Cisco Secure Firewall 1230, 1240, and 1250 Hardware Installation Guide

Features

The Cisco Secure Firewall 1200 series is a family of network security appliances for enterprise branches. The appliances are powered by a network processor that delivers high performance and power efficiency in modern branch security workloads. The 1200 Series includes three 1U rack-mount models: 1230, 1240 and 1250. The Secure Firewall 1200 series supports Cisco Secure Firewall Threat Defense and Cisco Secure Firewall ASA software.

The following figure shows the Cisco Secure Firewall 1200 series chassis.

Figure 1. CSF-1230, CSF-1240, and CSF-1250

The following table lists the features for the Secure Firewall 1200 series.

Table 1. CSF-1230, CSF-1240, and CSF-1250 Features
Feature	CSF-1230	CSF-1240	CSF-1250
Form factor	1 RU
Mounting	Rack mount EIA-310D (19-inch) rack (2-post mounting)
Airflow	I/O side to non-I/O side with I/O side air intake Rear panel to front panel (cold aisle to hot aisle)
System memory	16 GB	32 GB
Management port	One 1-Gbps copper RJ-45 Gigabit Ethernet 10/100/1000 BaseT
Console ports	One Cisco Serial (RS-232 on RJ-45) One USB Type C 3.0 Provides management access through an external system; you cannot use both ports at the same time.
USB port	One USB 3.0 Type A Allows attachment of an external device such as mass storage
Network ports	Eight 1000BaseT		Eight 1000/2500BaseT
Small form-factor pluggable (SFP) ports	Four SFP+ (1/10Gbps) Port numbering is left to right, top to bottom; ports are named Gigabit Ethernet 1/9 through 1/12. Each port includes a pair of LEDs, one each for connection status and link status.
Supported SFPs	See Supported transceivers for a list of the supported SFPs.
Power switch	Located on the left side of the rear panel
Reset button	Small recessed button
AC power supply	One AC power supply Internal component only; not field-replaceable. You must return the chassis to Cisco for power supply replacement.
Redundant power	No
Fan	Two fixed fans Internal component only; not field-replaceable. You must return the chassis to Cisco for fan replacement.
Storage	One slot 960-GB U.2 NVME
Flash	Internal 16 GB eMMC The flash is not field-replaceable; you must return the chassis to Cisco for flash replacement.

Package contents

The following figure shows the package contents for the Secure Firewall 1230, 1240, and 1250. Note that the contents are subject to change, and your exact contents might contain additional or fewer items depending on what you ordered.


1	Chassis	2	Power cord Optional: in package if ordered
3	Eight 6-32 x 0.25-inch Phillips screws for securing the rack mount brackets to the chassis	4	Two rack-mount brackets
5	Cisco Secure Firewall 1230, 1240, and 1250 This document has links to the hardware installation guide, regulatory and safety information guide, and warranty and licensing information. It also contains a QR code and URL that point to the Digital Documentation Portal. The portal contains links to the product information page, the hardware installation guide, the regulatory and safety information guide, the getting started guide, and the zero-touch provisioning guide.	6	USB console cable (Type C) PID: CAB-CONS-USB-C Optional: in package if ordered

Pullout asset tag and compliance label

The pullout asset card on the front panel of the chassis contains the chassis model name, part number, serial number, the common language equipment identifier (CLEI), and the Digital Documentation Portal QR code that points to the getting started guide, the regulatory and compliance guide, the zero-touch deployment guide, and the hardware installation guide.

The following figure shows an example pullout asset card on the front panel of the chassis.


1	Pullout asset tab	2	Label
3	Digital Documentation Portal QR code	4	Chassis serial number

The following figure shows the location of the compliance label on the bottom of the chassis.


1	Front panel (I/O side)	2	Compliance label
3	Bottom of the chassis		—

The following figure shows a sample compliance label found on the bottom of the chassis.

Front panel

The following figure shows the front panel of the Secure Firewall 1230, 1240, and 1250.


1	Reset button	2	USB Type A
3	USB Type C console	4	Management port RJ-45
5	Eight 1000BASE-T (CSF-1230 and CSF-1240) or 2.5 G BASE-T (CSF-1250) Ethernet ports (numbered 1 through 8)	6	Four SFP+ ports (numbered 9 through 12)
7	RJ-45 (8P8C) console port	8	Status LEDs
9	Pullout asset tag	10	SSD LED
11	SSD slot		—

Power switch and reset button

Power switch

The power button is a rocker-type power on/off switch and is located on the rear panel.

Note

The power switch provides a way to gracefully shut down the system and place it in standby. Graceful shutdown reduces the risk of system software and data corruption. The power supply and fan remain active and the fan may continue to spin at slow speed. To achieve total power shut down, unplug the power supply from the chassis.

Caution

If you accidentally push the power switch to ON while unpacking your chassis, make sure the power switch is set to OFF before you connect AC power for the first time. The chassis powers on and boots up as soon as the AC power is applied when the power button is in the ON position.

Reset button

The chassis has a small recessed reset button on the left front panel that resets the system to the factory default. All previous configuration is erased after pressing the button down with a pin for five seconds. This resets the chassis to its default state following the next reboot.

Note

Configuration variables are reset to factory default, but the flash is not erased and no files are removed.

Management, console, USB, and network ports

Management port

The Secure Firewall 1230, 1240, and 1250 have one 1-Gbps Gigabit Ethernet RJ-45 10/100/1000 BaseT management port. It is restricted to network management access. To access the management port, connect with an RJ-45 cable.

Console ports

The chassis has two external console ports, a Cisco RJ-45 serial port and a Type C USB serial port. Only one serial console port can be active at a time. When a cable is plugged into the USB console port, the RJ-45 port becomes inactive. Conversely, when the USB cable is removed from the USB port, the RJ-45 port becomes active. The console ports do not have any hardware flow control. You can use the CLI to configure the chassis through either serial console port by using a terminal server or a terminal emulation program on a computer.

RJ-45 (8P8C) port—Supports RS-232 signaling to an internal UART controller. The RJ-45 console port does not support a remote dial-in modem. You can use an adapter to convert the RJ45-to-DB9 connection if necessary.
Type C USB port—Lets you connect to a USB port on an external computer. You can plug and unplug the USB cable from the console port without affecting Windows HyperTerminal operations. We recommend shielded USB cables with properly terminated shields. The default setting is 9600 baud. Use this for the initial connection. Baud rates for the USB console port are 1200, 2400, 4800, 9600, 19200, 38400, 57600, and 115200 bps.

USB Type A port

The chassis contains a standard USB 3.0 Type A port for an external USB drive that you can use for the startup image, configuration, backup and other standard uses for flash storage.

Supports EXT2/3/4 or VFAT/FAT32 format
Identified as the following drive ID depending on the CLI:
- FxOS local-mgmt—usbdrive:
- FxOS—usbA:
- ASA and Firewall Threat Defense—disk1:
- ROMMON—usb:
Output power of 5 volts, up to a maximum of 1 A (5 USB power units)

The Type A USB port does not support Cisco Secure Package (CSP) image upload support.

Network ports

The Secure Firewall 1230 and 1240 have eight 1000 BaseT ports. The Secure Firewall 1250 has eight 1000/2500 BaseT ports. The ports are numbered (from top to bottom, left to right) 1, 2, 3, 4, 5, 6, 7, 8. Each port includes a pair of LEDs, one each for connection status and link status. The ports are named and numbered Gigabit Ethernet 1/1 through Gigabit Ethernet 1/8.

Each RJ-45 (8P8C) copper port supports auto Medium Dependent Interface Crossover (MDI/X) as well as auto-negotiation for interface speed, duplex, and other negotiated parameters, and are MDI/X-compliant.

Front panel LEDs

The following figure shows the LEDs on the front panel of the Secure Firewall 1230, 1240, and 1250 and describes their states.


1	Management Status of the management ports: Link status (L): Off—No link, or port is not in use. Green—Link established. Green, flashing—Link activity.	2	Management Status of the management ports: Connection-speed status (S): Green, flashing—One flash every three seconds = 10 Mbps. Green, flashing—Two rapid flashes = 100 Mbps. Green, flashing—Three rapid flashes = 1000 Mbps.
3	Network Status of the network ports (applies to CSF-1230 and CSG-1240): Link status (L): Off—No link, or port is not in use. Green—Link established. Green, flashing—Link activity. Status of the network ports (applies to CSF-1250): Link status (L): Off—No link, or port is not in use. Green, flashing—Link activity.	4	Network Status of the network ports (applies to CSF-1230 and CAF-1240): Connection-speed status (S): Green, flashing—One flash every three seconds = 10 Mbps. Green, flashing—Two rapid flashes = 100 Mbps. Green, flashing—Three rapid flashes = 1000 Mbps. Status of the network ports (applies to CSF-1250): Connection-speed status (S): Off—No link, or port is not in use. Green—Link established
5	Power Power supply status: Off —Power supply off. Green—Power supply on. Amber—System is powering up or system firmware is updating. Green, flashing—System in process of a graceful shutdown.	6	System System operating status: Off—System has not booted up yet. Green, flashing—System is booting up. Green—System has booted up; normal system function. Amber—System failed to boot. Amber, flashing—Boot failed.
7	Active Status of the failover pair: Off—System is in standby mode. Green—System is in active mode.	8	Managed Cloud connection status for zero-touch provisioning: Green, flashing slowly (twice in five seconds)—Connected to the Cisco cloud and ready for onboarding. Green and amber, flashing—Cloud connection failure. Green—Onboarded.
9	Alarm Status of the alarms: Off—No alarms. Yellow—Power supply, temperature too high, and/or fan failures.	10	SSD Status of the SSD: Off— No SSD present. Green—SSD detected. Green, flashing—Activity on the SSD.

Rear panel

The following figure shows the rear panel of the Secure Firewall 1230, 1240, and 1250.


1	Power switch	2	Power cord socket
3	Internal fan	4	Internal fan
5	Grounding lug pad		—

Hardware specifications

The following table contains hardware specifications for the Secure Firewall 1200 series.

Table 2. CSF-1230, CSF-1240, and CSF-1250 hardware specifications
Specification	CSF-1230	CSF-1240	CSF-1250
Dimensions (H x W x D)	1.72 x 11.22 x 17.25 inches (4.37 x 28.49 x 43.81 cm)
Weight	9.35 lb (4.24 kg)		9.52 lb (4.31 kg)
Temperature	Operating: 32 to 104°F (0 to 40°C) Nonoperating: -13 to 158°F (-25 to 70°C) maximum altitude is 15,000 ft
Humidity	Operating: 5 to 85% noncondensing Nonoperating: 5 to 95% noncondensing
Altitude	Operating: 0 to 10,000 ft (0 to 3048 m) Nonoperating: 0 to 15,000 ft (0 to 4572 m)
Acoustic noise (10,000 ft and 40°C)	52.1 dBa (maximum) At highest system performance	57.8 dBa (maximum) At highest system performance
Power consumption (maximum)	57 W	69 W	88 W

Supported transceivers

The SFP transceiver is a bidirectional device with a transmitter and receiver in the same physical package. It is a hot-swappable optical or electrical (copper) interface that plugs into the SFP ports on the fixed ports and the network module ports, and provides Ethernet connectivity.

The following figure shows the components of a transceiver.


1	Dust plug	2	Bail clasp
3	Receive optical bore	4	Transmit optical bore

Safety warnings

Take note of the following warnings:

Warning

Statement 1055—Class 1/1M Laser

Invisible laser radiation is present. Do not expose to users of telescopic optics. This applies to Class 1/1M laser products.

Warning

Statement 1056—Unterminated Fiber Cable

Invisible laser radiation may be emitted from the end of the unterminated fiber cable or connector. Do not view directly with optical instruments. Viewing the laser output with certain optical instruments, for example, eye loupes, magnifiers, and microscopes, within a distance of 100 mm, may pose an eye hazard.

Warning

Statement 1057—Hazardous Radiation Exposure

Use of controls, adjustments, or performance of procedures other than those specified may result in hazardous radiation exposure.

Warning

Use appropriate ESD procedures when inserting the transceiver. Avoid touching the contacts at the rear, and keep the contacts and ports free of dust and dirt. Keep unused transceivers in the ESD packing that they were shipped in.

Caution

Although non-Cisco SFPs are allowed, we do not recommend using them because they have not been tested and validated by Cisco. Cisco TAC may refuse support for any interoperability problems that result from using an untested third-party SFP transceiver.

The following table lists the SFPs that are supported on the Secure Firewall 1230, 1240, and 1250 fixed ports.

Table 3. CSF-1230, CSF-1240, and CSF-1250 fixed ports
Port type	Transceiver PID	First supported release
Fixed SFP ports	GLC-TE GLC-SX-MMD GLC-LH-SMD GLC-EX-SMD GLC-ZX-SMD GLC-GE-100FX	Firewall Threat Defense 7.7/ASA 9.23

The following table lists the SFPs that are supported on the Secure Firewall 1230, 1240, and 1250 fixed ports.

Table 4. CSF-1230, CSF-1240, and CSF-1250 fixed ports
Port type	Transceiver PID	First supported release
Fixed SFP ports	SFP-10G-SR SFP-10G-SR-S SFP-10G-LR SFP-10G-LR-S SFP-10G-ER SFP-10G-ER-S SFP-10G-T-X SFP-H10GB-CUxM SFP-H10GB-ACUxM SFP-10G-AOCxM	Firewall Threat Defense 7.7/ASA 9.23

Product ID numbers

The following table lists the field-replaceable PIDs associated with the Secure Firewall 1230, 1240, and 1250. The spare components are ones that you can order separately from the appliance. If any internal components fail, you must get a return material authorization (RMA) for the entire chassis.

Note

Use the show inventory command to display a list of the PIDs for your Secure Firewall 1230, 1240, and 1250.

Table 5. CSF-1230, CSF-1240, and CSF-1250 PIDs
PID	Description
CSF1230-ASA-K9	Secure Firewall 1230 appliance, ASA
CSF1240-ASA-K9	Secure Firewall 1240 appliance, ASA
CSF1250-ASA-K9	Secure Firewall 1250 appliance, ASA
CSF1230-TD-K9	Secure Firewall 1230 appliance, Threat Defense
CSF1240-TD-K9	Secure Firewall 1240 appliance, Threat Defense
CSF1250-TD-K9	Secure Firewall 1250 appliance, Threat Defense
CSF1200-SSD960	Secure Firewall 1230, 1240, and 1250 960-GB SSD
CSF1200-SSD960=	Secure Firewall 1230, 1240, and 1250 960-GB SSD (spare)
CSF1200-CBL-MGMT	Secure Firewall 1230, 1240, and 1250 cable-management brackets
CSF1200-CBL-MGMT=	Secure Firewall 1230, 1240, and 1250 cable-management brackets (spare)
CSF1200-BRKT=	Secure Firewall 1230, 1240, and 1250 rack-mount brackets (spare)

Power Cord Specifications

Standard power cords or jumper power cords are available for connection to the security appliance. The jumper power cords for use in racks are available as an optional alternative to the standard power cords.

If you do not order the optional power cord with the system, you are responsible for selecting the appropriate power cord for the product. Using a incompatible power cord with this product may result in electrical safety hazard.

Note

Only the approved power cords or jumper power cords provided with the chassis are supported.

The following power cords are supported.


1	Plug: VA2073	2	Cord set rating: 10 A, 250 V
3	Connector: V1625		—

Figure 11. Australia/New Zealand (CAB-ACA)


1	Plug: AU10LS3	2	Cord set rating: 10 A, 250 V
3	Connector: V1625		—


1	Plug: NBR 14136	2	Cord set rating: 10 A, 250 V
3	Connector: EL 701B (EN 60320/C13)		—


1	Plug: V3203C	2	Cord set rating: 10 A, 250 V
3	Connector: V1625		—


1	Plug: M2511	2	Cord set rating: 16 A, 250 V
3	Connector: V1625		—


1	Plug: IA16A3-C	2	Cord set rating: 16 A, 250 V
3	Connector: V1625BS-E		—


1	Plug: IT10S3	2	Cord set rating: 10 A, 250 V
3	Connector: V1625		—

Figure 17. Japan (CAB-C13-C14-2M-JP) PSE mark


1	IEC 60320-2-2/E	2	Cord set rating: 10 A, 250 V
3	Connector: IEC 60320/C13		—


1	Plug: M744	2	Cord set rating: 12 A, 125 V
3	Connector: V1625		—


1	Plug: M2511	2	Cord set rating: 10 A, 250 V
3	Connector: V1625		—


1	Plug: PS204	2	Cord set rating: 10 A, 250 V
3	Connector: V1625		—


1	IEC 60320/C14G	2	Cord set rating: 10 A, 250 V
3	Connector: IEC 60320/C13		—

Figure 22. South Africa (AIR-PWR-CORD-SA)


1	Plug: SA16A	2	Cord set rating: 10 A, 250 V
3	Connector: V1625		—


1	Plug: SW10ZS3	2	Cord set rating: 10 A, 250 V
3	Connector: V1625		—

Taiwan (CAB-AC-TAI) — Figure 24. Taiwan **(CAB-AC-TAI)**


1	Plug: CNS 10917-2	2	Cord set rating: 10 A, 125 V
3	Connector: IEC 60320/C15		—


1	Plug: 3P BS 1363	2	Cord set rating: 10 A, 250 V
3	Connector: IEC 60320/C13		—

Bias-Free Language

Book Title

Overview

Results

Chapter: Overview

Overview

Features

Package contents

Pullout asset tag and compliance label

Front panel

Power switch and reset button

Management, console, USB, and network ports

Front panel LEDs

Rear panel

Hardware specifications

Supported transceivers

Product ID numbers

Power Cord Specifications

Was this Document Helpful?

Contact Cisco