Explore Cisco
How to Buy

Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

Cisco Network Security Ordering Guide

Available Languages

Download Options

  • PDF
    (3.7 MB)
    View with Adobe Reader on a variety of devices
Updated:May 18, 2021

Available Languages

Download Options

  • PDF
    (3.7 MB)
    View with Adobe Reader on a variety of devices
Updated:May 18, 2021
 

 

Introduction

Purpose

This document describes the ordering guidance for all Cisco® network security solutions, including Cisco Advanced Malware Protection (AMP) for Networks solution, Cisco Firepower® Next-Generation Firewalls (NGFW), Cisco Adaptive Security Appliance (ASA) 5500-X appliances with either Cisco Firepower Threat Defense or ASA software, or ASA with FirePOWER Services NGFW software images. With NGFW procurements, note that customers’ investments are protected regardless of what type of NGFW they choose, for two reasons:

     Threat defense innovations in Cisco Firepower Threat Defense software also come to the FirePOWER Services module of ASA with FirePOWER Services.

     Customers can elect at a future date after the time of purchase, at no additional cost, to reimage supported firewall appliances from ASA to Cisco Firepower Threat Defense software.

This guide will help you make sure that the right quantities and types of parts are selected to reduce the risk of order rejection.

Audience

This guide is intended for Cisco sales, partners, and distributors.

Scope

This document covers orderability for the following products and licenses:

Cisco Firepower NGFW

     Cisco Firepower NGFW appliances with Cisco Firepower Threat Defense software and subscriptions

     Cisco Firepower Threat Defense software and subscriptions on existing ASA 5500-X appliances

     Cisco Firepower Threat Defense software and subscriptions on new ASA 5500-X appliances

     Cisco Next-Generation Firewall Virtual (NGFWv) appliance and subscriptions

Cisco ASA firewalls

     Cisco ASA with FirePOWER Services appliances and subscriptions

     Cisco ASA Firewall physical and virtual (ASAv) appliance and subscriptions

     Cisco ASA software and subscriptions on Cisco Firepower NGFW appliances

Firewall management solutions

     Cisco Firepower Management Center (known as Cisco FireSIGHT Management Center prior to version 6.0.1) physical and virtual appliance and subscriptions

     Cisco Security Manager software

Optional hardware

     Cisco ASA 5500-X Series 6-port Gigabit Ethernet interface cards

Optional Software

     Radware Virtual DefensePro DDoS Mitigation

     Cisco AnyConnect® Secure Mobility Client

Support

     Cisco Smart Net Total Care appliance support services

     Cisco Software Application Support plus Upgrades (SASU)

Note:      Any order for a service will be subject to the detailed terms and conditions presented in this guide.

Selecting the Appropriate Management Solution

Several management solutions are available to manage Cisco firewalls. The following guidelines can help select the most appropriate one, but you can consult a Cisco expert to help select the best manager for your customer or use cases.

Choosing the right management solution is tied to a few factors:

     The software image you select, either Firepower Threat Defense (FTD) or ASA software image

     Willingness to use a cloud based solution for management

     Need for specific features or environment scale

Local managers are included with both software options for single NGFW deployments:

     ASDM is included with the ASA software image

     Firepower Device Manager (FDM) is included with the Firepower Threat Defense software Image for all supported appliance models (Firepower 1000 Series, Firepower 2100 Series, Firepower 4100 Series and Firepower 9300)

The Cisco Firepower Threat Defense software image enables centralized management with either an on-premise manager - Cisco Firepower Management Center – or a cloud based one – Cisco Defense Orchestrator.

Devices running the ASA software can be managed centrally with the Cisco Security Manager (local) or Cisco Defense Orchestrator (Cloud).

If a customer wants to manage a mix of ASAs and FTDs from a single pane of glass, Cisco Defense Orchestrator is the best way forward.

If a customer wants to manage multiple ASA with FirePOWER Services devices centrally, then two managers are required: Firepower Management Center (formerly FireSIGHT Management Center) for threat functions and Cisco Security Manager for firewall functions.

The following table can help guide you in which manager to select with your firewall order.

Manager selection matrix

Manager selection matrix

Licensing

Smart Licensing is Cisco’s new licensing system. It enables customers to easily move licenses themselves between similar systems in their organization, overcoming limitations associated with previous device-locked Product Authorization Key (PAK)-based licenses. Become familiar with the new Smart Software Licensing portion of the ordering process.

End customers must create a Smart Licensing account on Cisco’s Smart Software Manager portal before initiating an order for the Cisco Firepower Threat Defense software on select ASA appliances. Alternatively, Cisco or a partner can begin the process of creating the Smart Licensing account on behalf of the end customer. The Smart Software Manager portal is available for customers to manage the efficient use of purchased smart licenses. When the order is placed, all ordered licenses are added to the customer’s Smart Licensing account.

Table 1.             Product licensing by product type

Cisco Firepower Threat Defense (FTD) software on Firepower NGFW appliances

Cisco Smart Licensing only

Cisco Firepower Threat Defense (FTD) software on ASA 5500-X Series appliances

Cisco Smart Licensing only

Cisco ASA with FirePOWER Services software on ASA 5500-X Series appliances

Cisco PAK Licensing only

Cisco ASA software on Cisco ASA 5500-X Series appliances

Cisco PAK Licensing only

Cisco ASA Virtual (ASAv) appliances

Cisco Smart Licensing

Cisco Firepower NGFW Virtual (NGFWv) appliances

Cisco Smart Licensing

Cisco Radware vDefensePro on Cisco Firepower 9300 and select Firepower 4100 Series appliances

Supplied by Radware

Cisco Firepower Management Center

None required

Cisco Firepower Management Center Virtual Appliance (FMCv)

Either Cisco PAK and Smart Licensing

Cisco Security Manager

Cisco PAK Licensing

With the Cisco Smart License Manager, the customer can connect devices to the Smart Software Manager portal, so purchased licenses can be consumed as needed. These licenses can be relinquished back to the portal when a device is powered down or a user is finished using the license. With Smart Software Licensing, customers can easily check in and check out licenses to use on different platforms. Licenses are no longer locked to a specific platform.

A Smart Account can be created from Cisco Software Central. For more information on setting up a Smart Account, please refer to this Quick Reference Guide.

Additional Smart Licensing resources are available here:

Location

Description

https://cisco.com/go/smartaccounts

Cisco Smart Accounts Overview

https://cisco.com/go/smartlicensing

Cisco Smart Software Licensing Overview

Software Operation Exchange Page

Live Training Schedule

Orderable Smart Licensing SKU List

Additional Software training and informational resources

Cisco Radware vDefensePro Licensing

Licensing of the vDP and Vision will be administered directly by Radware. Once the order is shipped, Radware will send an email to the customer with their serial numbers. Please note the address of the person on the customer order who will receive the email. These serial numbers will be needed along with the MAC address for either vDP and/or Vision after installation. If the email with the serial numbers cannot be found, please open a TAC case to get them reissued. For detailed licensing instructions, please refer to the Radware Customer Onboarding and License Generation Instructions.

High Availability Pair Licensing

Cisco requires two (2) subscriptions for a High Availability (HA) pair of appliances running Firepower Threat Defense software image, which is configured for active-passive operation. The hardware models available with this optional configuration include:

     Cisco ASA 5500-X Series

     Cisco Firepower 1000 Series

     Cisco Firepower 2100 Series

     Cisco Firepower 4100 Series

     Cisco Firepower 9300 Series

We now offer specially configured bundle SKUs that enable the purchase of a high availability pair of appliances and software subscriptions that includes 50% discounted pricing for the second software subscription in the two-appliance bundle.

The bundle consists of:

     Two (2) identically configured hardware appliances

     Two (2) identical software subscriptions

A 50% discount will be automatically applied to the second software subscription in the bundle. See the specific model section in this document for the appropriate bundle PID.

Renewing HA Bundle Software Subscriptions

The 50% pricing discount also applies to HA bundles at time of renewal.

Cisco AnyConnect Secure Mobility Client Licensing

Cisco AnyConnect (Plus, Apex, and VPN Only) licenses are required to use the Remote Access VPN (RA VPN) functions on all Network Security NGFWs (physical and virtual) running the Firepower Threat Defense code base version 6.2.1 and later. This adds capability to the Firepower Threat Defense code base previously only available on appliances running the ASA code base.

For purchasing information on AnyConnect licenses or instructions on sharing an AnyConnect license with your Smart Account, please see the AnyConnect Ordering Guide.

Instructions can also be found in the AnyConnect License FAQ.

Service and Support Offerings

Software Application Support Plus Upgrades (SASU)

Cisco Firepower Threat Defense software, ASA with FirePOWER Services, ASA firewall, and Cisco Firepower Management Center security licenses include software subscription support. SASU is essential to keeping your business-critical applications available, highly secure, and operating at optimal performance. For the term of your software subscription licenses, you will receive timely, uninterrupted access to the latest software updates and major upgrade releases, which may contain significant architectural changes and new features and functions. With software subscription support, you will have the latest software working to protect your business. You will also have access to a wide range of online tools and communities that can help you solve problems quickly, maintain business continuity, improve your competitiveness, and make the most of limited resources through increased productivity.

This support entitles customers to the services listed here for the full term of the purchased software subscription:

     Software updates and major upgrades, to keep applications performing optimally with the most current feature set

     Access to the Cisco Technical Assistance Center (TAC), which provides fast, specialized support

     Online tool building, to expand in-house expertise and boost business agility

     Collaborative learning, to provide additional knowledge and training opportunities

No additional products or fees are required to receive these services with a software subscription.

Cisco SASU includes:

     Registered access to Cisco.com

     24-hour access to the Cisco TAC and Cisco software specialists

     Maintenance and minor software release updates

     Major software upgrade releases

Please refer to the following link for more detailed information regarding Cisco SASU:
https://www.cisco.com/en/US/services/ps2827/ps2993/services_at_a_glance_sas_sasu.pdf.

Cisco Smart Net Total Care Service

Customers require a Cisco Smart Net Total Care support contract with each appliance to download application signature updates. The Smart Net Total Care Service gives customers access to an abundance of Cisco support tools and expertise, providing them with greater network availability and performance while reducing operating costs. Technical service is required to be attached at the point of the product sale so that customers get the necessary support and entitlement and the best possible return on investment. When ordering Threat Defense software on select ASA hardware, ASA with FirePOWER Services, the Management Center, or Cisco SSL hardware in Cisco Commerce, the appropriate Smart Net Total Care service items are automatically added to your quote.

Additionally, a license can be added to upgrade existing Cisco ASA 5500-X Series and Cisco ASA 5585-X appliances to support Cisco ASA with FirePOWER Services or Threat Defense software capabilities.

The Cisco Smart Net Total Care Service provides:

     Global 24-hour access to the Cisco TAC

     Access to the online knowledge base, communities, and tools

     Current hardware replacement option: next business day, where available

     Operating system software updates

     Smart, proactive diagnostics and real-time alerts on devices enabled with Cisco Smart Call Home

Please refer to the following link for more detailed information regarding Cisco Smart Net Total Care Service: https://www.cisco.com/en/US/products/svcs/ps3034/ps2827/ps2978/serv_group_home.html.

Cisco Advanced Services

The Cisco Global Security Solutions team provides comprehensive assessment, design, deployment, and migration assistance through the Cisco Advanced Services Transaction (AS-T) model, which involves the use of a Statement of Work (SOW). These Cisco AS-T offers are custom scoped and priced, and partners need to engage a Cisco Services account manager to purchase them.

Cisco Security Plan and Build Services help customers develop and deploy a comprehensive security strategy they can rely on to deliver the industry's most comprehensive advanced threat protection solution. This service incorporates a best-practice review, deployment, and mini-tune-up to help ensure that the system is alerting properly.

Cisco Security Migration Services help customers move from existing Cisco Sourcefire or competitive environments. Cisco performs an analysis of the current environment, develops a migration plan, tests the plan in a lab, and performs the migration in the production environment.

To order the customized Cisco Security Plan and Build Services and Migration Services, use the Cisco AS-T part numbers in the table below.

Table 2.             Cisco AS-T ordering information

Part numbers

Description

Price (US$)

AS-SEC-CNSLT (-A, -L)

Cisco Security Plan and Build Services

Custom priced

AS-SEC-CNSLT (-A, -L)

Cisco Security Migration Services

Custom priced

Cisco Technical Services

Cisco Technical Services for Cisco products can be quoted and ordered in Cisco tools, including the Cisco Service Contract Center (SCC) and Cisco Commerce (CCW). Tool use varies depending on the service offer and partner type and whether the service is attached at the time of product purchase.

Partner Supported Services (PSS)

Customers who choose to purchase Partner Supported Services (PSS) from an authorized Cisco partner are also entitled to download application signature updates. For more details, visit https://www.cisco.com/go/partnerservices and the Partner Support Service Global Ordering Guide for Cisco 1-Tier Partners.

SKUs and Ordering Guidance for Cisco Firepower NGFW (Firepower 1000, 2100, 4100 and 9300 Series)

Introduction

Scope: This section describes the pricing and ordering for the following products:

     Cisco Firepower 1000 Series

     Cisco Firepower 2100 Series

     Cisco Firepower 4100 Series

     Cisco Firepower 9300 Series

About the Cisco Firepower 1000, 2100, 4100, and 9300 Series

The Cisco Firepower 1000, 2100, 4100, and 9300 Series, when deployed as Next-Generation Firewall (NGFW) appliances, use the Cisco Firepower Threat Defense software image. The Cisco Firepower Management Center (FMC) provides unified management of the Cisco Firepower NGFW, as well as dedicated Cisco Firepower Next-Generation Intrusion Prevention (NGIPS) and Cisco Advanced Malware Protection (AMP) solutions. The on-device Firepower Device Manager is also available with select Firepower NGFW models. Firepower Device Manager on-device manager is included for deployments of Firepower 1000, 2100 and 5500-X devices running the FTD image. Alternatively, the Cisco Adaptive Security Appliance (ASA) software image is also supported on the Cisco Firepower 9300, Cisco 4100 Series, Cisco 2100 Series and Cisco 1000 Series. When running the ASA software image, the ADSM on-device manager is available. Also available today on Cisco Firepower 9300 appliances with the ASA image, and direct from Cisco, is the Radware Virtual DefensePro Distributed Denial of Service (DDoS) mitigation capability.

Cisco Firepower 1000 Series Appliances

The Cisco Firepower 1000 Series comprises of three threat-focused NGFW security appliances. The 1000 Series addresses SMB, Branch/Distributed Enterprise and Internet Edge deployments. The 1000 Series NGFWs deliver superior threat defense, at fast spends, with a smaller footprint than their predecessors, the ASA-5506-X, ASA-5508-X and ASA-5516-X. The 1000 Series is now available in ASA and FTD software images.

Chassis Overview: Cisco Firepower 1010

Front view

Integrated 8x10/100/1000 RJ45 ports

Integrated 4x1G SFP ports

Console (Cisco RJ45 serial or mini-USB)

1x USB 2.0 Host and 1x USB console

1 RJ45 10/100/1000Base-T Management Port

  Management Console and Ethernet
  Singular AC PSU

Cisco Firepower 1010_Front view

Rear view

1. 1 power supply module bay

Rear view

Chassis Overview: Cisco Firepower 1120 and 1140

Front view

1. Fixed ports

  Integrated 8x10/100/1000 RJ45 ports
  Integrated 4x1G SFP ports
  Console (Cisco RJ45 serial or mini-USB)
  1x USB 2.0 Host and 1x USB console
  1 RJ45 10/100/1000Base-T Management Port
  Management Console and Ethernet

2. Modular options (FRU)

Cisco Firepower 1120 and 1140_Front view -

Rear view

1. 1 power supply module bay

Cisco Firepower 1120 and 1140_Rear view

Chassis Overview: Cisco Firepower 1150

Front view

1. Fixed ports

  Integrated 8x10/100/1000 RJ45 ports
  Integrated 2x1G SFP ports and 2x10G SPF+ ports
  Console (Cisco RJ45 serial or mini-USB)
  1x USB 2.0 Host and 1x USB console
  1 RJ45 10/100/1000Base-T Management Port
  Management Console and Ethernet

2. Modular options (FRU)

Cisco Firepower 1150_Front view

Rear view

1. 1 power supply module bay

Rear view

Cisco Firepower 2100 Series Appliances

The Cisco Firepower 2100 Series comprises four threat-focused NGFW security appliances. The 2100 Series addresses mid-market use cases from the Internet edge to the data center. The 2100 Series NGFWs deliver superior threat defense, at faster speeds, with a smaller footprint than their predecessors, the ASA-5500 series and FirePOWER 70XX and 71XX appliances.

Chassis Overview: Cisco Firepower 2110 and 2120

Front view

1. Fixed ports

  4 x SFP and 12 x RJ45 ports, USB2.0
  12 x 1G copper and 4 x SFP 1G
  Secondary bay for AMP storage
  Management Console and Ethernet
  Singular AC PSU

Cisco Firepower 2110 and 2120_Front view

Rear view

1. 1 power supply module bay

Cisco Firepower 2110 and 2120_Rear view

Chassis Overview: Cisco Firepower 2130 and 2140

Front view

1. Fixed ports

  4 x SFP+ and 12 x RJ45 ports, USB2.0
  12 x 1G Copper and integrated 4 x SFP+ 10G
  Secondary bay for AMP storage
  Netmod bay with optional expansion for fiber, copper modules
  Management Console and Ethernet

2. Modular options (FRU)

  Optional dual PSU 2130, standard dual PSU 2140
  Optional DC

Cisco Firepower 2130 and 2140_Front view

Rear view

1. 2 power supply module bays

Cisco Firepower 2130 and 2140_Rear view

Cisco Firepower 4100 Series Appliances

The Cisco Firepower 4100 Series comprises four threat-focused NGFW security appliances. The 4100 Series addresses use cases from the Internet edge to the data center. The 4100 Series NGFWs deliver superior threat defense, at faster speeds, with a smaller footprint. Also, the Cisco Firepower 4100 Series enables an evolutionary path, on the customer’s timeline, to the Cisco Firepower NGFW, even if the customer chooses the ASA image in the immediate term.

Chassis Overview: Cisco Firepower 4100 Series

Front view

1. 8 SFP+ ports (require SFP optics module selection)

  2 Network Module bays
  Optional Network Modules with optional optics modules

2. SSD bays (one occupied by default, second bay for future expansion)

Cisco Firepower 4100 Series_Front view

Rear view

1. 2 power supply module bays

  4110, 4115 and 4120: single AC default, dual AC or DC optional
  4125, 4140, 4145 and 4150: dual AC default, DC optional

2. 6 hot-swappable fans (default configuration, no options)

Cisco Firepower 4100 Series_Rear view

Cisco Firepower 9300 Series Appliances

The Cisco Firepower 9300 is a modular, scalable, carrier-grade appliance, available in Network Equipment Building Standards (NEBS) configurations, designed for service providers, data centers, campuses, supercomputing centers, high-frequency trading environments, and other environments requiring both low latency and the greatest throughput. In the service provider context, it is specifically designed for carriers, content providers, and cloud service providers to protect the Cisco Evolved Programmable Network, Cisco Evolved Services platform, and Cisco Application Centric Infrastructure architectures. (For more information, please see Cisco service provider security solutions.)

Tightly integrating threat-centric security services from Cisco and its partners, the 9300 appliance lowers integration costs and supports the full realization of highly secure, open, and programmable networks. In addition to providing class-leading security services, it offers low (less than 5-microsecond) latency, throughput for single flows exceeding 30 Gbps, and class-leading performance and port density on a per-rack-unit basis.

Chassis Overview: Cisco Firepower 9300

Supervisor module (included): provides overall chassis management and network interaction

  Network interface allocation and security module connectivity (960-Gbps internal fabric)

2 x Network Module bays

  10, 40, and 100 Gigabit Ethernet network connectivity options

Cisco Firepower 9300_Supervisor module

Security Modules: modular computing capability expands as your needs grow. Pictured are the three bays for Security Modules. A minimum of one must be ordered for standard operation.

With three SM-56 Security Modules, Cisco Firepower 9300 features up to 235 Gbps of stateful (ASA) firewalling performance, and 1.2 Tbps of clustered performance with 5 clustered Cisco Firepower 9300 chassis.

Also available: NEBS-compliant modules.

Also pictured at right is the rear views of the Cisco Firepower 9300. Note that it is available with dual AC, DC, or HVDC power supplies. Also, the fan assemblies and power supplies are user replaceable.

Reminder: The Cisco Firepower 9300 is available with 10, 40, and 100 GE Network Modules.

 

Cisco Firepower 9300

 

Cisco Firepower 9300_Security Modules_B

Special Guidelines for Quoting the Cisco Firepower 9300

Cisco Firepower 9300 ordering is highly customizable, and options are offered “à la carte” (that is, separately). You’ll nevertheless find the ordering process quite straightforward.

The following table shows the four core components of a Cisco Firepower 9300 order.

Table 3.             Components of a Cisco Firepower 9300 order

Common hardware

Optional modules

Software licenses

Services and subscriptions

Base Cisco Firepower 9300 Security Appliances include:

  Chassis (1)
  Supervisor (1)
  Fans (4)
  Power supplies (2 – AC, DC or HVDC)

Choice of Security Modules—up to three bays per chassis:

  SM-24, 36, 44, 40, 48, 56

Choice of network modules — two bays per chassis:

  1/10/40/100Gbps options

Smart Licenses

ASA:

  ASA Standard
  Carrier
  Strong Encryption
  Security Contexts

Cisco Firepower Threat Defense:

  Threat Base (includes Application Visibility and Control – AVC)
  Threat license and subscription terms (see next column)

Third-party software:

  Radware Virtual DefensePro (available with ASA, and with Firepower Threat Defense in a future release)

Smart Net Total Care Service

Cisco Firepower Threat Defense Subscriptions

(1-, 3-, or 5-year terms)

  Threat (includes Security Intelligence, NGIPS)
  Network AMP
  URL

Common hardware is bundled. However, your customer may wish to order extra fans and power supplies with the initial order, as these are hot-swappable, user-replaceable items. Please note that every order will require at least one, and up to three, Security Modules. Network Modules are also ordered separately.

Regarding software licenses, keep in mind that the Cisco Firepower 9300 runs either the ASA software image or the Cisco Firepower Threat Defense image. As well, the Cisco Firepower Threat Defense–based software licenses for customers that already have a Cisco Firepower 9300 are distinct, as detailed below. Also, please note that the Encryption license is export controlled. It is available for most markets, to customers in countries where U.S. export control permits the export of strong cryptography. For more information, visit export compliance details.

In the third-party software category, Radware Virtual DefensePro (vDP) DDoS-mitigation capability, which has been tightly integrated into the Cisco Firepower 9300 and 4100 Series with ASA software, is orderable from and supported directly by Cisco.

ASA Licensing for Cisco Firepower Appliances

The 9300 appliance, 4100 Series, 2100 Series and 1000 Series are available with either the Cisco Firepower Threat Defense image or the Cisco Adaptive Security Appliance (ASA) image. Cisco Firepower appliances with ASA are available through Smart Licenses. They include a Base license and up to three optional licenses (Encryption, Security Contexts, and Carrier).

Base License (Free)

L-F9K-ASA(=) (for the Cisco Firepower 9300), L-FPR4100-ASA(=) (for the Cisco Firepower 4100 Series models), L-FPR2100-ASA(=) (for the Cisco Firepower 2100 Series models) or L-FPR1000-ASA(=) (for the Cisco Firepower 1000 Series models): Licensing on the ASA is simplified for the Cisco Firepower appliances. More than 50 ASA feature licenses are condensed into a single license. This license also includes the following security contexts by default: 10 security contexts for Firepower 9300, 10 security contexts for Firepower 4100 Series, 2 security contexts for Firepower 2100 Series and 2 security contexts for Firepower 1000 Series.

Encryption License (Free)

L-F9K-ASA-ENCR-K9(=) (for the Cisco Firepower 9300), L-FPR4K-ENC-K9(=) (for Cisco Firepower 4100 Series models), L-FPR2K-ENC-K9(=) (for the Cisco Firepower 2100 Series models) or L-FPR1K-ENC-K9(=) (for Cisco Firepower 1000 Series models): This license provides for strong encryption (K9) on the platform. The U.S. export of strong cryptography is not available to export-restricted regions. Cisco solutions and products with strong encryption may not be delivered to individuals or entities on the U.S. government's list of denied or restricted parties.

Please review the U.S. Bureau of Industry and Security's list of parties of concern at: https://www.bis.doc.gov/index.php/policy-guidance/lists-of-parties-of-concern.

Additional Security Contexts (Paid)

L-F9K-ASA-SC-10(=) (for the Cisco Firepower 9300), L-FPR4K-ASASC-10(=) (for the Cisco Firepower 4100 Series models), or L-FPR2K-ASASC-10(=) (for the Cisco Firepower 2100 Series models): This license adds 10 security contexts to an ASA instance on the 9300 appliance or 4100 appliance, respectively.

Carrier License Option (Paid)

L-F9K-ASA-CAR(=) (for the Cisco Firepower 9300) or L-FP4K-ASA-CAR= (for Cisco Firepower 4100 Series models): This license covers carrier feature enablement.

Cisco Firepower Threat Defense Licensing for Cisco Firepower Appliances

Figure 2, which is provided for general reference purposes only, highlights the typical order flow. Start with the primary bundle part numbers and the software image (ASA or Firepower Threat Defense), and then, in the case of the example, associated Cisco Firepower Threat Defense–related licenses and subscriptions for functionality like Security Intelligence and Next-Generation IPS (“T”), Advanced Malware Protection (“M”), and URL Filtering (“C”). This example concludes with ordering the associated virtualized Cisco Firepower Management Center. Note that Cisco Firepower Threat Defense ships standard with the option to activate a 3-month trial license without activation of a Smart License account.

Typical order flow

Figure 2.         

Typical order flow

Ordering Steps for Cisco Firepower 9300, FTD-Based Cisco Firepower 9300

1.     Start with one of the following FTD Bundles SKUs in CCW

     FPR9K-FTD-BUN

2.     Select Hardware Options and Quantity

a.   Chassis Type – AC, DC, or HVDC

i.   Chassis Options including Netmod, Sup, SFPs, power cables

b.   Security Module Quantity - up to 3 per chassis

3.     Select Subscriptions

a.   Type

i.   T=

ii.  URL=

iii.  AMP=

iv. TC=

v.  TM=

vi. TMC=

b.   Term

i.   1 Year

ii.  3 Years

iii.  5 Years

4.     Select Base Software License for each security module

5.     Save and exit bundle configuration and select quantity of each bundle configured. Each bundle corresponds to a single-chassis configuration. After saving the configuration, you can change quantity for more than one chassis with the same configuration

Radware Virtual DefensePro DDoS Mitigation Option

Overview

Firepower DDoS Mitigation is provided by Radware Virtual DefensePro (vDP), available and supported directly from Cisco. It is available with the Cisco Firepower 9300 and select Cisco Firepower 4100 Series models running either the ASA or FTD software image. The following table details Firepower model and software image compatibility with Radware vDP.

Table 4.             Radware vDP availability on Cisco Firepower running either ASA or FTD software image

9300 Series – All Security Modules

yes

yes

4100 Series – All Models

yes

yes

Performance

The performance figures in the tables below apply to all Cisco Firepower 9300 and 4100 Series model configurations running either the ASA or FTD software image.

Table 5.             Key DDoS performance metrics for Cisco Firepower 4100 Series

Parameter

Value

Maximum mitigation capacity/throughput

10 Gbps

Maximum legitimate concurrent sessions

209,000 Connections Per Second (CPS)

Maximum DDoS flood attack prevention rate

1,800,000 Packets Per Second (PPS)

The performance figures in the following table are for Cisco Firepower 9300 with 1 to 3 Security Modules irrespective of Security Module type.

Table 6.             Key DDoS performance metrics for Cisco Firepower 9300 with 1, 2, or 3 Security Modules

Parameter

Firepower 9300 with 1 Security Module

Firepower 9300 with 2 Security Modules

Firepower 9300 with 3 Security Modules

Maximum mitigation capacity/throughput

10 Gbps

20 Gbps

30 Gbps

Maximum legitimate concurrent sessions

209,000 Connections Per Second (CPS)

418,000 Connections Per Second (CPS)

627,000 Connections Per Second (CPS)

Maximum DDoS flood attack prevention rate

1,800,000 Packets Per Second (PPS)

3,600,000 Packets Per Second (PPS)

5,400,000 Packets Per Second (PPS)

Capacity vs. Licensing

Performance/Capacity/Throughput is dependent on the number of cores assigned to the vDP virtual instance:

     By default, Radware virtual DefensePro (vDP) installs using 6 cores (1 management, 5 software) across each of Cisco Firepower 9300’s Security Modules and 4100 Series platforms.

     At install, the number of cores assigned to vDP can be adjusted from 2 to 10 to optimize the throughput performance of Cisco Firepower appliance depending on the customer need.

     While using the default 6 cores, the performance numbers for vDP are constant across platforms. The table below represents the relative performance level expected from ASA and FTD by removing 6 cores from the total available cores on the respective platforms (i.e. 24 cores minus 6 equals 75% of the total performance still available).

Table 7.             Expected ASA or FTD image performance with 6 of the available cores assigned to vDP

Cisco Firepower Model

Total vCores

Expected ASA or FTD Performance with vDP Active

9300 – SM-56

56

89.3%

9300 – SM-48

48

87.5%

9300 – SM-44

44

93.2%

9300 – SM-40

40

85.0%

9300 – SM-36

36

91.7%

9300 – SM-24

24

87.5%

Firepower 4150

44

93.2%

Firepower 4145

44

93.2%

Firepower 4140

36

83.3%

Firepower 4125

32

90.6%

Firepower 4120

24

75.0%

Firepower 4115

24

75.0%

Firepower 4110

24

75.0%

Licensing is based on the amount of legitimate traffic, not the capacity of the VM to process information.

     Purchase vDP licenses based on the amount of the client’s peak legitimate traffic flow.

     This approach differs from other vendors who charge based on attack volume. Radware licenses are based on known legitimate traffic rather than an unknown attack volume.

Capacity vs. licensing

Figure 3.         

Capacity vs. licensing

Example 1: Client has a 10-GB WAN link with a daily peak traffic flow of 2 GB.

     Purchase a 2-GB license or higher if the traffic is expected to increase in the near future.

     vDP will be able to mitigate a DDoS attack up to the capacity of the WAN link’s 10 GB, after which a cloud scrubbing solution will have to take over at the ISP level.

     Radware can be set up to automatically notify a cloud scrubber to take over.

     Radware’s Emergency Response Team (ERT) can assist in configuring vDP for each customer as part of the standard Cisco ECMU support contract for vDP.

     Radware cloud availability on GPL is on the roadmap.

     Warning: Do not over-purchase or over-quote the client’s throughput needs. License is based on clean traffic only, not the capacity of the VM.

The vDP Software Licenses and Support SKUs

The following tables outline the product information and SKUs for ordering. Cisco is only OEMing the Virtual License for Radware Manager Vision. Customers may want additional Manager Options that are provided directly by Radware.

Table 8.             vDP spare SKUs: May be ordered separately

SKU

Description

Service ECMU SKU

L-FPR-RVDP-10G=

Radware Virtual Defense Pro 10-Gbps license for Firepower

CON-ECMU-LFPRRVG1

L-FPR-RVDP-5G=

Radware Virtual Defense Pro 5-Gbps license for Firepower

CON-ECMU-LFPR5RGV

L-FPR-RVDP-2G=

Radware Virtual Defense Pro 2-Gbps license for Firepower

CON-ECMU-LFPRRVG2

L-FPR-RVDP-1G=

Radware Virtual Defense Pro 1-Gbps license for Firepower

CON-ECMU-LFPRRVGP

L-FPR-RVDP-500M=

Radware Virtual Defense Pro 500-Mbps license for Firepower

CON-ECMU-LFPR5RVD

L-FPR-RVDP-200M=

Radware Virtual Defense Pro 200-Mbps license for Firepower

CON-ECMU-LFPR0RVD

L-RDWR-APV-VA=

Radware Manager Vision and Security Reporter (supports 10 vDP instances)

None

L-RDWR-APV-RTU6=

Radware Manager Vision Only (supports 60 vDP instances)

None

Table 9.             Regular SKUs: Orderable with the Cisco Firepower platform

SKU

Description

Service ECMU SKU

FPR-RVDP-10G

Radware Virtual Defense Pro 10-Gbps license for Firepower

CON-ECMU-LFPRRVG1

FPR-RVDP-5G

Radware Virtual Defense Pro 5-Gbps license for Firepower

CON-ECMU-LFPR5RGV

FPR-RVDP-2G

Radware Virtual Defense Pro 2-Gbps license for Firepower

CON-ECMU-LFPRRVG2

FPR-RVDP-1G

Radware Virtual Defense Pro 1-Gbps license for Firepower

CON-ECMU-LFPRRVGP

FPR-RVDP-500M

Radware Virtual Defense Pro 500-Mbps license for Firepower

CON-ECMU-LFPR5RVD

FPR-RVDP-200M

Radware Virtual Defense Pro 200-Mbps license for Firepower

CON-ECMU-LFPR0RVD

Notes:

     Radware vDP license are based on legitimate traffic. Please refer to the TDM deck for more details:

     Cisco Firepower with Radware DDoS TDM

     L-RDWR-APV-VA includes both APSolute Vision with Security Reporter – 10 vDP.

     The CON Service SKUs should automatically be added to the cart with a 12-month term.

     Cisco will provide Level 0/1 to determine if problem is Cisco Firepower or vDP. All vDP issues will be escalated to Radware.

     Radware vDP clustering is currently only supported in the Cisco Firepower 9300 intrachassis configuration. This is clustering of multiple security modules (SM-24, SM-36, SM-44) within the same Cisco Firepower 9300 chassis.

     For High Availability (HA), Active-Active and Active-Standby modes are supported.

     Radware Vision Manager is a Virtual License and needs to be installed on its own server, not the Cisco Firepower platform. The recommended hardware and software for Radware Manager Vision are:

     VMware vSphere             ESXi 4.1                          ESXi 5.1

     Processor                        2 vCPUs                          4vCPUs

     Memory                           4 GB RAM                        8 GB RAM

     Hard drive                        50 GB HD                        250 GB HD

     Networking                       3 vNICs                           3 vNICs

Radware vDP Ordering Steps

Ordering SPARE SKUs for existing equipment

Spare SKUs are provided (start with “L” and end in “=” sign) to allow you to order the vDP software license for existing equipment. These are the L-FPR-RVDP-10G=. 5G=, and 2G=, respectively.

1.     Go to Cisco Commerce: https://apps.cisco.com/Commerce/home.

2.     Create a new estimate or edit an old one.

3.     In the “Search by SKU” box, paste in one of the SPARE SKUs. Or click on the “Find Products and Solutions” link to the right of the “Search by SKU” box.

a.     Typing in “Radware” in search box will return all active Radware SPARE SKUs.

Find products and solutions

Figure 4.         

Find products and solutions

4.     Once you find the SKU you need, then click the ‘+’ sign to add it to the cart.

5.     Next click on the “Edit Service/Subscription” link and set the term of the service contract.

Edit service/subscription

Figure 5.         

Edit service/subscription

6.     A 12-month (1y) ECME contract is selected by default, but that can be increased up to 60 months (5y).

a.   Note: As of this writing, you have to visit the Edit Service/Subscription link and click done to accept the default 12-month service contract. Otherwise, the cart will produce an error.

7.     If you do not already own Radware Vision Manager, please add to your order SKU: L-RDWR-APV-VA=.

a.     This is the Radware Manager Vision and Security Reporter with support for 10 vDP instances.

Cisco Secure Firewall Small Business Edition License Pack

Overview

To meet real-world needs of small business, Cisco Secure Firewall Small Business Edition is tailor-made to simplify security. Secure Firewall Small Business Edition licenses are available in 2 flavors and can ordered at the time of hardware purchase or as standalone license. See table below for Part Numbers.

Table 10.          Small Business Edition – Included Feature Set

License Feature (Available in 3 Yr Term only)

SBE Lite

SBE Standard

Threat Protection, Malware and URL Filtering

Yes

Yes

Cisco Defense Orchestrator

Yes

Yes

Anyconnect Plus for Mobile Devices and or Desktops (50 Licenses)

Yes

Yes

SAL Logging and Troubleshooting

No

Yes

Platforms available

Table 11.          Small Business Edition – Product Series Availability

Product Series

SBE Lite

SBE Standard

Firepower 1000 Series

Yes – Only on FPR1010

Yes – Only on FPR1010

All other platforms

Not Available

Not Available

SKUs and Ordering

Table 12.          Small Business Edition – Part Numbers

Part Number

Description

FPR-SEC-TERM

Cisco Secure Firewall Term Licenses - For Distributors/Drop Ship Orders

FPR1010T-SBE

Cisco Secure Firewall FPR1010 Small Business Edition

FPR1010T-SBE-L

Cisco Secure Firewall FPR1010 Small Business Edition Lite without Logging

FPR1010T-SBE-3Y

Cisco FPR1010 Small Business Edition, 3Y Subs

FPR1010T-SBE-L-3Y

Cisco FPR1010 Small Business Edition Lite, 3Y Subs

Ordering Steps for Cisco Secure Small Business Edition

Ordering Steps for Cisco Secure Small Business Edition

1.     Start with one of the following Firepower 1010 SKU in CCW

     FPR1010-NGFW-K9

2.     Select “Edit Options”

3.     Select Subscription for Small Business Edition or Small Business Edition Lite

a.   FPR1010T-SBE

b.   FPR1010T-SBE-L

4.     Select Country

5.     Save and exit configuration

Ordering Steps for Cisco Secure Small Business Edition for Distributors

Ordering Steps for Cisco Secure Small Business Edition for Distributors

1.    Start with the following SKU in CCW

     FPR-SEC-TERM

2.    Select Subscription for Small Business Edition or Small Business Edition Lite

a.     FPR1010T-SBE

b.    FPR1010T-SBE-L

3.    Save and exit configuration

Ordering vDP with the Cisco Firepower Platform

The non-spare versions of the SKUs are available options when ordering the 9300 or 4100 Cisco Firepower platform.

1.     Go to Cisco Commerce: https://apps.cisco.com/Commerce/home.

2.     Create a new estimate or edit an old one.

3.     Add Cisco Firepower 9300 or 4100 as desired (example is of a 4120) and configure appropriately.

a.   As of January 2017, vDP now works with both ASA (minimum version 9.6.1) and Firepower Threat Defense (minimum version 6.2).

Configuration options for Cisco Firepower 4120 platform

Figure 6.         

Configuration options for Cisco Firepower 4120 platform

4.     The Radware vDP SKUs are available under “Feature Licenses.”

a.   When configuring a Firepower 9300, you will need 1 license of equal size for each blade.

Feature licenses

Figure 7.         

Feature licenses

5.     When you make your selection, you will see the Service Contract and the Right-to-Use licenses are automatically added to the cart.

6.     As with the SPARE license, you can change the length of the service contract by clicking the “Edit Service/Subscription” link. You will find the EMCU contract under the selected Radware SKU.

7.     If you do not already own Radware Vision Manager, please add to your order SKU: L-RDWR-APV-VA=.

a.   This is the Radware Manager Vision and Security Reporter with support for 10 vDP instances.

Links and Resources for Radware vDP

For Cisco internal questions, please send an email to: ask-radware-ddos@external.cisco.com.

For Radware specific questions, please see: https://www.radware.com/Partners/TechnologyPartners/Cisco-Resources/.

SKUs and Ordering for Cisco Firepower 1000 Series

The following tables outline the product part number information for the Cisco Firepower 1000 Series. Note that the customer may want extra power supplies and fans. You can add these to the order separately. Table 13A and 13B provides the chassis part numbers for chassis running the ASA software and chassis running the Firepower Threat Defense (FTD) software. Note that software subscriptions can only be added to chassis running the FTD software. The chassis SKUs are automatically included in the bundle. The bundle also offers the part numbers for network modules, and Table 14 provides part numbers for accessories.

Table13A.  1000 Series Chassis Part Numbers

Part Number

Description

Bundles

FPR1010-BUN

Cisco Firepower 1010 Master Bundle

FPR1120-BUN

Cisco Firepower 1120 Master Bundle

FPR1140-BUN

Cisco Firepower 1140 Master Bundle

FPR1010-FTD-HA-BUN

Cisco Firepower 1010 Two Unit High Availability Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

FPR1120-FTD-HA-BUN

Cisco Firepower 1120 Two Unit High Availability Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

FPR1140-FTD-HA-BUN

Cisco Firepower 1140 Two Unit High Availability Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

FPR1150-FTD-HA-BUN

Cisco Firepower 1150 Two Unit High Availability Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

Appliances

FPR1010-NGFW-K9

Cisco Firepower 1010 NGFW Appliance, Desktop (runs FTD software + optional subscriptions)

FPR1120-NGFW-K9

Cisco Firepower 1120 NGFW Appliance, 1RU (runs FTD software + optional subscriptions)

FPR1140-NGFW-K9

Cisco Firepower 1140 NGFW Appliance, 1RU (runs FTD software + optional subscriptions)

FPR1150-NGFW-K9

Cisco Firepower 1150 NGFW Appliance, 1RU (runs FTD software + optional subscriptions)

FPR1010-ASA-K9

Cisco Firepower 1010 NGFW Appliance, Desktop (run ASA SW + Optional security plus license for High Availability)

FPR1120-ASA-K9

Cisco Firepower 1120 NGFW Appliance, 1RU (runs ASA software + optional security context license)

FPR1140-ASA-K9

Cisco Firepower 1140 NGFW Appliance, 1RU (runs ASA software + optional security context license)

FPR1150-ASA-K9

Cisco Firepower 1150 NGFW Appliance, 1RU (runs ASA software + optional security context license)

Table 13B.  1000 Series ASA Licenses and SKUs

Part Number

Description

ASA Standard License

FPR1000-ASA

Cisco Firepower 1000 Standard ASA License

L-FPR1000-ASA= 

Cisco Firepower 1000 Standard ASA License

Security Context Licenses

L-FPR1K-ASASC-10=

Cisco Firepower 1000 - Add 10 Security Context Licenses

L-FPR1K-ASASC-5=

Cisco Firepower 1000 - Add 5 Security Context Licenses

Encryption Licenses

L-FPR1K-ENC-K9=

Cisco Firepower 1K Series ASA Strong Encryption (3DES/AES)

FPR1010 Security Plus License (for HA)

L-FPR1010-SEC-PL=

Cisco Firepower 1010 - Security Plus License

Table 14.       1000 Series Accessories Part Numbers

Part Number

Description

FPR1K-CBL-MGMT=

Cisco Firepower 1k Series Cable Mgmt Brackets 1120/1140/1150

FPR1K-DT-ACY-KIT=

Cisco Firepower 1K Series Accessory Kit for FPR-1010

FPR1K-DT-PWR-AC=

Cisco Firepower 1K Series 150W Power Adapter for FPR-1010

FPR1K-DT-RACK-MNT=

Cisco Firepower 1K Series Rackmount Kit for FPR-1010

FPR1K-DT-WALL-MNT=

Cisco Firepower 1K Series Wall Mount for FPR-1010

FPR1K-RM-ACY-KIT=

Cisco Firepower 1K Series Accessory Kit for FPR-1120/1140/1150

FPR1K-RM-BRKT=

Cisco Firepower 1K Series Rackmount Brackets - FPR-1120/1140/1150

FPR1K-RM-FIPS-KIT=

Cisco Firepower 1K Series FIPS Kits for FPR-1120/1140/1150

FPR1K-RM-SSD200=

Cisco Firepower 1K Series 200GB for FPR-1120/1140/1150

Note:      Use these part numbers if the customer is ordering spare fans, power supplies, or a rack mount kit.

SKUs for 1000 Series Licenses and Subscriptions

When ordering a 1000 Series NGFW with the Cisco Firepower Threat Defense image, both licenses and a subscription to optional security services are required. Subscription terms are 1, 3, and 5 years, with the greatest price discount at 5 years. In the listed part numbers, the threat services are identified as follows:

Threat Subscription Abbreviations

Description

T

Threat (Security Intelligence and Cisco Firepower Next-Generation IPS)

M or AMP

Advanced Malware Protection for Networks (AMP)

C or URL

URL Filtering

1Y

1-Year Subscription

3Y

3-Year Subscription

5Y

5-Year Subscription

Table 15.          Cisco Firepower 1000 Series License Part Numbers for Configurations with the Cisco Firepower Threat Defense Image for the Cisco Firepower NGFW

Part Number

Description

L-FPR1010T-AMP=

Cisco Firepower 1010 Threat Defense Malware Protection License

L-FPR1010T-T=

Cisco Firepower 1010 Threat Defense Threat Protection License

L-FPR1010T-TC=

Cisco Firepower 1010 Threat Defense Threat and URL License

L-FPR1010T-TM=

Cisco Firepower 1010 Threat Defense Threat and Malware License

L-FPR1010T-TMC=

Cisco Firepower 1010 Threat Defense Threat, Malware, and URL License

L-FPR1010T-URL=

Cisco Firepower 1010 Threat Defense URL Filtering License

L-FPR1120T-AMP=

Cisco Firepower 1120 Threat Defense Malware Protection License

L-FPR1120T-T=

Cisco Firepower 1120 Threat Defense Threat Protection License

L-FPR1120T-TC=

Cisco Firepower 1120 Threat Defense Threat and URL License

L-FPR1120T-TM=

Cisco Firepower 1120 Threat Defense Threat and Malware License

L-FPR1120T-TMC=

Cisco Firepower 1120 Threat Defense Threat, Malware, and URL License

L-FPR1120T-URL=

Cisco Firepower 1120 Threat Defense URL Filtering License

L-FPR1140T-AMP=

Cisco Firepower 1140 Threat Defense Malware Protection License

L-FPR1140T-T=

Cisco Firepower 1140 Threat Defense Threat Protection License

L-FPR1140T-TC=

Cisco Firepower 1140 Threat Defense Threat and URL License

L-FPR1140T-TM=

Cisco Firepower 1140 Threat Defense Threat and Malware License

L-FPR1140T-TMC=

Cisco Firepower 1140 Threat Defense Threat, Malware, and URL License

L-FPR1140T-URL=

Cisco Firepower 1140 Threat Defense URL Filtering License

L-FPR1150T-AMP=

Cisco Firepower 1150 Threat Defense Malware Protection License

L-FPR1150T-T=

Cisco Firepower 1150 Threat Defense Threat Protection License

L-FPR1150T-TC=

Cisco Firepower 1150 Threat Defense Threat and URL License

L-FPR1150T-TM=

Cisco Firepower 1150 Threat Defense Threat and Malware License

L-FPR1150T-TMC=

Cisco Firepower 1150 Threat Defense Threat, Malware, and URL License

L-FPR1150T-URL=

Cisco Firepower 1150 Threat Defense URL Filtering License

Table 16.          Cisco Firepower 1000 Series Subscription Part Numbers for Configurations with the Firepower Threat Defense Image for Cisco Firepower NGFW

Part Number

Description

L-FPR1010T-AMP-1Y

Cisco Firepower 1010 Threat Defense Malware Protection 1Y Subscription

L-FPR1010T-AMP-3Y

Cisco Firepower 1010 Threat Defense Malware Protection 3Y Subscription

L-FPR1010T-AMP-5Y

Cisco Firepower 1010 Threat Defense Malware Protection 5Y Subscription

L-FPR1010T-T-1Y

Cisco Firepower 1010 Threat Defense Threat Protection 1Y Subscription

L-FPR1010T-T-3Y

Cisco Firepower 1010 Threat Defense Threat Protection 3Y Subscription

L-FPR1010T-T-5Y

Cisco Firepower 1010 Threat Defense Threat Protection 5Y Subscription

L-FPR1010T-TC-1Y

Cisco Firepower 1010 Threat Defense Threat and URL 1Y Subscription

L-FPR1010T-TC-3Y

Cisco Firepower 1010 Threat Defense Threat and URL 3Y Subscription

L-FPR1010T-TC-5Y

Cisco Firepower 1010 Threat Defense Threat and URL 5Y Subscription

L-FPR1010T-TM-1Y

Cisco Firepower 1010 Threat Defense Threat and Malware 1Y Subscription

L-FPR1010T-TM-3Y

Cisco Firepower 1010 Threat Defense Threat and Malware 3Y Subscription

L-FPR1010T-TM-5Y

Cisco Firepower 1010 Threat Defense Threat and Malware 5Y Subscription

L-FPR1010T-TMC-1Y

Cisco Firepower 1010 Threat Defense Threat, Malware, and URL 1Y Subscription

L-FPR1010T-TMC-3Y

Cisco Firepower 1010 Threat Defense Threat, Malware, and URL 3Y Subscription

L-FPR1010T-TMC-5Y

Cisco Firepower 1010 Threat Defense Threat, Malware, and URL 5Y Subscription

L-FPR1010T-URL-1Y

Cisco Firepower 1010 Threat Defense URL Filtering 1Y Subscription

L-FPR1010T-URL-3Y

Cisco Firepower 1010 Threat Defense URL Filtering 3Y Subscription

L-FPR1010T-URL-5Y

Cisco Firepower 1010 Threat Defense URL Filtering 5Y Subscription

L-FPR1120T-AMP-1Y

Cisco Firepower 1120 Threat Defense Malware Protection 1Y Subscription

L-FPR1120T-AMP-3Y

Cisco Firepower 1120 Threat Defense Malware Protection 3Y Subscription

L-FPR1120T-AMP-5Y

Cisco Firepower 1120 Threat Defense Malware Protection 5Y Subscription

L-FPR1120T-T-1Y

Cisco Firepower 1120 Threat Defense Threat Protection 1Y Subscription

L-FPR1120T-T-3Y

Cisco Firepower 1120 Threat Defense Threat Protection 3Y Subscription

L-FPR1120T-T-5Y

Cisco Firepower 1120 Threat Defense Threat Protection 5Y Subscription

L-FPR1120T-TC-1Y

Cisco Firepower 1120 Threat Defense Threat and URL 1Y Subscription

L-FPR1120T-TC-3Y

Cisco Firepower 1120 Threat Defense Threat and URL 3Y Subscription

L-FPR1120T-TC-5Y

Cisco Firepower 1120 Threat Defense Threat and URL 5Y Subscription

L-FPR1120T-TM-1Y

Cisco Firepower 1120 Threat Defense Threat and Malware 1Y Subscription

L-FPR1120T-TM-3Y

Cisco Firepower 1120 Threat Defense Threat and Malware 3Y Subscription

L-FPR1120T-TM-5Y

Cisco Firepower 1120 Threat Defense Threat and Malware 5Y Subscription

L-FPR1120T-TMC-1Y

Cisco Firepower 1120 Threat Defense Threat, Malware, and URL 1Y Subscription

L-FPR1120T-TMC-3Y

Cisco Firepower 1120 Threat Defense Threat, Malware, and URL 3Y Subscription

L-FPR1120T-TMC-5Y

Cisco Firepower 1120 Threat Defense Threat, Malware, and URL 5Y Subscription

L-FPR1120T-URL-1Y

Cisco Firepower 1120 Threat Defense URL Filtering 1Y Subscription

L-FPR1120T-URL-3Y

Cisco Firepower 1120 Threat Defense URL Filtering 3Y Subscription

L-FPR1120T-URL-5Y

Cisco Firepower 1120 Threat Defense URL Filtering 5Y Subscription

L-FPR1140T-AMP-1Y

Cisco Firepower 1140 Threat Defense Malware Protection 1Y Subscription

L-FPR1140T-AMP-3Y

Cisco Firepower 1140 Threat Defense Malware Protection 3Y Subscription

L-FPR1140T-AMP-5Y

Cisco Firepower 1140 Threat Defense Malware Protection 5Y Subscription

L-FPR1140T-T-1Y

Cisco Firepower 1140 Threat Defense Threat Protection 1Y Subscription

L-FPR1140T-T-3Y

Cisco Firepower 1140 Threat Defense Threat Protection 3Y Subscription

L-FPR1140T-T-5Y

Cisco Firepower 1140 Threat Defense Threat Protection 5Y Subscription

L-FPR1140T-TC-1Y

Cisco Firepower 1140 Threat Defense Threat and URL 1Y Subscription

L-FPR1140T-TC-3Y

Cisco Firepower 1140 Threat Defense Threat and URL 3Y Subscription

L-FPR1140T-TC-5Y

Cisco Firepower 1140 Threat Defense Threat and URL 5Y Subscription

L-FPR1140T-TM-1Y

Cisco Firepower 1140 Threat Defense Threat and Malware 1Y Subscription

L-FPR1140T-TM-3Y

Cisco Firepower 1140 Threat Defense Threat and Malware 3Y Subscription

L-FPR1140T-TM-5Y

Cisco Firepower 1140 Threat Defense Threat and Malware 5Y Subscription

L-FPR1140T-TMC-1Y

Cisco Firepower 1140 Threat Defense Threat, Malware, and URL 1Y Subscription

L-FPR1140T-TMC-3Y

Cisco Firepower 1140 Threat Defense Threat, Malware, and URL 3Y Subscription

L-FPR1140T-TMC-5Y

Cisco Firepower 1140 Threat Defense Threat, Malware, and URL 5Y Subscription

L-FPR1140T-URL-1Y

Cisco Firepower 1140 Threat Defense URL Filtering 1Y Subscription

L-FPR1140T-URL-3Y

Cisco Firepower 1140 Threat Defense URL Filtering 3Y Subscription

L-FPR1140T-URL-5Y

Cisco Firepower 1140 Threat Defense URL Filtering 5Y Subscription

L-FPR1150T-AMP-1Y

Cisco FPR1150 Threat Defense Malware Protection 1Y Subs

L-FPR1150T-AMP-3Y

Cisco FPR1150 Threat Defense Malware Protection 3Y Subs

L-FPR1150T-AMP-5Y

Cisco FPR1150 Threat Defense Malware Protection 5Y Subs

L-FPR1150T-T-1Y

Cisco FPR1150 Threat Defense Threat Protection 1Y Subs

L-FPR1150T-T-3Y

Cisco FPR1150 Threat Defense Threat Protection 3Y Subs

L-FPR1150T-T-5Y

Cisco FPR1150 Threat Defense Threat Protection 5Y Subs

L-FPR1150T-TC-1Y

Cisco FPR1150 Threat Defense Threat and URL 1Y Subs

L-FPR1150T-TC-3Y

Cisco FPR1150 Threat Defense Threat and URL 3Y Subs

L-FPR1150T-TC-5Y

Cisco FPR1150 Threat Defense Threat and URL 5Y Subs

L-FPR1150T-TM-1Y

Cisco FPR1150 Threat Defense Threat and Malware 1Y Subs

L-FPR1150T-TM-3Y

Cisco FPR1150 Threat Defense Threat and Malware 3Y Subs

L-FPR1150T-TM-5Y

Cisco FPR1150 Threat Defense Threat and Malware 5Y Subs

L-FPR1150T-TMC-1Y

Cisco FPR1150 Threat Defense Threat, Malware and URL 1Y Subs

L-FPR1150T-TMC-3Y

Cisco FPR1150 Threat Defense Threat, Malware and URL 3Y Subs

L-FPR1150T-TMC-5Y

Cisco FPR1150 Threat Defense Threat, Malware and URL 5Y Subs

L-FPR1150T-URL-1Y

Cisco FPR1150 Threat Defense URL Filtering 1Y Subs

L-FPR1150T-URL-3Y

Cisco FPR1150 Threat Defense URL Filtering 3Y Subs

L-FPR1150T-URL-5Y

Cisco FPR1150 Threat Defense URL Filtering 5Y Subs

SKUs and Ordering for Cisco Firepower 2100 Series

The following tables outline the product part number information for the Cisco Firepower 2100 Series. Note that the customer may want extra power supplies and fans. You can add these to the order separately. Note that software subscriptions can only be added to chassis running the FTD software. The chassis SKUs are automatically included in the bundle. The bundle also offers the part numbers for network modules.

Table 17.          2100 Series chassis part numbers

Part Number

Description

PID

Description

Bundles

FPR2110-BUN

Cisco Firepower 2110 Master Bundle

FPR2120-BUN

Cisco Firepower 2120 Master Bundle

FPR2130-BUN

Cisco Firepower 2130 Master Bundle

FPR2140-BUN

Cisco Firepower 2140 Master Bundle

FPR2110-FTD-HA-BUN

Cisco Firepower 2110 Two Unit High Availability Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

FPR2120-FTD-HA-BUN

Cisco Firepower 2120 Two Unit High Availability Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

FPR2130-FTD-HA-BUN

Cisco Firepower 2130 Two Unit High Availability Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

FPR2140-FTD-HA-BUN

Cisco Firepower 2140 Two Unit High Availability Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

Appliances

FPR2110-NGFW-K9

Cisco Firepower 2110 NGFW Appliance, 1RU (runs FTD software + optional subscriptions)

FPR2120-NGFW-K9

Cisco Firepower 2120 NGFW Appliance, 1RU (runs FTD software + optional subscriptions)

FPR2130-NGFW-K9

Cisco Firepower 2130 NGFW Appliance, 1RU, 1 x Network Module Bays (runs FTD software + optional subscriptions)

FPR2140-NGFW-K9

Cisco Firepower 2140 NGFW Appliance, 1RU, 1 x Network Module Bays (runs FTD software + optional subscriptions)

FPR2110-ASA-K9

Cisco Firepower 2110 ASA Appliance, 1RU (runs ASA software with optional security context license)

FPR2120-ASA-K9

Cisco Firepower 2120 ASA Appliance, 1RU (runs ASA software with optional security context license)

FPR2130-ASA-K9

Cisco Firepower 2130 ASA Appliance, 1RU, 1 x Network Module Bays (runs ASA software with optional security context license)

FPR2140-ASA-K9

Cisco Firepower 2140 ASA Appliance, 1RU, 1 x Network Module Bays (runs ASA software with optional security context license)

Netmods

FPR2K-NM-8X10G

Cisco Firepower 8 port SFP+ Network Module

FPR2K-NM-8X10G=

Cisco Firepower 8 port SFP+ Network Module

FPR2K-NM-8X1G

Cisco Firepower 8-port SFP Network Module

FPR2K-NM-8X1G=

Cisco Firepower 8-port SFP FTW Network Module (Spare)

FPR2K-NM-8X1G-F

Cisco Firepower 8-port 1G Copper FTW Network Module

FPR2K-NM-8X1G-F=

Cisco Firepower 8-port 1G Copper FTW Network Module (Spare)

FPR2K-NM-6X10LR-F=

Cisco Firepower 6 port 10G LR FTW Network Module

FPR2K-NM-6X10LR-F

Cisco Firepower 6 port 10G LR FTW Network Module

FPR2K-NM-6X10SR-F=

Cisco Firepower 6 port 10G SR FTW Network Module

FPR2K-NM-6X10SR-F

Cisco Firepower 6 port 10G SR FTW Network Module 

FPR2K-NM-6X1SX-F=

Cisco Firepower 6 port 1G SX Fiber FTW Network Module

FPR2K-NM-6X1SX-F

Cisco Firepower 6 port 1G SX Fiber FTW Network Module 

Table 18.          2100 Series ASA software license SKUs

Part Number

Description

Multicontext License

L-FPR2K-ASASC-10=

Cisco Firepower 2100 Add-on 10 security context licenses

L-FPR2K-ASASC-5=

Cisco Firepower 2100 add-on 5 security context licenses

Encryption License

L-FPR2K-ENC-K9=

License to enable strong encryption for ASA on Cisco Firepower 2100 Series

Table 19.          2100 Series accessories part numbers

Part Number

Description

FPR2K-PWR-AC-400=

Firepower 2000 Series 400W AC Power Supply

FPR2K-PWR-DC-350=

Firepower 2000 Series 350W DC Power Supply

FPR2K-FAN=

Firepower 2000 Series Fan Tray

FPR2K-PSU-BLANK=

Firepower 2000 Series Chassis Power Supply Blank Slot Cover

FPR2K-NM-BLANK=

Firepower 2000 Series Network Module Blank Slot Cover

FPR2K-SSD100=

Firepower 2000 Series SSD for FPR-2110/2120

FPR2K-SSD200=

Firepower 2000 Series SSD for FPR-2130/2140

FPR2K-BBLKD=

Firepower 2000 Series SSD Carrier

FPR2K-RM-BRKT=

Firepower 2000 Rackmount Brackets

FPR2K-RAIL-BRKT=

Firepower 2000 Slide Rail Brackets

FPR2K-CBL-MGMT=

Firepower 2000 Cable Management Brackets

FPR-2100-FIPS-KIT=

Firepower 2000 FIPS Kit

FPR2K-SLIDE-RAILS=

Firepower 2000 Slide Rail Kit

Note:      Use these part numbers if the customer is ordering spare fans, power supplies, or a rack mount kit.

SKUs for 2100 Series Licenses and Subscriptions

When ordering a 2100 Series NGFW with the Cisco Firepower Threat Defense image, both licenses and a subscription to optional security services are required. Subscription terms are 1, 3, and 5 years, with the greatest price discount at 5 years. In the listed part numbers, the threat services are identified as follows:

Threat Subscription Abbreviations

Description

T

Threat (Security Intelligence and Cisco Firepower Next-Generation IPS)

M or AMP

Advanced Malware Protection for Networks (AMP)

C or URL

URL Filtering

1Y

1-Year Subscription

3Y

3-Year Subscription

5Y

5-Year Subscription

Table 20.          Cisco Firepower 2100 Series license part numbers for configurations with the Cisco Firepower Threat Defense image for the Cisco Firepower NGFW

Part Number

Description

L-FPR2110T-AMP=

Cisco Firepower 2110 Threat Defense Malware Protection License

L-FPR2110T-T=

Cisco Firepower 2110 Threat Defense Threat Protection License

L-FPR2110T-TC=

Cisco Firepower 2110 Threat Defense Threat and URL License

L-FPR2110T-TM=

Cisco Firepower 2110 Threat Defense Threat and Malware License

L-FPR2110T-TMC=

Cisco Firepower 2110 Threat Defense Threat, Malware, and URL License

L-FPR2110T-URL=

Cisco Firepower 2110 Threat Defense URL Filtering License

L-FPR2120T-AMP=

Cisco Firepower 2120 Threat Defense Malware Protection License

L-FPR2120T-T=

Cisco Firepower 2120 Threat Defense Threat Protection License

L-FPR2120T-TC=

Cisco Firepower 2120 Threat Defense Threat and URL License

L-FPR2120T-TM=

Cisco Firepower 2120 Threat Defense Threat and Malware License

L-FPR2120T-TMC=

Cisco Firepower 2120 Threat Defense Threat, Malware, and URL License

L-FPR2120T-URL=

Cisco Firepower 2120 Threat Defense URL Filtering License

L-FPR2130T-AMP=

Cisco Firepower 2130 Threat Defense Malware Protection License

L-FPR2130T-T=

Cisco Firepower 2130 Threat Defense Threat Protection License

L-FPR2130T-TC=

Cisco Firepower 2130 Threat Defense Threat and URL License

L-FPR2130T-TM=

Cisco Firepower 2130 Threat Defense Threat and Malware License

L-FPR2130T-TMC=

Cisco Firepower 2130 Threat Defense Threat, Malware, and URL License

L-FPR2130T-URL=

Cisco Firepower 2130 Threat Defense URL Filtering License

L-FPR2140T-AMP=

Cisco Firepower 2140 Threat Defense Malware Protection License

L-FPR2140T-T=

Cisco Firepower 2140 Threat Defense Threat Protection License

L-FPR2140T-TC=

Cisco Firepower 2140 Threat Defense Threat and URL License

L-FPR2140T-TM=

Cisco Firepower 2140 Threat Defense Threat and Malware License

L-FPR2140T-TMC=

Cisco Firepower 2140 Threat Defense Threat, Malware, and URL License

L-FPR2140T-URL=

Cisco Firepower 2140 Threat Defense URL Filtering License

Table 21.          Cisco Firepower 2100 Series subscription part numbers for configurations with the Firepower Threat Defense image for Cisco Firepower NGFW

Part Number

Description

L-FPR2110T-AMP-1Y

Cisco Firepower 2110 Threat Defense Malware Protection 1Y Subscription

L-FPR2110T-AMP-3Y

Cisco Firepower 2110 Threat Defense Malware Protection 3Y Subscription

L-FPR2110T-AMP-5Y

Cisco Firepower 2110 Threat Defense Malware Protection 5Y Subscription

L-FPR2110T-T-1Y

Cisco Firepower 2110 Threat Defense Threat Protection 1Y Subscription

L-FPR2110T-T-3Y

Cisco Firepower 2110 Threat Defense Threat Protection 3Y Subscription

L-FPR2110T-T-5Y

Cisco Firepower 2110 Threat Defense Threat Protection 5Y Subscription

L-FPR2110T-TC-1Y

Cisco Firepower 2110 Threat Defense Threat and URL 1Y Subscription

L-FPR2110T-TC-3Y

Cisco Firepower 2110 Threat Defense Threat and URL 3Y Subscription

L-FPR2110T-TC-5Y

Cisco Firepower 2110 Threat Defense Threat and URL 5Y Subscription

L-FPR2110T-TM-1Y

Cisco Firepower 2110 Threat Defense Threat and Malware 1Y Subscription

L-FPR2110T-TM-3Y

Cisco Firepower 2110 Threat Defense Threat and Malware 3Y Subscription

L-FPR2110T-TM-5Y

Cisco Firepower 2110 Threat Defense Threat and Malware 5Y Subscription

L-FPR2110T-TMC-1Y

Cisco Firepower 2110 Threat Defense Threat, Malware, and URL 1Y Subscription

L-FPR2110T-TMC-3Y

Cisco Firepower 2110 Threat Defense Threat, Malware, and URL 3Y Subscription

L-FPR2110T-TMC-5Y

Cisco Firepower 2110 Threat Defense Threat, Malware, and URL 5Y Subscription

L-FPR2110T-URL-1Y

Cisco Firepower 2110 Threat Defense URL Filtering 1Y Subscription

L-FPR2110T-URL-3Y

Cisco Firepower 2110 Threat Defense URL Filtering 3Y Subscription

L-FPR2110T-URL-5Y

Cisco Firepower 2110 Threat Defense URL Filtering 5Y Subscription

L-FPR2120T-AMP-1Y

Cisco Firepower 2120 Threat Defense Malware Protection 1Y Subscription

L-FPR2120T-AMP-3Y

Cisco Firepower 2120 Threat Defense Malware Protection 3Y Subscription

L-FPR2120T-AMP-5Y

Cisco Firepower 2120 Threat Defense Malware Protection 5Y Subscription

L-FPR2120T-T-1Y

Cisco Firepower 2120 Threat Defense Threat Protection 1Y Subscription

L-FPR2120T-T-3Y

Cisco Firepower 2120 Threat Defense Threat Protection 3Y Subscription

L-FPR2120T-T-5Y

Cisco Firepower 2120 Threat Defense Threat Protection 5Y Subscription

L-FPR2120T-TC-1Y

Cisco Firepower 2120 Threat Defense Threat and URL 1Y Subscription

L-FPR2120T-TC-3Y

Cisco Firepower 2120 Threat Defense Threat and URL 3Y Subscription

L-FPR2120T-TC-5Y

Cisco Firepower 2120 Threat Defense Threat and URL 5Y Subscription

L-FPR2120T-TM-1Y

Cisco Firepower 2120 Threat Defense Threat and Malware 1Y Subscription

L-FPR2120T-TM-3Y

Cisco Firepower 2120 Threat Defense Threat and Malware 3Y Subscription

L-FPR2120T-TM-5Y

Cisco Firepower 2120 Threat Defense Threat and Malware 5Y Subscription

L-FPR2120T-TMC-1Y

Cisco Firepower 2120 Threat Defense Threat, Malware, and URL 1Y Subscription

L-FPR2120T-TMC-3Y

Cisco Firepower 2120 Threat Defense Threat, Malware, and URL 3Y Subscription

L-FPR2120T-TMC-5Y

Cisco Firepower 2120 Threat Defense Threat, Malware, and URL 5Y Subscription

L-FPR2120T-URL-1Y

Cisco Firepower 2120 Threat Defense URL Filtering 1Y Subscription

L-FPR2120T-URL-3Y

Cisco Firepower 2120 Threat Defense URL Filtering 3Y Subscription

L-FPR2120T-URL-5Y

Cisco Firepower 2120 Threat Defense URL Filtering 5Y Subscription

L-FPR2130T-AMP-1Y

Cisco Firepower 2130 Threat Defense Malware Protection 1Y Subscription

L-FPR2130T-AMP-3Y

Cisco Firepower 2130 Threat Defense Malware Protection 3Y Subscription

L-FPR2130T-AMP-5Y

Cisco Firepower 2130 Threat Defense Malware Protection 5Y Subscription

L-FPR2130T-T-1Y

Cisco Firepower 2130 Threat Defense Threat Protection 1Y Subscription

L-FPR2130T-T-3Y

Cisco Firepower 2130 Threat Defense Threat Protection 3Y Subscription

L-FPR2130T-T-5Y

Cisco Firepower 2130 Threat Defense Threat Protection 5Y Subscription

L-FPR2130T-TC-1Y

Cisco Firepower 2130 Threat Defense Threat and URL 1Y Subscription

L-FPR2130T-TC-3Y

Cisco Firepower 2130 Threat Defense Threat and URL 3Y Subscription

L-FPR2130T-TC-5Y

Cisco Firepower 2130 Threat Defense Threat and URL 5Y Subscription

L-FPR2130T-TM-1Y

Cisco Firepower 2130 Threat Defense Threat and Malware 1Y Subscription

L-FPR2130T-TM-3Y

Cisco Firepower 2130 Threat Defense Threat and Malware 3Y Subscription

L-FPR2130T-TM-5Y

Cisco Firepower 2130 Threat Defense Threat and Malware 5Y Subscription

L-FPR2130T-TMC-1Y

Cisco Firepower 2130 Threat Defense Threat, Malware, and URL 1Y Subscription

L-FPR2130T-TMC-3Y

Cisco Firepower 2130 Threat Defense Threat, Malware, and URL 3Y Subscription

L-FPR2130T-TMC-5Y

Cisco Firepower 2130 Threat Defense Threat, Malware, and URL 5Y Subscription

L-FPR2130T-URL-1Y

Cisco Firepower 2130 Threat Defense URL Filtering 1Y Subscription

L-FPR2130T-URL-3Y

Cisco Firepower 2130 Threat Defense URL Filtering 3Y Subscription

L-FPR2130T-URL-5Y

Cisco Firepower 2130 Threat Defense URL Filtering 5Y Subscription

L-FPR2140T-AMP-1Y

Cisco Firepower 2140 Threat Defense Malware Protection 1Y Subscription

L-FPR2140T-AMP-3Y

Cisco Firepower 2140 Threat Defense Malware Protection 3Y Subscription

L-FPR2140T-AMP-5Y

Cisco Firepower 2140 Threat Defense Malware Protection 5Y Subscription

L-FPR2140T-T-1Y

Cisco Firepower 2140 Threat Defense Threat Protection 1Y Subscription

L-FPR2140T-T-3Y

Cisco Firepower 2140 Threat Defense Threat Protection 3Y Subscription

L-FPR2140T-T-5Y

Cisco Firepower 2140 Threat Defense Threat Protection 5Y Subscription

L-FPR2140T-TC-1Y

Cisco Firepower 2140 Threat Defense Threat and URL 1Y Subscription

L-FPR2140T-TC-3Y

Cisco Firepower 2140 Threat Defense Threat and URL 3Y Subscription

L-FPR2140T-TC-5Y

Cisco Firepower 2140 Threat Defense Threat and URL 5Y Subscription

L-FPR2140T-TM-1Y

Cisco Firepower 2140 Threat Defense Threat and Malware 1Y Subscription

L-FPR2140T-TM-3Y

Cisco Firepower 2140 Threat Defense Threat and Malware 3Y Subscription

L-FPR2140T-TM-5Y

Cisco Firepower 2140 Threat Defense Threat and Malware 5Y Subscription

L-FPR2140T-TMC-1Y

Cisco Firepower 2140 Threat Defense Threat, Malware, and URL 1Y Subscription

L-FPR2140T-TMC-3Y

Cisco Firepower 2140 Threat Defense Threat, Malware, and URL 3Y Subscription

L-FPR2140T-TMC-5Y

Cisco Firepower 2140 Threat Defense Threat, Malware, and URL 5Y Subscription

L-FPR2140T-URL-1Y

Cisco Firepower 2140 Threat Defense URL Filtering 1Y Subscription

L-FPR2140T-URL-3Y

Cisco Firepower 2140 Threat Defense URL Filtering 3Y Subscription

L-FPR2140T-URL-5Y

Cisco Firepower 2140 Threat Defense URL Filtering 5Y Subscription

SKUs and Ordering for Cisco Firepower 4100 Series

The following tables outline the product part number information for the Cisco Firepower 4100 Series. Note that the customer may want extra power supplies and fans.

Table 22.          4100 Series chassis part numbers

Part Number

Description

PID

Description

FPR4110-BUN

Cisco Firepower 4110 Master Bundle

FPR4120-BUN

Cisco Firepower 4120 Master Bundle

FPR4140-BUN

Cisco Firepower 4140 Master Bundle

FPR4150-BUN

Cisco Firepower 4150 Master Bundle

FPR4115-BUN

Cisco Firepower 4115 Master Bundle

FPR4125-BUN

Cisco Firepower 4125 Master Bundle

FPR4145-BUN

Cisco Firepower 4145 Master Bundle

FPR4110-FTD-HA-BUN

Cisco Firepower 4110 Two Unit High Availability Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

FPR4120-FTD-HA-BUN

Cisco Firepower 4120 Two Unit High Availability Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

FPR4140-FTD-HA-BUN

Cisco Firepower 4140 Two Unit High Availability Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

FPR4150-FTD-HA-BUN

Cisco Firepower 4150 Two Unit High Availability Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

FPR4115-FTD-HA-BUN

Cisco Firepower 4115 Two Unit High Availability Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

FPR4125-FTD-HA-BUN

Cisco Firepower 4125 Two Unit High Availability Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

FPR4145-FTD-HA-BUN

Cisco Firepower 4145 Two Unit High Availability Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

FPR4110-ASA-K9

Cisco Firepower 4110 ASA Appliance, 1RU, 2 x Network Module Bays

FPR4110-NGFW-K9

Cisco Firepower 4110 NGFW Appliance, 1RU, 2 x Network Module Bays

FPR4110-NGIPS-K9

Cisco Firepower 4110 NGIPS Appliance, 1RU, 2 x Network Module Bays

FPR4110-AMP-K9

Cisco Firepower 4110 AMP Appliance, 1RU, 2 x Network Module Bays

FPR4120-ASA-K9

Cisco Firepower 4120 ASA Appliance, 1RU, 2 x Network Module Bays

FPR4115-ASA-K9

Cisco Firepower 4115 ASA Appliance, 1RU, 2 x Network Module Bays

FPR4115-NGFW-K9

Cisco Firepower 4115 NGFW Appliance, 1RU, 2 x Network Module Bays

FPR4115-NGIPS-K9

Cisco Firepower 4115 NGIPS Appliance, 1RU, 2 x Network Module Bays

FPR4120-NGFW-K9

Cisco Firepower 4120 NGFW Appliance, 1RU, 2 x Network Module Bays

FPR4120-NGIPS-K9

Cisco Firepower 4120 NGIPS Appliance, 1RU, 2 x Network Module Bays

FPR4120-AMP-K9

Cisco Firepower 4120 AMP Appliance, 1RU, 2 x Network Module Bays

FPR4125-ASA-K9

Cisco Firepower 4125 ASA Appliance, 1RU, 2 x Network Module Bays

FPR4125-NGFW-K9

Cisco Firepower 4125 NGFW Appliance, 1RU, 2 x Network Module Bays

FPR4125-NGIPS-K9

Cisco Firepower 4125 NGIPS Appliance, 1RU, 2 x Network Module Bays

FPR4140-ASA-K9

Cisco Firepower 4140 ASA Appliance, 1RU, 2 Network Module Bays

FPR4140-NGFW-K9

Cisco Firepower 4140 NGFW Appliance, 1RU, 2 x Network Module Bays

FPR4140-NGIPS-K9

Cisco Firepower 4140 NGIPS Appliance, 1RU, 2 x Network Module Bays

FPR4140-AMP-K9

Cisco Firepower 4140 AMP Appliance, 1RU, 2 x Network Module Bays

FPR4145-ASA-K9

Cisco Firepower 4145 ASA Appliance, 1RU, 2 x Network Module Bays

FPR4145-NGFW-K9

Cisco Firepower 4145 NGFW Appliance, 1RU, 2 x Network Module Bays

FPR4145-NGIPS-K9

Cisco Firepower 4145 NGIPS Appliance, 1RU, 2 x Network Module Bays

FPR4150-ASA-K9

Cisco Firepower 4150 ASA Appliance, 1RU, 2 Network Module Bays

FPR4150-NGFW-K9

Cisco Firepower 4150 NGFW Appliance, 1RU, 2 x Network Module Bays

FPR4150-NGIPS-K9

Cisco Firepower 4150 NGIPS Appliance, 1RU, 2 x Network Module Bays

FPR4150-AMP-K9

Cisco Firepower 4150 AMP Appliance, 1RU, 2 x Network Module Bays

Note:      USE THE BUNDLE PART NUMBER UNLESS YOU HAVE AN EXPLICIT REASON NOT TO. THE BUNDLE PID ENSURES THAT ALL NECESSARY COMPONENTS ARE PURCHASED.

Table 23.          4100 Series network module part numbers

Part Number

Description

FPR4K-NM-2X40G-F

Cisco Firepower 2-port 40G SR FTW Network Module

FPR4K-NM-2X40G-F=

Cisco Firepower 2-port 40G SR FTW Network Module

FPR4K-NM-4X40G

Cisco Firepower 4-port QSFP+ Network Module

FPR4K-NM-4X40G=

Cisco Firepower 4-port QSFP+ Network Module

FPR4K-NM-6X10LR-F

Cisco Firepower 6-port 10G LR FTW Network Module

FPR4K-NM-6X10LR-F=

Cisco Firepower 6-port 10G LR FTW Network Module

FPR4K-NM-6X10SR-F

Cisco Firepower 6-port 10G SR FTW Network Module

FPR4K-NM-6X10SR-F=

Cisco Firepower 6-port 10G SR FTW Network Module

FPR4K-NM-6X1SX-F

Cisco Firepower 6-port 1G SX Fiber FTW Network Module

FPR4K-NM-6X1SX-F=

Cisco Firepower 6-port 1G SX Fiber FTW Network Module

FPR4K-NM-8X10G

Cisco Firepower 8-port SFP+ Network Module

FPR4K-NM-8X10G=

Cisco Firepower 8-port SFP+ Network Module

FPR4K-NM-8X1G-F

Cisco Firepower 8-port 1Gbps copper FTW Network Module

FPR4K-NM-8X1G-F=

Cisco Firepower 8-port 1Gbps copper FTW Network Module

Table 24.          4100 Series accessories part numbers

Part Number

Description

FPR4K-FAN

Cisco Firepower 4000 Series Fan

FPR4K-FAN=

Cisco Firepower 4000 Series Fan

FPR4K-NM-BLANK

Cisco Firepower 4000 Series Network Module Blank Slot Cover

FPR4K-NM-BLANK=

Cisco Firepower 4000 Series Network Module Blank Slot Cover

FPR4K-PSU-BLANK

Cisco Firepower 4000 Series Chassis Power Supply Blank Slot Cover

FPR4K-PSU-BLANK=

Cisco Firepower 4000 Series Chassis Power Supply Blank Slot Cover

FPR4K-PWR-AC-1100

Cisco Firepower 4000 Series 1100W AC Power Supply

FPR4K-PWR-AC-1100=

Cisco Firepower 4000 Series 1100W AC Power Supply

FPR4K-PWR-DC-950

Cisco Firepower 4000 Series 950W DC Power Supply

FPR4K-PWR-DC-950=

Cisco Firepower 4000 Series 950W DC Power Supply

FPR4K-RACK-MNT

Cisco Firepower 4000 Series Rack Mount Kit

FPR4K-RACK-MNT=

Cisco Firepower 4000 Series Rack Mount Kit

FPR4K-SSD-BBLKD

Cisco Firepower 4000 Series SSD Slot Carrier

FPR4K-SSD-BBLKD=

Cisco Firepower 4000 Series SSD Slot Carrier

FPR4K-SSD200

Cisco Firepower 4000 Series SSD for 4110 and 4120

FPR4K-SSD200=

Cisco Firepower 4000 Series SSD for 4110 and 4120

FPR4K-SSD400

Cisco Firepower 4000 Series SSD for 4140 and 4150

FPR4K-SSD400=

Cisco Firepower 4000 Series SSD for 4140 and 4150

FPR4K-SSD800

Cisco Firepower 4000 Series 800GB SSD

FPR4K-SSD800=

Cisco Firepower 4000 Series 800GB SSD

FPR4K-ACC-KIT

Cisco Firepower 4000 Series Hardware Accessory Kit (Rack Mounts, Cables)

FPR4K-ACC-KIT=

Cisco Firepower 4000 Series Hardware Accessory Kit (Rack Mounts, Cables)

FPR4K-ACC-KIT2

Cisco Firepower 4115/25/45 Hardware Accessory Kit

FPR4K-ACC-KIT2=

Cisco Firepower 4115/25/45 Hardware Accessory Kit

FPR4K-CBL-MGMT

Cisco Firepower 4100 Series Cable Management Kit

FPR4K-CBL-MGMT=

Cisco Firepower 4100 Series Cable Management Kit

Note:      Use these part numbers if the customer is ordering spare fans, power supplies, or a rack mount kit.

SKUs for 4100 Series Licenses and Subscriptions

When ordering a 4100 Series firewall with the ASA configuration, a license is required. When ordering a 4100 Series NGFW with the Cisco Firepower Threat Defense image, both licenses and a subscription to optional security services are required. Subscription terms are 1, 3, and 5 years, with the greatest price discount at 5 years. In the listed part numbers, the threat services are identified as follows:

Threat Subscription Abbreviations

Description

T

Threat (Security Intelligence and Cisco Firepower Next-Generation IPS)

M or AMP

Advanced Malware Protection for Networks (AMP)

C or URL

URL Filtering

1Y

1-Year Subscription

3Y

3-Year Subscription

5Y

5-Year Subscription

Table 25.          Cisco Firepower 4100 Series license part numbers for configurations with the Cisco Firepower Threat Defense image for the Cisco Firepower NGFW

Part Number

Description

L-FPR4110T-AMP=

Cisco Firepower 4110 Threat Defense Malware Protection License

L-FPR4110T-T=

Cisco Firepower 4110 Threat Defense Threat Protection License

L-FPR4110T-TC=

Cisco Firepower 4110 Threat Defense Threat and URL License

L-FPR4110T-TM=

Cisco Firepower 4110 Threat Defense Threat and Malware License

L-FPR4110T-TMC=

Cisco Firepower 4110 Threat Defense Threat, Malware, and URL License

L-FPR4110T-URL=

Cisco Firepower 4110 Threat Defense URL Filtering License

L-FPR4115T-AMP=

Cisco Firepower 4115 Threat Defense Malware Protection License

L-FPR4115T-T=

Cisco Firepower 4115 Threat Defense Threat Protection License

L-FPR4115T-TC=

Cisco Firepower 4115 Threat Defense Threat and URL License

L-FPR4115T-TM=

Cisco Firepower 4115 Threat Defense Threat and Malware License

L-FPR4115T-TMC=

Cisco Firepower 4115 Threat Defense Threat, Malware, and URL License

L-FPR4115T-URL=

Cisco Firepower 4115 Threat Defense URL Filtering License

L-FPR4120T-AMP=

Cisco Firepower 4120 Threat Defense Malware Protection License

L-FPR4120T-T=

Cisco Firepower 4120 Threat Defense Threat Protection License

L-FPR4120T-TC=

Cisco Firepower 4120 Threat Defense Threat and URL License

L-FPR4120T-TM=

Cisco Firepower 4120 Threat Defense Threat and Malware License

L-FPR4120T-TMC=

Cisco Firepower 4120 Threat Defense Threat, Malware, and URL License

L-FPR4120T-URL=

Cisco Firepower 4120 Threat Defense URL Filtering License

L-FPR4125T-AMP=

Cisco Firepower 4125 Threat Defense Malware Protection License

L-FPR4125T-T=

Cisco Firepower 4125 Threat Defense Threat Protection License

L-FPR4125T-TC=

Cisco Firepower 4125 Threat Defense Threat and URL License

L-FPR4125T-TM=

Cisco Firepower 4125 Threat Defense Threat and Malware License

L-FPR4125T-TMC=

Cisco Firepower 4125 Threat Defense Threat, Malware, and URL License

L-FPR4125T-URL=

Cisco Firepower 4125 Threat Defense URL Filtering License

L-FPR4140T-AMP=

Cisco Firepower 4140 Threat Defense Malware Protection License

L-FPR4140T-T=

Cisco Firepower 4140 Threat Defense Threat Protection License

L-FPR4140T-TC=

Cisco Firepower 4140 Threat Defense Threat and URL License

L-FPR4140T-TM=

Cisco Firepower 4140 Threat Defense Threat and Malware License

L-FPR4140T-TMC=

Cisco Firepower 4140 Threat Defense Threat, Malware, and URL License

L-FPR4140T-URL=

Cisco Firepower 4140 Threat Defense URL Filtering License

L-FPR4145T-AMP=

Cisco Firepower 4145 Threat Defense Malware Protection License

L-FPR4145T-T=

Cisco Firepower 4145 Threat Defense Threat Protection License

L-FPR4145T-TC=

Cisco Firepower 4145 Threat Defense Threat and URL License

L-FPR4145T-TM=

Cisco Firepower 4145 Threat Defense Threat and Malware License

L-FPR4145T-TMC=

Cisco Firepower 4145 Threat Defense Threat, Malware, and URL License

L-FPR4145T-URL=

Cisco Firepower 4145 Threat Defense URL Filtering License

L-FPR4150T-AMP=

Cisco Firepower 4150 Threat Defense Malware Protection License

L-FPR4150T-T=

Cisco Firepower 4150 Threat Defense Threat Protection License

L-FPR4150T-TC=

Cisco Firepower 4150 Threat Defense Threat and URL License

L-FPR4150T-TM=

Cisco Firepower 4150 Threat Defense Threat and Malware License

L-FPR4150T-TMC=

Cisco Firepower 4150 Threat Defense Threat, Malware, and URL License

L-FPR4150T-URL=

Cisco Firepower 4150 Threat Defense URL Filtering License

Table 26.     Cisco Firepower 4100 Series subscription part numbers for configurations with the Firepower Threat Defense image for Cisco Firepower NGFW

Part Number

Description

L-FPR4110T-AMP-1Y

Cisco Firepower 4110 Threat Defense Malware Protection 1Y Subscription

L-FPR4110T-AMP-3Y

Cisco Firepower 4110 Threat Defense Malware Protection 3Y Subscription

L-FPR4110T-AMP-5Y

Cisco Firepower 4110 Threat Defense Malware Protection 5Y Subscription

L-FPR4110T-T-1Y

Cisco Firepower 4110 Threat Defense Threat Protection 1Y Subscription

L-FPR4110T-T-3Y

Cisco Firepower 4110 Threat Defense Threat Protection 3Y Subscription

L-FPR4110T-T-5Y

Cisco Firepower 4110 Threat Defense Threat Protection 5Y Subscription

L-FPR4110T-TC-1Y

Cisco Firepower 4110 Threat Defense Threat and URL 1Y Subscription

L-FPR4110T-TC-3Y

Cisco Firepower 4110 Threat Defense Threat and URL 3Y Subscription

L-FPR4110T-TC-5Y

Cisco Firepower 4110 Threat Defense Threat and URL 5Y Subscription

L-FPR4110T-TM-1Y

Cisco Firepower 4110 Threat Defense Threat and Malware 1Y Subscription

L-FPR4110T-TM-3Y

Cisco Firepower 4110 Threat Defense Threat and Malware 3Y Subscription

L-FPR4110T-TM-5Y

Cisco Firepower 4110 Threat Defense Threat and Malware 5Y Subscription

L-FPR4110T-TMC-1Y

Cisco Firepower 4110 Threat Defense Threat, Malware, and URL 1Y Subscription

L-FPR4110T-TMC-3Y

Cisco Firepower 4110 Threat Defense Threat, Malware, and URL 3Y Subscription

L-FPR4110T-TMC-5Y

Cisco Firepower 4110 Threat Defense Threat, Malware, and URL 5Y Subscription

L-FPR4110T-URL-1Y

Cisco Firepower 4110 Threat Defense URL Filtering 1Y Subscription

L-FPR4110T-URL-3Y

Cisco Firepower 4110 Threat Defense URL Filtering 3Y Subscription

L-FPR4110T-URL-5Y

Cisco Firepower 4110 Threat Defense URL Filtering 5Y Subscription

L-FPR4115T-AMP-1Y

Cisco Firepower 4115 Threat Defense Malware Protection 1Y Subscription

L-FPR4115T-AMP-3Y

Cisco Firepower 4115 Threat Defense Malware Protection 3Y Subscription

L-FPR4115T-AMP-5Y

Cisco Firepower 4115 Threat Defense Malware Protection 5Y Subscription

L-FPR4115T-T-1Y

Cisco Firepower 4115 Threat Defense Threat Protection 1Y Subscription

L-FPR4115T-T-3Y

Cisco Firepower 4115 Threat Defense Threat Protection 3Y Subscription

L-FPR4115T-T-5Y

Cisco Firepower 4115 Threat Defense Threat Protection 5Y Subscription

L-FPR4115T-TC-1Y

Cisco Firepower 4115 Threat Defense Threat and URL 1Y Subscription

L-FPR4115T-TC-3Y

Cisco Firepower 4115 Threat Defense Threat and URL 3Y Subscription

L-FPR4115T-TC-5Y

Cisco Firepower 4115 Threat Defense Threat and URL 5Y Subscription

L-FPR4115T-TM-1Y

Cisco Firepower 4115 Threat Defense Threat and Malware 1Y Subscription

L-FPR4115T-TM-3Y

Cisco Firepower 4115 Threat Defense Threat and Malware 3Y Subscription

L-FPR4115T-TM-5Y

Cisco Firepower 4115 Threat Defense Threat and Malware 5Y Subscription

L-FPR4115T-TMC-1Y

Cisco Firepower 4115 Threat Defense Threat, Malware, and URL 1Y Subscription

L-FPR4115T-TMC-3Y

Cisco Firepower 4115 Threat Defense Threat, Malware, and URL 3Y Subscription

L-FPR4115T-TMC-5Y

Cisco Firepower 4115 Threat Defense Threat, Malware, and URL 5Y Subscription

L-FPR4115T-URL-1Y

Cisco Firepower 4115 Threat Defense URL Filtering 1Y Subscription

L-FPR4115T-URL-3Y

Cisco Firepower 4115 Threat Defense URL Filtering 3Y Subscription

L-FPR4115T-URL-5Y

Cisco Firepower 4110 Threat Defense URL Filtering 5Y Subscription

L-FPR4120T-AMP-1Y

Cisco Firepower 4120 Threat Defense Malware Protection 1Y Subscription

L-FPR4120T-AMP-3Y

Cisco Firepower 4120 Threat Defense Malware Protection 3Y Subscription

L-FPR4120T-AMP-5Y

Cisco Firepower 4120 Threat Defense Malware Protection 5Y Subscription

L-FPR4120T-T-1Y

Cisco Firepower 4120 Threat Defense Threat Protection 1Y Subscription

L-FPR4120T-T-3Y

Cisco Firepower 4120 Threat Defense Threat Protection 3Y Subscription

L-FPR4120T-T-5Y

Cisco Firepower 4120 Threat Defense Threat Protection 5Y Subscription

L-FPR4120T-TC-1Y

Cisco Firepower 4120 Threat Defense Threat and URL 1Y Subscription

L-FPR4120T-TC-3Y

Cisco Firepower 4120 Threat Defense Threat and URL 3Y Subscription

L-FPR4120T-TC-5Y

Cisco Firepower 4120 Threat Defense Threat and URL 5Y Subscription

L-FPR4120T-TM-1Y

Cisco Firepower 4120 Threat Defense Threat and Malware 1Y Subscription

L-FPR4120T-TM-3Y

Cisco Firepower 4120 Threat Defense Threat and Malware 3Y Subscription

L-FPR4120T-TM-5Y

Cisco Firepower 4120 Threat Defense Threat and Malware 5Y Subscription

L-FPR4120T-TMC-1Y

Cisco Firepower 4120 Threat Defense Threat, Malware, and URL 1Y Subscription

L-FPR4120T-TMC-3Y

Cisco Firepower 4120 Threat Defense Threat, Malware, and URL 3Y Subscription

L-FPR4120T-TMC-5Y

Cisco Firepower 4120 Threat Defense Threat, Malware, and URL 5Y Subscription

L-FPR4120T-URL-1Y

Cisco Firepower 4120 Threat Defense URL Filtering 1Y Subscription

L-FPR4120T-URL-3Y

Cisco Firepower 4120 Threat Defense URL Filtering 3Y Subscription

L-FPR4120T-URL-5Y

Cisco Firepower 4120 Threat Defense URL Filtering 5Y Subscription

L-FPR4125T-AMP-1Y

Cisco Firepower 4125 Threat Defense Malware Protection 1Y Subscription

L-FPR4125T-AMP-3Y

Cisco Firepower 4125 Threat Defense Malware Protection 3Y Subscription

L-FPR4125T-AMP-5Y

Cisco Firepower 4125 Threat Defense Malware Protection 5Y Subscription

L-FPR4125T-T-1Y

Cisco Firepower 4125 Threat Defense Threat Protection 1Y Subscription

L-FPR4125T-T-3Y

Cisco Firepower 4125 Threat Defense Threat Protection 3Y Subscription

L-FPR4125T-T-5Y

Cisco Firepower 4125 Threat Defense Threat Protection 5Y Subscription

L-FPR4125T-TC-1Y

Cisco Firepower 4125 Threat Defense Threat and URL 1Y Subscription

L-FPR4125T-TC-3Y

Cisco Firepower 4125 Threat Defense Threat and URL 3Y Subscription

L-FPR4125T-TC-5Y

Cisco Firepower 4125 Threat Defense Threat and URL 5Y Subscription

L-FPR4125T-TM-1Y

Cisco Firepower 4125 Threat Defense Threat and Malware 1Y Subscription

L-FPR4125T-TM-3Y

Cisco Firepower 4125 Threat Defense Threat and Malware 3Y Subscription

L-FPR4125T-TM-5Y

Cisco Firepower 4125 Threat Defense Threat and Malware 5Y Subscription

L-FPR4125T-TMC-1Y

Cisco Firepower 4125 Threat Defense Threat, Malware, and URL 1Y Subscription

L-FPR4125T-TMC-3Y

Cisco Firepower 4125 Threat Defense Threat, Malware, and URL 3Y Subscription

L-FPR4125T-TMC-5Y

Cisco Firepower 4125 Threat Defense Threat, Malware, and URL 5Y Subscription

L-FPR4125T-URL-1Y

Cisco Firepower 4125 Threat Defense URL Filtering 1Y Subscription

L-FPR4125T-URL-3Y

Cisco Firepower 4125 Threat Defense URL Filtering 3Y Subscription

L-FPR4125T-URL-5Y

Cisco Firepower 4125 Threat Defense URL Filtering 5Y Subscription

L-FPR4140T-AMP-1Y

Cisco Firepower 4140 Threat Defense Malware Protection 1Y Subscription

L-FPR4140T-AMP-3Y

Cisco Firepower 4140 Threat Defense Malware Protection 3Y Subscription

L-FPR4140T-AMP-5Y

Cisco Firepower 4140 Threat Defense Malware Protection 5Y Subscription

L-FPR4140T-T-1Y

Cisco Firepower 4140 Threat Defense Threat Protection 1Y Subscription

L-FPR4140T-T-3Y

Cisco Firepower 4140 Threat Defense Threat Protection 3Y Subscription

L-FPR4140T-T-5Y

Cisco Firepower 4140 Threat Defense Threat Protection 5Y Subscription

L-FPR4140T-TC-1Y

Cisco Firepower 4140 Threat Defense Threat and URL 1Y Subscription

L-FPR4140T-TC-3Y

Cisco Firepower 4140 Threat Defense Threat and URL 3Y Subscription

L-FPR4140T-TC-5Y

Cisco Firepower 4140 Threat Defense Threat and URL 5Y Subscription

L-FPR4140T-TM-1Y

Cisco Firepower 4140 Threat Defense Threat and Malware 1Y Subscription

L-FPR4140T-TM-3Y

Cisco Firepower 4140 Threat Defense Threat and Malware 3Y Subscription

L-FPR4140T-TM-5Y

Cisco Firepower 4140 Threat Defense Threat and Malware 5Y Subscription

L-FPR4140T-TMC-1Y

Cisco Firepower 4140 Threat Defense Threat, Malware, and URL 1Y Subscription

L-FPR4140T-TMC-3Y

Cisco Firepower 4140 Threat Defense Threat, Malware, and URL 3Y Subscription

L-FPR4140T-TMC-5Y

Cisco Firepower 4140 Threat Defense Threat, Malware, and URL 5Y Subscription

L-FPR4140T-URL-1Y

Cisco Firepower 4140 Threat Defense URL Filtering 1Y Subscription

L-FPR4140T-URL-3Y

Cisco Firepower 4140 Threat Defense URL Filtering 3Y Subscription

L-FPR4140T-URL-5Y

Cisco Firepower 4140 Threat Defense URL Filtering 5Y Subscription

L-FPR4145T-AMP-1Y

Cisco Firepower 4145 Threat Defense Malware Protection 1Y Subscription

L-FPR4145T-AMP-3Y

Cisco Firepower 4145 Threat Defense Malware Protection 3Y Subscription

L-FPR4145T-AMP-5Y

Cisco Firepower 4145 Threat Defense Malware Protection 5Y Subscription

L-FPR4145T-T-1Y

Cisco Firepower 4145 Threat Defense Threat Protection 1Y Subscription

L-FPR4145T-T-3Y

Cisco Firepower 4145 Threat Defense Threat Protection 3Y Subscription

L-FPR4145T-T-5Y

Cisco Firepower 4145 Threat Defense Threat Protection 5Y Subscription

L-FPR4145T-TC-1Y

Cisco Firepower 4145 Threat Defense Threat and URL 1Y Subscription

L-FPR4145T-TC-3Y

Cisco Firepower 4145 Threat Defense Threat and URL 3Y Subscription

L-FPR4145T-TC-5Y

Cisco Firepower 4145 Threat Defense Threat and URL 5Y Subscription

L-FPR4145T-TM-1Y

Cisco Firepower 4145 Threat Defense Threat and Malware 1Y Subscription

L-FPR4145T-TM-3Y

Cisco Firepower 4145 Threat Defense Threat and Malware 3Y Subscription

L-FPR4145T-TM-5Y

Cisco Firepower 4145 Threat Defense Threat and Malware 5Y Subscription

L-FPR4145T-TMC-1Y

Cisco Firepower 4145 Threat Defense Threat, Malware, and URL 1Y Subscription

L-FPR4145T-TMC-3Y

Cisco Firepower 4145 Threat Defense Threat, Malware, and URL 3Y Subscription

L-FPR4145T-TMC-5Y

Cisco Firepower 4145 Threat Defense Threat, Malware, and URL 5Y Subscription

L-FPR4145T-URL-1Y

Cisco Firepower 4145 Threat Defense URL Filtering 1Y Subscription

L-FPR4145T-URL-3Y

Cisco Firepower 4145 Threat Defense URL Filtering 3Y Subscription

L-FPR4145T-URL-5Y

Cisco Firepower 4145 Threat Defense URL Filtering 5Y Subscription

L-FPR4150T-AMP-1Y

Cisco Firepower 4150 Threat Defense Malware Protection 1Y Subscription

L-FPR4150T-AMP-3Y

Cisco Firepower 4150 Threat Defense Malware Protection 3Y Subscription

L-FPR4150T-AMP-5Y

Cisco Firepower 4150 Threat Defense Malware Protection 5Y Subscription

L-FPR4150T-T-1Y

Cisco Firepower 4150 Threat Defense Threat Protection 1Y Subscription

L-FPR4150T-T-3Y

Cisco Firepower 4150 Threat Defense Threat Protection 3Y Subscription

L-FPR4150T-T-5Y

Cisco Firepower 4150 Threat Defense Threat Protection 5Y Subscription

L-FPR4150T-TC-1Y

Cisco Firepower 4150 Threat Defense Threat and URL 1Y Subscription

L-FPR4150T-TC-3Y

Cisco Firepower 4150 Threat Defense Threat and URL 3Y Subscription

L-FPR4150T-TC-5Y

Cisco Firepower 4150 Threat Defense Threat and URL 5Y Subscription

L-FPR4150T-TM-1Y

Cisco Firepower 4150 Threat Defense Threat and Malware 1Y Subscription

L-FPR4150T-TM-3Y

Cisco Firepower 4150 Threat Defense Threat and Malware 3Y Subscription

L-FPR4150T-TM-5Y

Cisco Firepower 4150 Threat Defense Threat and Malware 5Y Subscription

L-FPR4150T-TMC-1Y

Cisco Firepower 4150 Threat Defense Threat, Malware, and URL 1Y Subscription

L-FPR4150T-TMC-3Y

Cisco Firepower 4150 Threat Defense Threat, Malware, and URL 3Y Subscription

L-FPR4150T-TMC-5Y

Cisco Firepower 4150 Threat Defense Threat, Malware, and URL 5Y Subscription

L-FPR4150T-URL-1Y

Cisco Firepower 4150 Threat Defense URL Filtering 1Y Subscription

L-FPR4150T-URL-3Y

Cisco Firepower 4150 Threat Defense URL Filtering 3Y Subscription

L-FPR4150T-URL-5Y

Cisco Firepower 4150 Threat Defense URL Filtering 5Y Subscription

Example of Cisco Firepower Solution Configurations

Below tables show sample configurations for ordering the 9300 appliances. Note that these are high-level overviews and that actual orders will include additional items.

Table 27.          Fully populated chassis with three SM-36 Security Modules for maximum I/O capability

Part Number

Description

Quantify

FPR-C9300-AC

Cisco Firepower 9300 AC Chassis + 2 PSU + 4 fans

1

FPR9K-SUP

Cisco Firepower 9000 Series Supervisor

1

FPR9K-SM-36

Cisco Firepower 9000 Series 36 Physical Core, Security Module includes 2 SSDs

3

FPR9K-NM-4X40G

Cisco Firepower 9000 Series - 4-port QSFP+ Network Module

1

FPR9K-NM-8X10G

Cisco Firepower 9000 Series - 8-port SFP+ Network Module

1

CAB-AC-C6K-TWLK

Power Cord, 250VAC 16A, twist-lock NEMA L6-20 plug, U

1

L-F9K-ASA-SC-10=

License to add 10 Security Contexts to ASA in Cisco Firepower 9000

3

Table 28.          Chassis with one SM-24 Security Module

Part Number

Description

Quantify

FPR-C9300-AC

Cisco Firepower 9300 AC Chassis + 2 PSU + 4 fans

1

FPR9K-SUP

Cisco Firepower 9000 Series Supervisor

1

FPR9K-SM-24

Cisco Firepower 9000 Series Enterprise, 24 Physical Core, Security Module (NEBS Ready) includes 2 SSDs

1

CAB-AC-C6K-TWLK

Power Cord, 250VAC 16A, twist lock NEMA L6-20 plug, U

1

Ordering Examples: Cisco Commerce, Step-by-Step

Cisco Commerce provides a Deals and Quotes application that helps the Cisco sales team and specialized channel partners to build a system quote with:

     Products, required modules, and software

     Automatically generated services based on products and installation-site location

     Customized leasing options from Cisco Capital® financing, where available

For additional information about Cisco Commerce, go to: https://apps.cisco.com/Commerce/home.

You will find several helpful tools to estimate and order solutions so you can configure products and view lead times and prices for each selection. You can view lead time and price changes under a variety of price lists and service contract terms. You can also track your order.

The following product and related options are supported in the workspace:

     Cisco Firepower 9300 (FPR-C9300-AC)

     Cisco Firepower 4100 Series (FPR-41xx-xxx)

For other ordering tools, such as services ordering, please consult the Additional Resources section at the end of this document.

Ordering Example 1: Cisco Firepower 9300 with ASA

Step 1.      Smart Software Licensing

Before placing a Cisco Firepower 9300 order, a Smart Software Licensing account for the end customer must be initiated. If the customer already has a Smart Software Licensing account, that account must be associated with the order. More information on Smart Software Licensing account establishment is available in the Smart Software Licensing section of this ordering guide, and online at: https://www.cisco.com/web/ordering/smart-software-manager/index.html.

To associate the order’s licenses with the customer’s Smart Licensing account, or to begin the establishment of the Smart Licensing account, follow these steps. Note that if you are initiating the account, you are able to complete the order only if the account is initiated on the end customer’s behalf and associated with the order.

1.     Go to Cisco Commerce: https://www.cisco.com/go/ccw.

2.     From the Orders pull-down menu, select Create Order.

3.     Select Assign Smart Account, and follow the subsequent prompts for Smart Licensing.

Assign Smart Account

Step 2.      Navigate to Products > Security > Cisco Firepower 9000 Series. In the search box, enter the part number FPR-C9300-AC.

Cisco Firepower 9000 Series

Step 3.      Add the chassis to the cart by clicking the blue plus sign (+), and then the Add button.

cart by clicking

Step 4.      Check the box at 1.0 FPR-C9300-AC and click Select Options.

Check the box at 1.0 FPR-C9300-AC

Step 5.      Follow the instructions in the yellow box. First, click the Power Cables link and make a cable selection in the next screen.

Power Cables

Step 6. After selecting appropriate cable(s), click Security Module Slot 1 in the yellow box.

Security Module Slot 1

Step 7.      Select either the SM-24 or SM-36 security module type, and then enter quantity 1. Repeat this process as required for two and three security modules, if ordered. Remember, you cannot mix module types in the chassis. Then click Security Module Slot 1 to add software.

SM-24 or SM-36 security module type

Step 8.      Check the button under the SKU selection column to add software, and then click Supervisor.

SKU selection column to add software

Step 9.      Check the box to add the supervisor module, and click the FPR9K-SUP link to add modules.

FPR9K-SUP link to add modules

Step 10.  Select the supervisor module, and then click Network Modules to add.

Network Modules to add

Step 11.  Select the required network modules, and then click FPR-NM-4X40G to select the required connectors.

click FPR-NM-4X40G

Step 12.  Browse and select compatible connectors from the list, and then click Done.

Browse and select compatible connectors

Step 13.  Any missing components will be flagged at this time. Here we see that a Strong Encryption license is missing. If required, return to the menu under Feature Licenses to add.

Feature Licenses to add

Step 14.  Select L-FPR9K-ASA to display additional software licenses. Select Strong Encryption and additional security contexts if desired, and then click Done.

Select L-FPR9K-ASA

Ordering Example 2: Firepower 4100 NGFW (Uses the Firepower Threat Defense Image)

Step 1.       

1.     In Cisco Commerce, select one of the bundles for desired platform based on performance requirements:

     FPR4110-BUN

     FPR4120-BUN

     FPR4140-BUN

     FPR4150-BUN

     FPR4115-BUN

     FPR4125-BUN

     FPR4145-BUN

2.     Select the desired appliance by deployment type (4110 example):

     FPR4110-ASA-K9 (for firewall deployment, running standalone ASA firewall)

or

     FPR4110-NGFW-K9 (for NGFW deployment, running Cisco Firepower Threat Defense)

or

     FPR4110-NGIPS-K9 (for NGIPS deployment [inline options], running Cisco Firepower Threat Defense)

Firepower 4100 NGFW

Step 2.       

3.     FPR4110-NGFW-K9 is selected from the “Firepower Hardware” section.

4.     Select the Redundant Power Supply option where applicable. If chosen, two (2) power cords must be selected.

5.     Select Country Specification (affects power cord selection).

6.     Warnings will be presented in a yellow box until the number of power cords selected is equal to the number of power supplies.

Firepower Hardware_FPR4110-NGFW-K9

Step 3.      Configure the supervisor software.

7.     The FXOS license is selected by default, as it is the supervisor operating system and required for system function. No selection is required.

Configure the supervisor software -

Step 4.      Configure the Cisco Firepower Threat Defense software version.

Configure the Cisco Firepower Threat Defense software version -

Step 5.      Configure the supervisor SFP modules.

8.     Select SFP modules for the supervisor (up to 8 allowed). These are the on-chassis included ports and require an optics module to function.

Select SFP modules for the supervisor

Step 6.      Configure the network modules.

9.     Select optional network module(s).

10.   There are two network module slots (1 and 2). Each contains selectable options.

11.   Certain network modules offer SFP options when selected. These appear as a links below the Slot 1 and Slot 2 section headings.

Configure the network modules

Step 7.      Configure the network modules (continued).

12.   When the link is clicked, SFP options appear (example: FPR4K-NM-4X40G).

13.   Select the appropriate number of SFPs for the network module.

Configure the network modules

Step 8.      Complete the bundle by adding optional subscriptions.

14.   After completion of hardware options, return to the main bundle page.

15.   Click the SUBSCRIPTIONS link on the lower left.

Click the SUBSCRIPTIONS link

16.   When selected, the subscription options will expand. Subscriptions for the NGFW configuration are optional:

     T = Threat (IPS)

     TM = Threat + AMP

     TC = Threat + URL

     TMC = Threat + AMP +URL

NGFW configuration

Step 9.      Complete the bundle by adding optional subscriptions.

17.   Click the blue plus sign (+) to add a desired subscription.

18.   The subscription will then appear below the previously completed hardware selection.

Bundle by adding optional subscriptions

19.   You may then configure the term of the subscription by clicking the “Edit Services/Subscriptions” link. 3Y is the default term, with options for 1Y and 5Y.

Edit Services/Subscriptions

SKUs and Ordering for Cisco Firepower 9300

The following tables outline the product part number information for the Cisco Firepower 9300. Note that the customer may want extra power supplies and fans. You can add these to the order separately. When you order, you choose between one and three security modules per chassis. Note that security module types cannot be mixed within a chassis.

Table 29.          Chassis and sublevel assemblies and components included with each chassis

Part Number (Chassis Hardware)

Description

FPR-C9300-AC

Cisco Firepower 9300 AC Chassis - includes 2 power supply units + 4 fans + rack-mount kit (3RU; accommodates up to three security modules)

FPR-C9300-DC

Cisco Firepower 9300 DC Chassis - includes 2 power supply units + 4 fans + rack-mount kit (3RU; accommodates up to three security modules)

FPR-C9300-HVDC

Cisco Firepower 9300 high-voltage DC Chassis - includes 2 power supply units + 4 fans + rack-mount kit (3RU; accommodates up to three security modules)

FPR-C9300-AC=

Cisco Firepower 9300 AC Chassis Spare – without power supply and fans

FPR-C9300-DC=

Cisco Firepower 9300 DC Chassis Spare – without power supply and fans

FPR9K-PS-AC=

Cisco Firepower 9000 Series AC Power Supply (order for spare only)

FPR9K-PS-DC=

Cisco Firepower 9000 Series DC Power Supply (order for spare only)

FPR9K-FAN=

Cisco Firepower 9000 Series Fan (order for spare only)

FPR9K-RMK=

Cisco Firepower 9000 Series Rack Mount Kit (order for spare only)

FPR9K-SUP=

Cisco Firepower 9000 Series Supervisor Spare

 

Part Number (Security Modules)

Description

FPR9K-SM-24=

Cisco Firepower 9000 Series, Security Module 24 Spare, (NEBS certified) includes 2 SSDs

FPR9K-SM-36=

Cisco Firepower 9000 Series, Security Module 36 Spare, includes 2 SSDs

FPR9K-SM-44=

Cisco Firepower 9000 Series, Security Module 44 Spare, includes 2 SSDs

FPR9K-SM-40=

Cisco Firepower 9000 Series, Security Module 40 Spare, includes 2 SSDs

FPR9K-SM-48=

Cisco Firepower 9000 Series, Security Module 48 Spare, includes 2 SSDs

FPR9K-SM-56=

Cisco Firepower 9000 Series, Security Module 56 Spare, includes 2 SSDs

FPT9KT-HA-BUN

Cisco FPR9300 Threat Defense Chassis, Subs HA Bundle

FPR9KT-SM24-HA-BUN

Cisco FPR9300 SM-24 Threat Defense Chassis, Subs HA Bundle

FPR9KT-SM36-HA-BUN

Cisco FPR9300 SM-36 Threat Defense Chassis, Subs HA Bundle

FPR9KT-SM44-HA-BUN

Cisco FPR9300 SM-44 Threat Defense Chassis, Subs HA Bundle

 

Part Number (Cables)

Description

Breakout Cables

Generic breakout cables can be used, please see: https://www.cisco.com/c/en/us/products/collateral/interfaces-modules/transceiver-modules/data_sheet_c78-660083.html

Note:      There are eight 10-Gbps ports on the supervisor module, which is bundled by default with the chassis. However, customers that plan to use supervisor module ports will require connectors for both those ports as well as for the ports on the network modules. Only one 1-Gbps connector, for the management port, is included by default with each supervisor module.

Table 30.          Cisco Firepower 9300 Network Modules

Network Modules

Description

FPR9K-NM-4X40G

Firepower 9000 Series – 4 port QSFP+ Network Module

FPR9K-NM-4X40G=

Firepower 9000 Series – 4 port QSFP+ Network Module

FPR9K-NM-8X10G

Firepower 9000 Series – 8 port SFP+ Network Module

FPR9K-NM-8X10G=

Firepower 9000 Series – 8 port SFP+ Network Module

FPR9K-DNM-2X100G

Cisco FirePower 2 port 100G Network Module, Double Width

FPR9K-DNM-2X100G=

Cisco FirePower 2 port 100G Network Module, Double Width

FPR9K-NM-2X100G

Cisco FirePower 2 port 100G Network Module

FPR9K-NM-2X100G=

Cisco FirePower 2 port 100G Network Module

FPR9K-NM-4X100G

Cisco FirePower 4 port 100G Network Module

FPR9K-NM-4X100G=

Cisco FirePower 4 port 100G Network Module

FPR9K-NM-6X10SR-F

10G Short range Fail to Wire Network Module (includes built-in SFP)

FPR9K-NM-6X10SR-F=

10G Short range Fail to Wire Spare Network Module (includes built-in SFP)

FPR9K-NM-6X10LR-F

10G Long range Fail to Wire Network Module (includes built-in SFP)

FPR9K-NM-6X10LR-F=

10G Long range Fail to Wire Spare Network Module (includes built-in SFP)

FPR9K-NM-2X40G-F

40G Fail to Wire Network Module (includes built-in QSFP)

FPR9K-NM-2X40G-F=

40G Fail to Wire Spare Network Module (includes built-in QSFP)

FPR9K-NM-6X1SX-F

Cisco Firepower 6-port 1G SX Fiber FTW Network Module (includes built-in SFP)

FPR9K-NM-6X1SX-F=

Cisco Firepower 6-port 1G SX Fiber FTW Network Module (Spare) (inlcudes built-in SFP)

Table 31.          SFP module options for 10G netmod and 10G supervisor ports

Part Number (SFP Modules)

Description

SKU

Description

SFP-10G-SR

10GBASE-SR SFP Module

SFP-10G-LR

10GBASE-LR SFP Module

SFP-10G-SR-S

10GBASE-SR SFP Module, Enterprise-Class

SFP-10G-LR-S

10GBASE-LR SFP Module, Enterprise-Class

SFP-10G-LRM

10GBASE-LRM SFP Module

SFP-10G-ER

10GBASE-ER SFP Module

SFP-H10GB-CU1M

10GBASE-CU SFP+ Cable 1m

SFP-H10GB-CU3M

10GBASE-CU SFP+ Cable 3m

SFP-H10GB-CU5M

10GBASE-CU SFP+ Cable 5m

SFP-H10GB-ACU7M

Active Twinax cable assembly, 7m

SFP-H10GB-ACU10M

Active Twinax cable assembly, 10m

SFP-10G-AOC1M

10GBASE Active Optical SFP+ Cable, 1m

SFP-10G-AOC2M

10GBASE Active Optical SFP+ Cable, 2m

SFP-10G-AOC3M

10GBASE Active Optical SFP+ Cable, 3m

SFP-10G-AOC5M

10GBASE Active Optical SFP+ Cable, 5m

SFP-10G-AOC7M

10GBASE Active Optical SFP+ Cable, 7m

SFP-10G-AOC10M

10GBASE Active Optical SFP+ Cable, 10m

GLC-SX-MMD

1000BASE-SX SFP transceiver module, MMF, 850nm, DOM

GLC-LH-SMD

1000BASE-LX/LH SFP transceiver module, MMF/SMF, 1310nm, DOM

GLC-EX-SMD

1000BASE-EX SFP transceiver module, SMF, 1310nm, DOM

GLC-ZX-SMD

1000BASE-ZX SFP transceiver module, SMF, 1550nm, DOM

Table 32.          SFP module options for 40G netmod

Part Number (SFP Modules)

Description

QSFP-40G-SR4

40GBASE-SR4 QSFP Transceiver Module with MPO Connector

QSFP-40G-CSR4

QSFP 4x10GBASE-SR Transceiver Module, MPO, 300M

QSFP-40G-SR-BD

QSFP40G BiDi Short-reach Transceiver

QSFP-40G-LR4-S

QSFP 40GBASE-LR4 Transceiver Mod, LC, 10km, Enterprise-Class

QSFP-40G-LR4

QSFP 40GBASE-LR4 OTN Transceiver, LC, 10km

WSP-Q40GLR4L

QSFP 40G Ethernet - LR4 Lite, LC, 2KM

QSFP-H40G-CU1M

40GBASE-CR4 Passive Copper Cable, 1m

QSFP-H40G-CU3M

40GBASE-CR4 Passive Copper Cable, 3m

QSFP-H40G-CU5M

40GBASE-CR4 Passive Copper Cable, 5m

QSFP-H40G-AOC1M

40GBASE Active Optical Cable, 1m

QSFP-H40G-AOC2M

40GBASE Active Optical Cable, 2m

QSFP-H40G-AOC3M

40GBASE Active Optical Cable, 3m

QSFP-H40G-AOC5M

40GBASE Active Optical Cable, 5m

QSFP-H40G-AOC7M

40GBASE Active Optical Cable, 7m

QSFP-H40G-AOC10M

40GBASE Active Optical Cable, 10m

QSFP-H40G-AOC15M

40GBASE Active Optical Cable, 15m

QSFP-H40G-ACU7M

40GBASE-CR4 Active Copper Cable, 7m

QSFP-H40G-AOC10M

40GBASE-CR4 Active Copper Cable, 10m

Table 33.          100G network QSFP28 module options

Part Number (SFP Modules)

Description

QSFP-100G-LR4-S

100GBASE LR4 QSFP Transceiver, LC, 10km over SMF

When ordering a Cisco Firepower 9300 firewall with the ASA configuration, a Standard (base) ASA license (L‑F9K‑ASA) is required.

Table 34.          Cisco Firepower 9300 power cables

Part Number (Power Cables)

Country

Description

CAB-AC-2500W-INT

International

Power Cord, 250VAC 16A, INTL

CAB-C19-CBN

International

Cabinet Jumper Power Cord, 250VAC 16A, C20-C19 Connectors

CAB-AC-C6K-TWLK

[All Categories]

Power Cord, 250VAC 16A, twist lock NEMA L6-20 plug, US

CAB-AC-2500W-US1

North America and Japan

Power Cord, 250VAC 16A, straight blade NEMA 6-20 plug, US

CAB-AC-16A-AUS

Australia

Power Cord, 250VAC, 16A, Australia C19

CAB-AC16A-CH

China

16A AC Power Cord for China

CAB-AC-2500W-ISRL

People's Republic of China

Power Cord, 250VAC, 16A, Israel

CAB-S132-C19-ISRL

Israel

S132 to IEC-C19 14ft Israeli

CAB-ACS-16

Switzerland

AC Power Cord (Swiss) 16A

CAB-IR2073-C19-AR

Argentina

IRSM 2073 to IEC-C19 14ft Argentina

CAB-BS1363-C19-UK

United Kingdom

BS-1363 to IEC-C19 14ft UK

CAB-SABS-C19-IND

India

SABS 164-1 to IEC-C19 India

CAB-C2316-C19-IT

Italy

CEI 23-16 to IEC-C19 14ft Italy

UCSB-CABL-C19-BRZ

Brazil

NBR 14136 to C19 AC 14ft Power Cord, Brazil

CAB-C19-C20-3M-JP

Japan

Power Cord C19-C20, 3m/10ft Japan PSE mark

CAB-AC-2500W-INT

International

Power Cord, 250VAC 16A, INTL

SKUs for Cisco Firepower 9300 Series Licenses and Firepower Threat Defense Subscriptions

When ordering a Cisco Firepower 9300 firewall with the ASA configuration, a Standard (base) ASA license (L-F9K-ASA) is required.

Alternatively, when ordering a 9300 Series NGFW with the Cisco Firepower Threat Defense image, base AVC capability comes by default with Cisco Firepower Threat Defense license (L-FPR9K-TD-BASE=). Additionally, subscriptions can be purchased (one license per security module) to add NGIPS, URL Filtering, and AMP capabilities. Similarly, if the customer already has a Firepower 9300, the same PIDs are used to upgrade to the Cisco Firepower Threat Defense image. Subscription terms are 1, 3, and 5 years, with the greatest price discount at 5 years. In the listed part numbers, the threat services are identified as follows:

Table 35.          Threat subscription decoder

Threat Subscription Abbreviations

Description

T

Threat (Security Intelligence and Cisco Firepower Next-Generation IPS)

M or AMP

Advanced Malware Protection for Networks (AMP)

C or URL

URL Filtering

1Y

1-Year Subscription

3Y

3-Year Subscription

5Y

5-Year Subscription

Table 36.          Cisco Firepower 9300 Series license part numbers and subscription terms for Cisco Firepower Threat Defense on Security Module SM-24

PID

Description

L-FPR9K-24T-T=

Cisco FPR9K SM-24 Threat Defense Threat Protection License

L-FPR9K-24T-AMP=

Cisco FPR9K SM-24 Threat Defense Malware Protection License

L-FPR9K-24T-URL=

Cisco FPR9K SM-24 Threat Defense URL Filtering License

L-FPR9K-24T-TM=

Cisco FPR9K SM-24 Threat Defense Threat and Malware License

L-FPR9K-24T-TC=

Cisco FPR9K SM-24 Threat Defense Threat and URL License

L-FPR9K-24T-TMC=

Cisco FPR9K SM-24 Threat Defense Threat, Malware and URL License

L-FPR9K-24T-AMP-1Y

Cisco FPR9K SM-24 Threat Defense Malware Protection 1Y Subs

L-FPR9K-24T-AMP-3Y

Cisco FPR9K SM-24 Threat Defense Malware Protection 3Y Subs

L-FPR9K-24T-AMP-5Y

Cisco FPR9K SM-24 Threat Defense Malware Protection 5Y Subs

L-FPR9K-24T-URL-1Y

Cisco FPR9K SM-24 Threat Defense URL Filtering 1Y Subs

L-FPR9K-24T-URL-3Y

Cisco FPR9K SM-24 Threat Defense URL Filtering 3Y Subs

L-FPR9K-24T-URL-5Y

Cisco FPR9K SM-24 Threat Defense URL Filtering 5Y Subs

L-FPR9K-24T-T-1Y

Cisco FPR9K SM-24 Threat Defense Threat Protection 1Y Subs

L-FPR9K-24T-T-3Y

Cisco FPR9K SM-24 Threat Defense Threat Protection 3Y Subs

L-FPR9K-24T-T-5Y

Cisco FPR9K SM-24 Threat Defense Threat Protection 5Y Subs

L-FPR9K-24T-TM-1Y

Cisco FPR9K SM-24 Threat Defense Threat and Malware 1Y Subs

L-FPR9K-24T-TM-3Y

Cisco FPR9K SM-24 Threat Defense Threat and Malware 3Y Subs

L-FPR9K-24T-TM-5Y

Cisco FPR9K SM-24 Threat Defense Threat and Malware 5Y Subs

L-FPR9K-24T-TC-1Y

Cisco FPR9K SM-24 Threat Defense Threat and URL 1Y Subs

L-FPR9K-24T-TC-3Y

Cisco FPR9K SM-24 Threat Defense Threat and URL 3Y Subs

L-FPR9K-24T-TC-5Y

Cisco FPR9K SM-24 Threat Defense Threat and URL 5Y Subs

L-FPR9K-24T-TMC-1Y

Cisco FPR9K SM-24 Threat Defense Threat, Malware, URL 1Y Sub

L-FPR9K-24T-TMC-3Y

Cisco FPR9K SM-24 Threat Defense Threat, Malware, URL 3Y Sub

L-FPR9K-24T-TMC-5Y

Cisco FPR9K SM-24 Threat Defense Threat, Malware, URL 5Y Sub

Table 37.          Cisco Firepower 9300 Series license part numbers and subscription terms for Cisco Firepower Threat Defense on Security Module SM-36

FPR9K-SM-36

Firepower 9000 Series High Performance Security Module

L-FPR9K-36T-T=

Cisco FPR9K SM-36 Threat Defense Threat Protection License

L-FPR9K-36T-AMP=

Cisco FPR9K SM-36 Threat Defense Malware Protection License

L-FPR9K-36T-URL=

Cisco FPR9K SM-36 Threat Defense URL Filtering License

L-FPR9K-36T-TM=

Cisco FPR9K SM-36 Threat Defense Threat and Malware License

L-FPR9K-36T-TC=

Cisco FPR9K SM-36 Threat Defense Threat and URL License

L-FPR9K-36T-TMC=

Cisco FPR9K SM-36 Threat Defense Threat, Malware and URL License

L-FPR9K-36T-AMP-1Y

Cisco FPR9K SM-36 Threat Defense Malware Protection 1Y Subs

L-FPR9K-36T-AMP-3Y

Cisco FPR9K SM-36 Threat Defense Malware Protection 3Y Subs

L-FPR9K-36T-AMP-5Y

Cisco FPR9K SM-36 Threat Defense Malware Protection 5Y Subs

L-FPR9K-36T-URL-1Y

Cisco FPR9K SM-36 Threat Defense URL Filtering 1Y Subs

L-FPR9K-36T-URL-3Y

Cisco FPR9K SM-36 Threat Defense URL Filtering 3Y Subs

L-FPR9K-36T-URL-5Y

Cisco FPR9K SM-36 Threat Defense URL Filtering 5Y Subs

L-FPR9K-36T-T-1Y

Cisco FPR9K SM-36 Threat Defense Threat Protection 1Y Subs

L-FPR9K-36T-T-3Y

Cisco FPR9K SM-36 Threat Defense Threat Protection 3Y Subs

L-FPR9K-36T-T-5Y

Cisco FPR9K SM-36 Threat Defense Threat Protection 5Y Subs

L-FPR9K-36T-TM-1Y

Cisco FPR9K SM-36 Threat Defense Threat and Malware 1Y Subs

L-FPR9K-36T-TM-3Y

Cisco FPR9K SM-36 Threat Defense Threat and Malware 3Y Subs

L-FPR9K-36T-TM-5Y

Cisco FPR9K SM-36 Threat Defense Threat and Malware 5Y Subs

L-FPR9K-36T-TC-1Y

Cisco FPR9K SM-36 Threat Defense Threat and URL 1Y Subs

L-FPR9K-36T-TC-3Y

Cisco FPR9K SM-36 Threat Defense Threat and URL 3Y Subs

L-FPR9K-36T-TC-5Y

Cisco FPR9K SM-36 Threat Defense Threat and URL 5Y Subs

L-FPR9K-36T-TMC-1Y

Cisco FPR9K SM-36 Threat Defense Threat, Malware, URL 1Y Sub

L-FPR9K-36T-TMC-3Y

Cisco FPR9K SM-36 Threat Defense Threat, Malware, URL 3Y Sub

L-FPR9K-36T-TMC-5Y

Cisco FPR9K SM-36 Threat Defense Threat, Malware, URL 5Y Sub

Table 38.          Cisco Firepower 9300 Series license part numbers and subscription terms for Cisco Firepower Threat Defense on Security Module SM-44

FPR9K-SM-44

Firepower 9000 Series Super-High Performance Security Module

L-FPR9K-44T-T=

Cisco FPR9K SM-44 Threat Defense Threat Protection License

L-FPR9K-44T-AMP=

Cisco FPR9K SM-44 Threat Defense Malware Protection License

L-FPR9K-44T-URL=

Cisco FPR9K SM-44 Threat Defense URL Filtering License

L-FPR9K-44T-TM=

Cisco FPR9K SM-44 Threat Defense Threat and Malware License

L-FPR9K-44T-TC=

Cisco FPR9K SM-44 Threat Defense Threat and URL License

L-FPR9K-44T-TMC=

Cisco FPR9K SM-44 Threat Defense Threat, Malware and URL License

L-FPR9K-44T-AMP-1Y

Cisco FPR9K SM-44 Threat Defense Malware Protection 1Y Subs

L-FPR9K-44T-AMP-3Y

Cisco FPR9K SM-44 Threat Defense Malware Protection 3Y Subs

L-FPR9K-44T-AMP-5Y

Cisco FPR9K SM-44 Threat Defense Malware Protection 5Y Subs

L-FPR9K-44T-URL-1Y

Cisco FPR9K SM-44 Threat Defense URL Filtering 1Y Subs

L-FPR9K-44T-URL-3Y

Cisco FPR9K SM-44 Threat Defense URL Filtering 3Y Subs

L-FPR9K-44T-URL-5Y

Cisco FPR9K SM-44 Threat Defense URL Filtering 5Y Subs

L-FPR9K-44T-T-1Y

Cisco FPR9K SM-44 Threat Defense Threat Protection 1Y Subs

L-FPR9K-44T-T-3Y

Cisco FPR9K SM-44 Threat Defense Threat Protection 3Y Subs

L-FPR9K-44T-T-5Y

Cisco FPR9K SM-44 Threat Defense Threat Protection 5Y Subs

L-FPR9K-44T-TM-1Y

Cisco FPR9K SM-44 Threat Defense Threat and Malware 1Y Subs

L-FPR9K-44T-TM-3Y

Cisco FPR9K SM-44 Threat Defense Threat and Malware 3Y Subs

L-FPR9K-44T-TM-5Y

Cisco FPR9K SM-44 Threat Defense Threat and Malware 5Y Subs

L-FPR9K-44T-TC-1Y

Cisco FPR9K SM-44 Threat Defense Threat and URL 1Y Subs

L-FPR9K-44T-TC-3Y

Cisco FPR9K SM-44 Threat Defense Threat and URL 3Y Subs

L-FPR9K-44T-TC-5Y

Cisco FPR9K SM-44 Threat Defense Threat and URL 5Y Subs

L-FPR9K-44T-TMC-1Y

Cisco FPR9K SM-44 Threat Defense Threat, Malware, URL 1Y Sub

L-FPR9K-44T-TMC-3Y

Cisco FPR9K SM-44 Threat Defense Threat, Malware, URL 3Y Sub

L-FPR9K-44T-TMC-5Y

Cisco FPR9K SM-44 Threat Defense Threat, Malware, URL 5Y Sub

Table 39.          Cisco Firepower 9300 Series license part numbers and subscription terms for Cisco Firepower Threat Defense on Security Module SM-40

FPR9K-SM-40

Firepower 9000 Series Security Module 40

L-FPR9K-40T-T=

Cisco FPR9K SM-40 Threat Defense Threat Protection License

L-FPR9K-40T-AMP=

Cisco FPR9K SM-40 Threat Defense Malware Protection License

L-FPR9K-40T-URL=

Cisco FPR9K SM-40 Threat Defense URL Filtering License

L-FPR9K-40T-TM=

Cisco FPR9K SM-40 Threat Defense Threat and Malware License

L-FPR9K-40T-TC=

Cisco FPR9K SM-40 Threat Defense Threat and URL License

L-FPR9K-40T-TMC=

Cisco FPR9K SM-40 Threat Defense Threat, Malware and URL License

L-FPR9K-40T-AMP-1Y

Cisco FPR9K SM-40 Threat Defense Malware Protection 1Y Subs

L-FPR9K-40T-AMP-3Y

Cisco FPR9K SM-40 Threat Defense Malware Protection 3Y Subs

L-FPR9K-40T-AMP-5Y

Cisco FPR9K SM-40 Threat Defense Malware Protection 5Y Subs

L-FPR9K-40T-URL-1Y

Cisco FPR9K SM-40 Threat Defense URL Filtering 1Y Subs

L-FPR9K-40T-URL-3Y

Cisco FPR9K SM-40 Threat Defense URL Filtering 3Y Subs

L-FPR9K-40T-URL-5Y

Cisco FPR9K SM-40 Threat Defense URL Filtering 5Y Subs

L-FPR9K-40T-T-1Y

Cisco FPR9K SM-40 Threat Defense Threat Protection 1Y Subs

L-FPR9K-40T-T-3Y

Cisco FPR9K SM-40 Threat Defense Threat Protection 3Y Subs

L-FPR9K-40T-T-5Y

Cisco FPR9K SM-40 Threat Defense Threat Protection 5Y Subs

L-FPR9K-40T-TM-1Y

Cisco FPR9K SM-40 Threat Defense Threat and Malware 1Y Subs

L-FPR9K-40T-TM-3Y

Cisco FPR9K SM-40 Threat Defense Threat and Malware 3Y Subs

L-FPR9K-40T-TM-5Y

Cisco FPR9K SM-40 Threat Defense Threat and Malware 5Y Subs

L-FPR9K-40T-TC-1Y

Cisco FPR9K SM-40 Threat Defense Threat and URL 1Y Subs

L-FPR9K-40T-TC-3Y

Cisco FPR9K SM-40 Threat Defense Threat and URL 3Y Subs

L-FPR9K-40T-TC-5Y

Cisco FPR9K SM-40 Threat Defense Threat and URL 5Y Subs

L-FPR9K-40T-TMC-1Y

Cisco FPR9K SM-40 Threat Defense Threat, Malware, URL 1Y Sub

L-FPR9K-40T-TMC-3Y

Cisco FPR9K SM-40 Threat Defense Threat, Malware, URL 3Y Sub

L-FPR9K-40T-TMC-5Y

Cisco FPR9K SM-40 Threat Defense Threat, Malware, URL 5Y Sub

Table 40.          Cisco Firepower 9300 Series license part numbers and subscription terms for Cisco Firepower Threat Defense on Security Module SM-48

FPR9K-SM-48

Firepower 9000 Series Security Module 48

L-FPR9K-48T-T=

Cisco FPR9K SM-48 Threat Defense Threat Protection License

L-FPR9K-48T-AMP=

Cisco FPR9K SM-48 Threat Defense Malware Protection License

L-FPR9K-48T-URL=

Cisco FPR9K SM-48 Threat Defense URL Filtering License

L-FPR9K-48T-TM=

Cisco FPR9K SM-48 Threat Defense Threat and Malware License

L-FPR9K-48T-TC=

Cisco FPR9K SM-48 Threat Defense Threat and URL License

L-FPR9K-48T-TMC=

Cisco FPR9K SM-48 Threat Defense Threat, Malware and URL License

L-FPR9K-48T-AMP-1Y

Cisco FPR9K SM-48 Threat Defense Malware Protection 1Y Subs

L-FPR9K-48T-AMP-3Y

Cisco FPR9K SM-48 Threat Defense Malware Protection 3Y Subs

L-FPR9K-48T-AMP-5Y

Cisco FPR9K SM-48 Threat Defense Malware Protection 5Y Subs

L-FPR9K-48T-URL-1Y

Cisco FPR9K SM-48 Threat Defense URL Filtering 1Y Subs

L-FPR9K-48T-URL-3Y

Cisco FPR9K SM-48 Threat Defense URL Filtering 3Y Subs

L-FPR9K-48T-URL-5Y

Cisco FPR9K SM-48 Threat Defense URL Filtering 5Y Subs

L-FPR9K-48T-T-1Y

Cisco FPR9K SM-48 Threat Defense Threat Protection 1Y Subs

L-FPR9K-48T-T-3Y

Cisco FPR9K SM-48 Threat Defense Threat Protection 3Y Subs

L-FPR9K-48T-T-5Y

Cisco FPR9K SM-48 Threat Defense Threat Protection 5Y Subs

L-FPR9K-48T-TM-1Y

Cisco FPR9K SM-48 Threat Defense Threat and Malware 1Y Subs

L-FPR9K-48T-TM-3Y

Cisco FPR9K SM-48 Threat Defense Threat and Malware 3Y Subs

L-FPR9K-48T-TM-5Y

Cisco FPR9K SM-48 Threat Defense Threat and Malware 5Y Subs

L-FPR9K-48T-TC-1Y

Cisco FPR9K SM-48 Threat Defense Threat and URL 1Y Subs

L-FPR9K-48T-TC-3Y

Cisco FPR9K SM-48 Threat Defense Threat and URL 3Y Subs

L-FPR9K-48T-TC-5Y

Cisco FPR9K SM-48 Threat Defense Threat and URL 5Y Subs

L-FPR9K-48T-TMC-1Y

Cisco FPR9K SM-48 Threat Defense Threat, Malware, URL 1Y Sub

L-FPR9K-48T-TMC-3Y

Cisco FPR9K SM-48 Threat Defense Threat, Malware, URL 3Y Sub

L-FPR9K-48T-TMC-5Y

Cisco FPR9K SM-48 Threat Defense Threat, Malware, URL 5Y Sub

Table 41.          Cisco Firepower 9300 Series license part numbers and subscription terms for Cisco Firepower Threat Defense on Security Module SM-56

FPR9K-SM-56

Firepower 9000 Series Security Module 56

L-FPR9K-56T-T=

Cisco FPR9K SM-56 Threat Defense Threat Protection License

L-FPR9K-56T-AMP=

Cisco FPR9K SM-56 Threat Defense Malware Protection License

L-FPR9K-56T-URL=

Cisco FPR9K SM-56 Threat Defense URL Filtering License

L-FPR9K-56T-TM=

Cisco FPR9K SM-56 Threat Defense Threat and Malware License

L-FPR9K-56T-TC=

Cisco FPR9K SM-56 Threat Defense Threat and URL License

L-FPR9K-56T-TMC=

Cisco FPR9K SM-56 Threat Defense Threat, Malware and URL License

L-FPR9K-56T-AMP-1Y

Cisco FPR9K SM-56 Threat Defense Malware Protection 1Y Subs

L-FPR9K-56T-AMP-3Y

Cisco FPR9K SM-56 Threat Defense Malware Protection 3Y Subs

L-FPR9K-56T-AMP-5Y

Cisco FPR9K SM-56 Threat Defense Malware Protection 5Y Subs

L-FPR9K-56T-URL-1Y

Cisco FPR9K SM-56 Threat Defense URL Filtering 1Y Subs

L-FPR9K-56T-URL-3Y

Cisco FPR9K SM-56 Threat Defense URL Filtering 3Y Subs

L-FPR9K-56T-URL-5Y

Cisco FPR9K SM-56 Threat Defense URL Filtering 5Y Subs

L-FPR9K-56T-T-1Y

Cisco FPR9K SM-56 Threat Defense Threat Protection 1Y Subs

L-FPR9K-56T-T-3Y

Cisco FPR9K SM-56 Threat Defense Threat Protection 3Y Subs

L-FPR9K-56T-T-5Y

Cisco FPR9K SM-56 Threat Defense Threat Protection 5Y Subs

L-FPR9K-56T-TM-1Y

Cisco FPR9K SM-56 Threat Defense Threat and Malware 1Y Subs

L-FPR9K-56T-TM-3Y

Cisco FPR9K SM-56 Threat Defense Threat and Malware 3Y Subs

L-FPR9K-56T-TM-5Y

Cisco FPR9K SM-56 Threat Defense Threat and Malware 5Y Subs

L-FPR9K-56T-TC-1Y

Cisco FPR9K SM-56 Threat Defense Threat and URL 1Y Subs

L-FPR9K-56T-TC-3Y

Cisco FPR9K SM-56 Threat Defense Threat and URL 3Y Subs

L-FPR9K-56T-TC-5Y

Cisco FPR9K SM-56 Threat Defense Threat and URL 5Y Subs

L-FPR9K-56T-TMC-1Y

Cisco FPR9K SM-56 Threat Defense Threat, Malware, URL 1Y Sub

L-FPR9K-56T-TMC-3Y

Cisco FPR9K SM-56 Threat Defense Threat, Malware, URL 3Y Sub

L-FPR9K-56T-TMC-5Y

Cisco FPR9K SM-56 Threat Defense Threat, Malware, URL 5Y Sub

SKUs and Ordering Guidance for Cisco Firepower NGFWv

Cisco Firepower NGFWv is available where virtualized NGFW capability is required, including in public cloud environments. It is the virtualized version of Cisco Firepower NGFW. Deployments with Cisco Firepower NGFWv enable consistent security policies to follow workloads across your physical, virtual, and cloud environments, and between clouds. Complexity is further minimized with simple provisioning and a single console, the Firepower Management Center (FMC), which enables threat visibility, and automated defense, across your estate. FMC manages both physical Firepower NGFW appliances and Firepower NGFWv instances. See the Firepower Management Center section of this guide for FMC part numbers.

In Amazon Web Services (AWS) environments, Cisco Firepower NGFWv instances can be managed either by an on-premises FMC, or in AWS with the virtualized Cisco Firepower Management Center, FMCv. When deployed in AWS environments, two licensing models are available:

     Bring Your Own License (BYOL), where an existing NGFWv license is required

     Hourly billing (a pay-as-you-go model) available through the AWS interface

Cisco Firepower NGFWv enables inter-VM and east-west traffic inspection, as well as at ingress and egress points to the cloud. It is designed to address security concerns in both traditional networks infrastructures and to be optionally inserted into Cisco’s Application Centric Infrastructure (ACI) for flexible orchestration.

Table 42.          Cisco Firepower NGFWv Base and Subscription SKUs

SKUs

Base License

Term Subscription

Description

FPRTD-V-K9

 

Cisco Firepower NGFWv Base License

 

Term Licenses

Term Subscription

Description

L-FPRTD-V-TMC=

L-FPRTD-V-TMC-1Y

Cisco Firepower NGFWv Threat Defense Threat, Malware, and URL 1YR Subscription

L-FPRTD-V-TMC=

L-FPRTD-V-TMC-3Y

Cisco Firepower NGFWv Threat Defense Threat, Malware, and URL 3YR Subscription

L-FPRTD-V-TMC=

L-FPRTD-V-TMC-5Y

Cisco Firepower NGFWv Threat Defense Threat, Malware, and URL 5YR Subscription

L-FPRTD-V-T=

L-FPRTD-V-T-1Y

Cisco Firepower NGFWv Threat Defense Threat Protection 1YR Subscription

L-FPRTD-V-T=

L-FPRTD-V-T-3Y

Cisco Firepower NGFWv Threat Defense Threat Protection 3YR Subscription

L-FPRTD-V-T=

L-FPRTD-V-T-5Y

Cisco Firepower NGFWv Threat Defense Threat Protection 5YR Subscription

L-FPRTD-V-URL=

L-FPRTD-V-URL-1Y

Cisco Firepower NGFWv Threat Defense URL Filtering 1YR Subscription

L-FPRTD-V-URL=

L-FPRTD-V-URL-3Y

Cisco Firepower NGFWv Threat Defense URL Filtering 3YR Subscription

L-FPRTD-V-URL=

L-FPRTD-V-URL-5Y

Cisco Firepower NGFWv Threat Defense URL Filtering 5YR Subscription

L-FPRTD-V-TC=

L-FPRTD-V-TC-1Y

Cisco Firepower NGFWv Threat Defense Threat and URL 1Y Subscription

L-FPRTD-V-TC=

L-FPRTD-V-TC-3Y

Cisco Firepower NGFWv Threat Defense Threat and URL 3Y Subscription

L-FPRTD-V-TC=

L-FPRTD-V-TC-5Y

Cisco Firepower NGFWv Threat Defense Threat and URL 5Y Subscription

L-FPRTD-V-TM=

L-FPRTD-V-TM-1Y

Cisco Firepower NGFWv Threat Defense Threat and Malware Protection 1Y Subscription

L-FPRTD-V-TM=

L-FPRTD-V-TM-3Y

Cisco Firepower NGFWv Threat Defense Threat and Malware Protection 3Y Subscription

L-FPRTD-V-TM=

L-FPRTD-V-TM-5Y

Cisco Firepower NGFWv Threat Defense Threat and Malware Protection 5Y Subscription

L-FPRTD-V-AMP=

L-FPRTD-V-AMP-1Y

Cisco Firepower NGFWv Threat Defense Malware Protection 1Y Subscription

L-FPRTD-V-AMP=

L-FPRTD-V-AMP-3Y

Cisco Firepower NGFWv Threat Defense Malware Protection 3Y Subscription

L-FPRTD-V-AMP=

L-FPRTD-V-AMP-5Y

Cisco Firepower NGFWv Threat Defense Malware Protection 5Y Subscription

SKUs and Ordering Guidance for Cisco Firepower Threat Defense Software on Select ASA Hardware

Select Cisco ASA 5500-X appliances can be deployed as a Next-Generation Firewall (NGFW) by running the Cisco Firepower Threat Defense unified software image. Threat Defense software on the ASA 5500-X brings threat‑focused, next-generation security to the following Next-Generation Firewalls: Cisco ASA 5508-X, 5516-X, 5525-X, 5545-X, and 5555-X.

Note:      Threat Defense software is not available on ASA 5585-X, ASA 5512-X, or ASA 5515-X, or ASA 5500 Series appliances without the “-X” suffix.

Threat Defense software on ASA 5500-X hardware includes combinations of the following orderable components:

     Cisco Firepower Threat Defense software on ASA 5508-X, 5516-X, 5525-X, 5545-X, and 5555-X appliances. High availability capability (Security Plus) is standard for all appliances as part of the base Threat Defense software and does not require a separate license.

     Application Visibility and Control (AVC) (included in the base image)

     Threat Defense software on ASA 5500-X subscriptions (1-year, 3-year, and 5-year terms) for:

     Cisco Firepower Next-Generation Intrusion Prevention System (NGIPS) with Security Intelligence and DNS (optional subscription)

     Reputation- and category-based URL Filtering (optional subscription)

     Advanced Malware Protection (AMP) and Cisco Threat Grid (optional subscription)

     Centralized management systems

     Cisco Firepower Management Center, physical or virtual appliance

     On-device management (included in v6.1 and later versions)

     Cisco Firepower Device Manager

     Cisco SSL Appliances (optional)

     Cisco Smart Net Total Care support services

     Cisco Software Application Support plus Upgrades (SASU)

The following tables outline the product information for base 5500-X hardware available with the Threat Defense software image. Table 34 corresponds to Cisco ASA with Firepower Threat Defense software on select low- and midrange Cisco ASA 5500-X appliances (Cisco ASA 5508-X, 5516-X, 5525-X, 5545‑X, and 5555-X).

Note:      The Threat Defense software image is not available on the ASA 5585-X, ASA 5512-X, or ASA 5515-X or older ASA 5500 Series hardware.

Table 43.          Cisco ASA 5500-X low- and midrange appliances with solid-state drive (SSD) and Cisco Firepower Threat Defense software modules

Part Number

Description

ASA5508-FTD-K9

ASA 5508-X with Threat Defense software, 8 GE Data, 1 GE Management, AC, 3DES/AES

ASA5516-FTD-K9

ASA 5516-X with Threat Defense software, 8 GE Data, 1 GE Management, AC, 3DES/AES

ASA5525-FTD-K9

ASA 5525-X with Threat Defense software, 8 GE Data, AC, 3DES/AES, SSD

ASA5545-FTD-K9

ASA 5545-X with Threat Defense software, 8 GE Data, AC, 3DES/AES, 2 SSD

ASA5555-FTD-K9

ASA 5555-X with Threat Defense software, 8 GE Data, AC, 3DES/AES, 2 SSD

Installing Firepower Threat Defense Software Image on Existing ASA with FirePOWER Services Appliances

Customers who already have a midrange Cisco ASA 5500-X appliance with an SSD will first need to create a Smart Licensing account on Cisco's Smart Software Manager portal before initiating an order for the relevant service subscriptions to run Threat Defense software. Next, you will need to migrate your existing ASA with FirePOWER Services licenses to Cisco Firepower Threat Defense licenses on the License Registration Portal. Customers who only have a TA license cannot use the License Registration portal. Instead they will need to file a GLO case to have their licenses migrated.

License registration portal

Figure 8.         

License registration portal

For more information see: Firepower Threat Defense – Smart Licensing FAQs and Smart Licensing.

When the order is placed, you will need to reimage the existing ASA 5500-X Series hardware with the Threat Defense software. Please refer to the Cisco Firepower Threat Defense Getting Started Guide for the ASA for detailed instructions.

Table 44.          Spare SSD for existing midrange Cisco ASA 5500-X customers

Part Number

Description

ASA5500X-SSD120=

ASA 5508-X through 5555-X 120-GB MLC SED SSD (spare)

To support failover and high-availability pairs, the primary and secondary platforms both need their own individual subscription licenses. Subscription licenses are not shared between primary and secondary NGFW platforms.

Bundle SKUs are the recommended approach to configure an order. By selecting a bundle SKU for a specific hardware appliance, the ordering tool will present you with a list of components that are compatible with that appliance. You are given the opportunity to select from this list of options to configure your order.

Table 45.          Cisco ASA 5500-X with Threat Defense software appliance bundle SKUs

Cisco Firepower Threat Defense Software on ASA 5500-X Series Bundles (Hardware and Subscription)

Part Number

Product Description

ASA5508-FTD-BUN

ASA 5508-X with Threat Defense Software, Chassis, and Threat Defense Software Subscription license Bundle

ASA5516-FTD-BUN

ASA 55016-X with Threat Defense Software, Chassis, and Threat Defense Software Subscription license Bundle

ASA5525-FTD-BUN

ASA 5525-X with Threat Defense Software, Chassis, and Threat Defense Software Subscription license Bundle

ASA5545-FTD-BUN

ASA 5545-X with Threat Defense Software, Chassis, and Threat Defense Software Subscription license Bundle

ASA5555-FTD-BUN

ASA 5555-X with Threat Defense Software, Chassis, and Threat Defense Software Subscription license Bundle

ASA5508-FTD-HA-BUN

ASA 5508-X with Threat Defense Software, Chassis, and Threat Defense Software Subscription license Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

ASA5516-FTD-HA-BUN

ASA 5516-X with Threat Defense Software, Chassis, and Threat Defense Software Subscription license Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

ASA5525-FTD-HA-BUN

ASA 5525-X with Threat Defense Software, Chassis, and Threat Defense Software Subscription license Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

ASA5545-FTD-HA-BUN

ASA 5545-X with Threat Defense Software, Chassis, and Threat Defense Software Subscription license Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

ASA5555-FTD-HA-BUN

ASA 5555-X with Threat Defense Software, Chassis, and Threat Defense Software Subscription license Bundle (will order 2 identical chassis and software subscriptions to be configured as a high-availability pair)

SKUs for Cisco Firepower Threat Defense Software on Select NEW ASA Appliances

The following tables provide ordering information for all Threat Defense software on ASA appliances. For optimal threat defense, we recommend choosing one of the multiservice subscriptions highlighted below. As well, we recommend multiyear subscriptions to customers for value and convenience.

Threat Subscription Abbreviations

Description

T

Threat (Security Intelligence, DNS, and Cisco Firepower Next-Generation IPS)

M or AMP

Advanced Malware Protection for Networks and Threat Grid (AMP)

C or URL

URL Filtering

1Y

1-Year Subscription

3Y

3-Year Subscription

5Y

5-Year Subscription

Table 46.          Cisco Firepower Threat Defense software on ASA 5508-X SKUs

Cisco ASA 5508-X with Threat Defense Software Term License and Subscription SKUs

Term License

Term Subscription

Description

L-ASA5508T-TMC=

L-ASA5508T-TMC-1Y

Cisco ASA5508 Threat Defense Threat, Malware, and URL 1YR Subscription

L-ASA5508T-TMC=

L-ASA5508T-TMC-3Y

Cisco ASA5508 Threat Defense Threat, Malware, and URL 3YR Subscription

L-ASA5508T-TMC=

L-ASA5508T-TMC-5Y

Cisco ASA5508 Threat Defense Threat, Malware, and URL 5YR Subscription

L-ASA5508T-T=

L-ASA5508T-TP-1Y

Cisco ASA5508 Threat Defense Threat Protection 1YR Subscription

L-ASA5508T-T=

L-ASA5508T-TP-3Y

Cisco ASA5508 Threat Defense Threat Protection 3YR Subscription

L-ASA5508T-T=

L-ASA5508T-TP-5Y

Cisco ASA5508 Threat Defense Threat Protection 5YR Subscription

L-ASA5508T-URL=

L-ASA5508T-URL-1Y

Cisco ASA5508 Threat Defense URL Filtering 1YR Subscription

L-ASA5508T-URL=

L-ASA5508T-URL-3Y

Cisco ASA5508 Threat Defense URL Filtering 3YR Subscription

L-ASA5508T-URL=

L-ASA5508T-URL-5Y

Cisco ASA5508 Threat Defense URL Filtering 5YR Subscription

L-ASA5508T-TC=

L-ASA5508T-TC-1Y

Cisco ASA5508 Threat Defense Threat and URL 1Y Subscription

L-ASA5508T-TC=

L-ASA5508T-TC-3Y

Cisco ASA5508 Threat Defense Threat and URL 3Y Subscription

L-ASA5508T-TC=

L-ASA5508T-TC-5Y

Cisco ASA5508 Threat Defense Threat and URL 5Y Subscription

L-ASA5508T-TM=

L-ASA5508T-TM-1Y

Cisco ASA5508 Threat Defense Threat and Malware Protection 1Y Subscription

L-ASA5508T-TM=

L-ASA5508T-TM-3Y

Cisco ASA5508 Threat Defense Threat and Malware Protection 3Y Subscription

L-ASA5508T-TM=

L-ASA5508T-TM-5Y

Cisco ASA5508 Threat Defense Threat and Malware Protection 5Y Subscription

L-ASA5508T-AMP=

L-ASA5508T-AMP-1Y

Cisco ASA5508 Threat Defense Malware Protection 1Y Subscription

L-ASA5508T-AMP=

L-ASA5508T-AMP-3Y

Cisco ASA5508 Threat Defense Malware Protection 3Y Subscription

L-ASA5508T-AMP=

L-ASA5508T-AMP-5Y

Cisco ASA5508 Threat Defense Malware Protection 5Y Subscription

Table 47.          Cisco Firepower Threat Defense software on ASA 5516-X SKUs

Cisco ASA 5516-X with Threat Defense Software Term License and Subscription SKUs

Term License

Term Subscription

Description

L-ASA5516T-TMC=

L-ASA5516T-TMC-1Y

Cisco ASA5516 Threat Defense Threat, Malware, and URL 1YR Subscription

L-ASA5516T-TMC=

L-ASA5516T-TMC-3Y

Cisco ASA5516 Threat Defense Threat, Malware, and URL 3YR Subscription

L-ASA5516T-TMC=

L-ASA5516T-TMC-5Y

Cisco ASA5516 Threat Defense Threat, Malware, and URL 5YR Subscription

L-ASA5516T-T=

L-ASA5516T-TP-1Y

Cisco ASA5516 Threat Defense Threat Protection 1YR Subscription

L-ASA5516T-T=

L-ASA5516T-TP-3Y

Cisco ASA5516 Threat Defense Threat Protection 3YR Subscription

L-ASA5516T-T=

L-ASA5516T-TP-5Y

Cisco ASA5516 Threat Defense Threat Protection 5YR Subscription

L-ASA5516T-URL=

L-ASA5516T-URL-1Y

Cisco ASA5516 Threat Defense URL Filtering 1YR Subscription

L-ASA5516T-URL=

L-ASA5516T-URL-3Y

Cisco ASA5516 Threat Defense URL Filtering 3YR Subscription

L-ASA5516T-URL=

L-ASA5516T-URL-5Y

Cisco ASA5516 Threat Defense URL Filtering 5YR Subscription

L-ASA5516T-TC=

L-ASA5516T-TC-1Y

Cisco ASA5516 Threat Defense Threat and URL 1Y Subscription

L-ASA5516T-TC=

L-ASA5516T-TC-3Y

Cisco ASA5516 Threat Defense Threat and URL 3Y Subscription

L-ASA5516T-TC=

L-ASA5516T-TC-5Y

Cisco ASA5516 Threat Defense Threat and URL 5Y Subscription

L-ASA5516T-TM=

L-ASA5516T-TM-1Y

Cisco ASA5516 Threat Defense Threat and Malware Protection 1Y Subscription

L-ASA5516T-TM=

L-ASA5516T-TM-3Y

Cisco ASA5516 Threat Defense Threat and Malware Protection 3Y Subscription

L-ASA5516T-TM=

L-ASA5516T-TM-5Y

Cisco ASA5516 Threat Defense Threat and Malware Protection 5Y Subscription

L-ASA5516T-AMP=

L-ASA5516T-AMP-1Y

Cisco ASA5516 Threat Defense Malware Protection 1Y Subscription

L-ASA5516T-AMP=

L-ASA5516T-AMP-3Y

Cisco ASA5516 Threat Defense Malware Protection 3Y Subscription

L-ASA5516T-AMP=

L-ASA5516T-AMP-5Y

Cisco ASA5516H Threat Defense Malware Protection 5Y Subscription

Table 48.          Cisco Firepower Threat Defense software on ASA 5525-X SKUs

Cisco ASA 5525-X with Threat Defense Software Term License and Subscription SKUs

Term License

Term Subscription

Description

L-ASA5525T-TMC=

L-ASA5525T-TMC-1Y

Cisco ASA5525 Threat Defense Threat, Malware, and URL 1YR Subscription

L-ASA5525T-TMC=

L-ASA5525T-TMC-3Y

Cisco ASA5525 Threat Defense Threat, Malware, and URL 3YR Subscription

L-ASA5525T-TMC=

L-ASA5525T-TMC-5Y

Cisco ASA5525 Threat Defense Threat, Malware, and URL 5YR Subscription

L-ASA5525T-T=

L-ASA5525T-TP-1Y

Cisco ASA5525 Threat Defense Threat Protection 1YR Subscription

L-ASA5525T-T=

L-ASA5525T-TP-3Y

Cisco ASA5525 Threat Defense Threat Protection 3YR Subscription

L-ASA5525T-T=

L-ASA5525T-TP-5Y

Cisco ASA5525 Threat Defense Threat Protection 5YR Subscription

L-ASA5525T-URL=

L-ASA5525T-URL-1Y

Cisco ASA5525 Threat Defense URL Filtering 1YR Subscription

L-ASA5525T-URL=

L-ASA5525T-URL-3Y

Cisco ASA5525 Threat Defense URL Filtering 3YR Subscription

L-ASA5525T-URL=

L-ASA5525T-URL-5Y

Cisco ASA5525 Threat Defense URL Filtering 5YR Subscription

L-ASA5525T-TC=

L-ASA5525T-TC-1Y

Cisco ASA5525 Threat Defense Threat and URL 1Y Subscription

L-ASA5525T-TC=

L-ASA5525T-TC-3Y

Cisco ASA5525 Threat Defense Threat and URL 3Y Subscription

L-ASA5525T-TC=

L-ASA5525T-TC-5Y

Cisco ASA5525 Threat Defense Threat and URL 5Y Subscription

L-ASA5525T-TM=

L-ASA5525T-TM-1Y

Cisco ASA5525 Threat Defense Threat and Malware Protection 1Y Subscription

L-ASA5525T-TM=

L-ASA5525T-TM-3Y

Cisco ASA5525 Threat Defense Threat and Malware Protection 3Y Subscription

L-ASA5525T-TM=

L-ASA5525T-TM-5Y

Cisco ASA5525 Threat Defense Threat and Malware Protection 5Y Subscription

L-ASA5525T-AMP=

L-ASA5525T-AMP-1Y

Cisco ASA5525 Threat Defense Malware Protection 1Y Subscription

L-ASA5525T-AMP=

L-ASA5525T-AMP-3Y

Cisco ASA5525 Threat Defense Malware Protection 3Y Subscription

L-ASA5525T-AMP=

L-ASA5525T-AMP-5Y

Cisco ASA5525 Threat Defense Malware Protection 5Y Subscription

Table 49.          Cisco Firepower Threat Defense software on ASA 5545-X SKUs

Cisco ASA 5545-X with Threat Defense Software Term License and Subscription SKUs

Term License

Term Subscription

Description

L-ASA5545T-TMC=

L-ASA5545T-TMC-1Y

Cisco ASA5545 Threat Defense Threat, Malware, and URL 1YR Subscription

L-ASA5545T-TMC=

L-ASA5545T-TMC-3Y

Cisco ASA5545 Threat Defense Threat, Malware, and URL 3YR Subscription

L-ASA5545T-TMC=

L-ASA5545T-TMC-5Y

Cisco ASA5545 Threat Defense Threat, Malware, and URL 5YR Subscription

L-ASA5545T-T=

L-ASA5545T-TP-1Y

Cisco ASA5545 Threat Defense Threat Protection 1YR Subscription

L-ASA5545T-T=

L-ASA5545T-TP-3Y

Cisco ASA5545 Threat Defense Threat Protection 3YR Subscription

L-ASA5545T-T=

L-ASA5545T-TP-5Y

Cisco ASA5545 Threat Defense Threat Protection 5YR Subscription

L-ASA5545T-URL=

L-ASA5545T-URL-1Y

Cisco ASA5545 Threat Defense URL Filtering 1YR Subscription

L-ASA5545T-URL=

L-ASA5545T-URL-3Y

Cisco ASA5545 Threat Defense URL Filtering 3YR Subscription

L-ASA5545T-URL=

L-ASA5545T-URL-5Y

Cisco ASA5545 Threat Defense URL Filtering 5YR Subscription

L-ASA5545T-TC=

L-ASA5545T-TC-1Y

Cisco ASA5545 Threat Defense Threat and URL 1Y Subscription

L-ASA5545T-TC=

L-ASA5545T-TC-3Y

Cisco ASA5545 Threat Defense Threat and URL 3Y Subscription

L-ASA5545T-TC=

L-ASA5545T-TC-5Y

Cisco ASA5545 Threat Defense Threat and URL 5Y Subscription

L-ASA5545T-TM=

L-ASA5545T-TM-1Y

Cisco ASA5545 Threat Defense Threat and Malware Protection 1Y Subscription

L-ASA5545T-TM=

L-ASA5545T-TM-3Y

Cisco ASA5545 Threat Defense Threat and Malware Protection 3Y Subscription

L-ASA5545T-TM=

L-ASA5545T-TM-5Y

Cisco ASA5545 Threat Defense Threat and Malware Protection 5Y Subscription

L-ASA5545T-AMP=

L-ASA5545T-AMP-1Y

Cisco ASA5545 Threat Defense Malware Protection 1Y Subscription

L-ASA5545T-AMP=

L-ASA5545T-AMP-3Y

Cisco ASA5545 Threat Defense Malware Protection 3Y Subscription

L-ASA5545T-AMP=

L-ASA5545T-AMP-5Y

Cisco ASA55245 Threat Defense Malware Protection 5Y Subscription

Table 50.          Cisco Firepower Threat Defense software on ASA 5555-X SKUs

Cisco ASA 5555-X with Firepower Threat Defense Software Term License and Subscription SKUs

Term License

Term Subscription

Description

L-ASA5555T-TMC=

L-ASA5555T-TMC-1Y

Cisco ASA5555 Threat Defense Threat, Malware, and URL 1YR Subscription

L-ASA5555T-TMC=

L-ASA5555T-TMC-3Y

Cisco ASA5555 Threat Defense Threat, Malware, and URL 3YR Subscription

L-ASA5555T-TMC=

L-ASA5555T-TMC-5Y

Cisco ASA5555 Threat Defense Threat, Malware, and URL 5YR Subscription

L-ASA5555T-T=

L-ASA5555T-TP-1Y

Cisco ASA5555 Threat Defense Threat Protection 1YR Subscription

L-ASA5555T-T=

L-ASA5555T-TP-3Y

Cisco ASA5555 Threat Defense Threat Protection 3YR Subscription

L-ASA5555T-T=

L-ASA5555T-TP-5Y

Cisco ASA5555 Threat Defense Threat Protection 5YR Subscription

L-ASA5555T-URL=

L-ASA5555T-URL-1Y

Cisco ASA5555 Threat Defense URL Filtering 1YR Subscription

L-ASA5555T-URL=

L-ASA5555T-URL-3Y

Cisco ASA5555 Threat Defense URL Filtering 3YR Subscription

L-ASA5555T-URL=

L-ASA5555T-URL-5Y

Cisco ASA5555 Threat Defense URL Filtering 5YR Subscription

L-ASA5555T-TC=

L-ASA5555T-TC-1Y

Cisco ASA5555 Threat Defense Threat and URL 1Y Subscription

L-ASA5555T-TC=

L-ASA5555T-TC-3Y

Cisco ASA5555 Threat Defense Threat and URL 3Y Subscription

L-ASA5555T-TC=

L-ASA5555T-TC-5Y

Cisco ASA5555 Threat Defense Threat and URL 5Y Subscription

L-ASA5555T-TM=

L-ASA5555T-TM-1Y

Cisco ASA5555 Threat Defense Threat and Malware Protection 1Y Subscription

L-ASA5555T-TM=

L-ASA5555T-TM-3Y

Cisco ASA5555 Threat Defense Threat and Malware Protection 3Y Subscription

L-ASA5555T-TM=

L-ASA5555T-TM-5Y

Cisco ASA5555 Threat Defense Threat and Malware Protection 5Y Subscription

L-ASA5555T-AMP=

L-ASA5555T-AMP-1Y

Cisco ASA5555 Threat Defense Malware Protection 1Y Subscription

L-ASA5555T-AMP=

L-ASA5555T-AMP-3Y

Cisco ASA5555 Threat Defense Malware Protection 3Y Subscription

L-ASA5555T-AMP=

L-ASA5555T-AMP-5Y

Cisco ASA5555 Threat Defense Malware Protection 5Y Subscription

SKUs and Ordering Guidance for Cisco ASA with FirePOWER Services

Cisco ASA with FirePOWER Services integrates FirePOWER Services’ threat-focused, next-generation security services with Cisco ASA 5500-X Series.

Cisco ASA with FirePOWER Services includes combinations of the following orderable components:

     Cisco ASA enterprise-class stateful firewall software, with site-to-site and remote-access VPN and advanced clustering capability for high-performance access and high availability that helps ensure business continuity (included).

     Application Visibility and Control (AVC) (included)

     Cisco ASA 5500-X Series appliances

     Cisco ASA 5500-X Series with FirePOWER Services

     Cisco ASA with FirePOWER Services optional subscriptions (1-year, 3-year, or 5-year term options)

     Cisco Firepower Next-Generation Intrusion Prevention System (NGIPS) (optional subscription)

     Reputation- and category-based URL Filtering (optional subscription)

     Advanced Malware Protection (AMP) and Threat Grid (optional subscription)

     Centralized management systems

     Cisco Firepower Management Center physical or virtual appliance

     Cisco Security Manager

     On-device management (included)

     Cisco Adaptive Security Manager (ASDM 7.3)

     Cisco Smart Net Total Care support services

     Cisco Software Application Support plus Upgrades (SASU)

FirePOWER Services licenses are enabled on the Cisco ASA 5500-X Series and Cisco ASA 5585-X appliances through the Management Center. Cisco ASDM manager is included on all ASA 5500-X Series appliances for local management and basic support of FirePOWER Services security functions (not supported on Cisco ASA 5585-X).

Cisco FirePOWER Services Subscriptions

One-year, 3-year, and 5-year subscriptions for each FirePOWER Service are available for Cisco ASA 5506-X, 5506W-X, 5506H-X, 5508-X, 5525-X, 5545-X, and 5555-X appliances:

     IPS subscription: The NGIPS license provides highly effective threat prevention and full contextual awareness of users, infrastructure, applications, and content to detect multivector threats and automate defense response. IPS licenses can be added alone to the base Cisco ASA with FirePOWER Services license or bundled with AMP, or AMP and URL Filtering licenses.

     URL Filtering subscription: The URL Filtering license adds the capability to filter more than 280 million top-level domains by risk level and more than 82 categories. The URL Filtering license can be added alone to the base Cisco ASA with FirePOWER Services license or as part of a bundle with the IPS or IPS and AMP licenses.

     AMP subscription: The Cisco AMP for ASA license delivers inline network protection against sophisticated malware and Cisco Threat Grid sandboxing. The AMP license option can be added to the Cisco ASA with FirePOWER Services base license or bundled with IPS or with IPS and URL Filtering licenses.

Five flexible subscription packaging options are available to tailor security according to your customer’s needs.

Available subscription-packaging options

Figure 9.         

Available subscription-packaging options

Table 51.          Software subscription SKU decoder

Code

Feature Description

TA

IPS and Apps Updates subscription (1-, 3-, and 5-year options)

TAC

IPS and Apps Updates plus URL Filtering subscription (1-, 3-, and 5-year options)

TAM

IPS and Apps Updates plus AMP subscription (1-, 3-, and 5-year options)

TAMC

IPS and Apps Updates plus URL Filtering and AMP subscription (1-, 3-, and 5-year options)

URL

URL Filtering subscription (1-, 3-, and 5-year options)

Purchase of a perpetual software license entitles a customer to activate the features on an associated Cisco ASA 5500-X Series platform only. For example, customers who buy a Cisco ASA 5515-X with FirePOWER Services and a 1-year IPS service subscription are entitled to apply the subscription to a single Cisco ASA 5515-X with FirePOWER Services appliance.

Following the completion of the term, the licenses will be deactivated unless they are renewed.

Cisco ASA with FirePOWER Services license for IPS and apps (NGFW) for a 3-year term

Figure 10.     

Example SKU: Cisco ASA with FirePOWER Services license for IPS and apps (NGFW) for a 3-year term

When customers order a subscription, they receive an activation key unique to that product. They use this key to generate a license to install the FirePOWER Services feature license on the appropriate virtual or physical Management Center appliance. Management Center controls and manages FirePOWER Services or Threat Defense software licenses and feature subscriptions.

The following table shows ordering information for a sample valid Cisco Commerce configuration for the Cisco ASA with FirePOWER Services appliance.

Table 52.          Cisco Commerce configuration for Cisco ASA with FirePOWER Services

Line Number

Item Name

Description

1.0

ASA5525-FPWR-BUN

ASA 5525-X with FirePOWER Services Chassis and Subs. Bundle

1.1

ASA5525-FPWR-K9

ASA 5525-X with FirePOWER Services 8 GE AC 3DES/AES SSD

1.1.0.1

CON-SNT-A25FPK9

Cisco Smart Net Total Care 8x5xNBD ASA 5525-X with FirePOWER Services, 8 GE

1.1.1

SF-ASA-X-9.2.2-K8

ASA 9.2.2 Software image for ASA 5500-X Series, ASA-SM

1.1.3

ASA5525-CTRL-LIC

Cisco ASA5525 Control License

1.1.4

CAB-AC

AC Power Cord (North America), C13, NEMA 5-15P, 2.1m

1.1.5

ASA-VPN-CLNT-K9

Cisco VPN Client Software (Windows, Solaris, Linux, Mac)

1.1.6

ASA5500-ENCR-K9

ASA 5500 Strong Encryption License (3DES/AES)

1.1.7

ASA-ANYCONN-CSD-K9

ASA 5500 AnyConnect Client + Cisco Security Desktop Software

1.1.8

ASA5500X-SSD120INC

ASA 5508-X through 5555-X 120 GB MLC SED SSD (Incl.)

1.1.9

ASA5525-MB

ASA 5525 IPS Part Number with which PCB Serial is associated

1.2

L-ASA5525-TAMC=

Cisco ASA5525 FirePOWER IPS AMP and URL Licenses

1.2.0.1

L-ASA5525-TAMC-3Y

Cisco ASA5525 FirePOWER IPS, AMP and URL 3YR Subs

2.0

FS750-K9

Cisco Firepower Management Center 750 Chassis 1 rack unit (1RU)

2.0.1

CON-SNT-FS750

Cisco Smart Net Total Care 8x5xNBD Firepower FS750

2.1

CAB-AC

AC Power Cord (North America) C13 NEMA 5-15P 2.1m

2.2

SF-FS5.2-K9

Cisco Firepower Management Center Software v5.2

2.3

FS750-Fpower-LIC

Cisco Firepower Management Center 750 Software License

2.3.0.1

CON-SAU-FS750

SASU Cisco Firepower 750

SKUs for All Cisco ASA with FirePOWER Services

The following tables provide ordering information for all Cisco ASA with FirePOWER Services appliances. The base hardware includes Cisco ASA firewall software, Cisco AVC functionality, and the Cisco ASDM.

Table 53.          Cisco ASA 5500-X Series with FirePOWER Services appliances SKUs

Cisco ASA with FirePOWER Services 5500-X Series Bundles (Hardware and Subscription)

Part Number

Product Description

ASA5508-FPWR-BUN

ASA 5508-X with FirePOWER Services Chassis and Subs. Bundle

ASA5516-FPWR-BUN

ASA 5516-X with FirePOWER Services Chassis and Subs. Bundle

ASA5525-FPWR-BUN

ASA 5525-X with FirePOWER Services Chassis and Subs. Bundle

ASA5545-FPWR-BUN

ASA 5545-X with FirePOWER Services Chassis and Subs. Bundle

ASA5555-FPWR-BUN

ASA 5555-X with FirePOWER Services Chassis and Subs. Bundle

Note:      The bundle (hardware and subscription) SKUs and Upgrade (UPG) SKUs offer a convenient mechanism for ordering both the appliances and software subscriptions in a single SKU configuration.

Upgrading ASA CX and IPS Customers to ASA with FirePOWER Services

Cisco ASA FirePOWER Services Upgrade (UPG) SKUs (include hardware, services subscriptions, and Management Center) offer a convenient mechanism for ordering Cisco ASA with FirePOWER services in an upgrade scenario where there is a Cisco ASA deployment already. It is the recommended mode to build customer configurations.

Table 54.          Upgrade from ASA CX or IPS