the two ports when needed. This hardware bypass network module has built-in SFPs.

Note	Hardware bypass is only supported with threat defense, although you can use these modules in nonbypass mode in threat defense or ASA.

Hardware bypass is supported only on a fixed set of ports. You can pair Port 1 with Port 2, Port 3 with Port 4, but you cannot pair Port 1 with Port 4 for example.

Note

When the appliance switches from normal operation to hardware bypass or from hardware bypass back to normal operation, traffic may be interrupted for several seconds. A number of factors can affect the length of the interruption; for example, behavior of the link partner such as how it handles link faults and debounce timing; spanning tree protocol convergence; dynamic routing protocol convergence; and so on. During this time, you may experience dropped connections.

Note	If you have an inline interface set with a mix of hardware bypass and nonhardware bypass interfaces, you cannot enable hardware bypass on this inline interface set. You can only enable hardware bypass on an inline interface set if all the pairs in the inline set are valid hardware bypass pairs.

Note

The hardware and the system support hot swapping if you are replacing a network module with the same type of network module. If you replace the 6-port 1/10/25-Gb network module with another supported network module, you must reboot the chassis so that the new network module is recognized. See the configuration guide for your operating system for the detailed procedures for managing network modules.

Note

Make sure you have the correct firmware package and software version installed to support this network module. See the configuration guide for your software for the procedure to verify your firmware package and software version. See the Cisco Secure Firewall Threat Defense Compatibility Guide and the Cisco Secure Firewall ASA Compatibility guide, which provide Cisco software and hardware compatibility, including operating system and hosting environment requirements, for each supported version

For More Information

• See 8-Port 1000Base-T Network Module with Hardware Bypass for a description of the 1-Gb network module.

• See 8-Port 1/10/25-Gb Network Module for a description of the 1/10/25-Gb network module.

• See 4-Port 40-Gb Network Module for a description of the 40-Gb network module.

• See Install, Remove, and Replace the Network Module for the procedure for removing and replacing network modules.

AC Power Supply

The dual power supplies can supply up to 1900-W power across the input voltage range. The load is shared when both power supply modules are plugged in and running at the same time.

Note	The system does not consume more than the capacity of one power supply module, so it always operates in full redundancy mode when two power supply modules are installed.

Power Supply Module LED

The following figure shows the bicolor power supply LED on the AC power supply module.

The Secure Firewall 4200 has two SSD slots that each hold one NVMe 1.8-TB SSD. By default the Secure Firewall 4200 ships with two 1.8-TB SSDs installed in slot 1 and slot 2. Software RAID1 is shipped already configured.

Hot swapping is supported. You can swap SSDs without powering off the chassis. However, before hot swapping SSDs you must issue the raid remove-secure local-disk 1|2 command to prepare the SSD for removal. This command preserves the data on the SSD. After you remove and replace the SSD, you must add it again to the RAID1 configuration using the raid add local-disk 1|2 command. See Hot Swap an SSD on the Secure Firewall 3100/4200 for the procedures for safely removing an SSD.

Caution

The raid remove-secure local disk command securely erases the specified SSD data.

Caution

You cannot swap SSDs between different platforms. For example, you cannot use a 3100 series SSD in a 4200 series model.

The SSD drive identifiers are disk0: and disk1:.

The following table contains hardware specifications for the Secure Firewall 4200.

The following table lists the product IDs (PIDs) associated with the Secure Firewall 4200. All of the PIDs in the table are field-replaceable. If you need to get a return material authorization (RMA) for any component, see Cisco Returns Portal for more information.

Note	See the show inventory command in the Cisco Secure Firewall Threat Defense Command Reference or the Cisco ASA Series Command Reference to display a list of the PIDs for your Secure Firewall 4200.

Each power supply has a separate power cord. Standard power cords or jumper power cords are available for connection to the secure firewall. The jumper power cords for use in racks are available as an optional alternative to the standard power cords.

If you do not order the optional power cord with the system, you are responsible for selecting the appropriate power cord for the product. Using a incompatible power cord with this product may result in electrical safety hazard. Orders delivered to Argentina, Brazil, and Japan must have the appropriate power cord ordered with the system.

Note	Only the approved power cords or jumper power cords provided with the Secure 4200 are supported.

The following power cords are supported.