The Cisco Secure Firewall 200 series is a cost-effective, highly efficient addition to our low-end firewall family. It is designed for enterprise branches, retail businesses, and small locations, and offers robust, affordable security with advanced threat intelligence, cloud security features, and optimized performance for comprehensive enterprise-grade protection.

The Secure Firewall 220 is a compact network security appliance in the Cisco Secure Firewall family. It is first supported in Cisco Secure Firewall Threat Defense Version 10.0.0 and Cisco Secure ASA Version 9.24.1.

See the Cisco Secure Firewall Threat Defense Compatibility Guide and Cisco Secure Firewall ASA Compatibility, which provide Cisco Firewall software and hardware compatibility, including operating system and hosting environment requirements, for each supported Firewall version.

The following figure shows the Secure Firewall 220.

The following table lists the features for the Secure Firewall 220.

You can find the Kensington lock on the left side of the rear panel (I/O) side of the chassis. It accepts a standard Kensington T-bar locking mechanism for securing the chassis.

The following figure shows the location.

The compliance label on the bottom of the chassis contains the chassis serial number, regulatory compliance marks, and the Digital Documentation Portal QR code that points to the getting started guide, the regulatory and compliance guide, the zero-touch provisioning guide, and the hardware installation guide.

The following figure shows an example compliance label found on the bottom of the chassis.

The Do Not Stack label is on the top of the chassis cover. The following figure shows the Do Not Stack label.

The Hot System warning label is on the rack-mount tray as seen in the following figure.

Management port

The Secure Firewall 220 series chassis has one 1-Gbps Cisco RJ-45 management port. It is restricted to network management access; connect with an RJ-45 cable.

RJ-45 console ports

The Secure Frirewall 200 series has two external console ports, a Cisco RJ-45 serial port and a Type C USB serial port. Only one console port can be active at a time. When a cable is plugged into the USB console port, the RJ-45 port becomes inactive. Conversely, when the USB cable is removed from the USB port, the RJ-45 port becomes active. The console ports do not have any hardware flow control. You can use the CLI to configure the chassis through either serial console port by using a terminal server or a terminal emulation program on a computer.

• RJ-45 (8P8C) port—Supports RS-232 signaling to an internal UART controller. The RJ-45 console port does not support a remote dial-in modem. You can use an adapter to convert the RJ45-to-DB9 connection if necessary.

• Type C USB port—Lets you connect to a USB port on an external computer. You can plug and unplug the USB cable from the console port without affecting Windows HyperTerminal operations. We recommend shielded USB cables with properly terminated shields. The default setting is 9600 baud. Use this for the initial connection. Baud rates for the USB console port are 1200, 2400, 4800, 9600, 19200, 38400, 57600, and 115200 bps.

Type A USB 3.0 port

The chassis provides a USB 3.0 Type A port that you can use to attach an external device. The USB port can provide output power of 5 V, and up to a maximum of 0.5 A, and 2.5 W of power.

• External USB drive (optional)—You can use the external USB Type A port to attach a data-storage device. The external USB drive identifier is disk1. When the chassis is powered on, a connected USB drive is mounted as disk1 and is available for you to use. Additionally, the file-system commands that are available to disk0 are also available to disk1, including copy, format, delete, mkdir, pwd, cd, and so on.

• FAT-32 File System—The Secure Firewall 200 series only supports FAT-32-formatted file systems for the external USB drive. If you insert an external USB drive that is not in FAT-32 format, the system mounting process fails, and you receive an error message. You can enter the command format disk1: to format the partition to FAT-32 and mount the partition to disk1 again; however, data might be lost.

Power button

The push power button is located on the the left side of the rear panel. It controls power to the system. When the AC power is first turned on, you do not have to press the power button because the system turns on by default. The system is OFF when the button is sticking out and ON when the button is pushed in. During the shutdown process the power LED flashes green indicating that the process has started. Once the shutdown is complete, the system is powered off. Wait for the system power LEDs to turn off before unplugging the AC power cables. See for a detailed description of the power status LED.

At the ROMMON or FX-OS prompt:

• Press the power button for 5 seconds and release it to initiate a power cycle. The power LED flashes green at a rate of 2 Hz.

• Press the power button for 15 seconds and release it to initiate a graceful shutdown. The power LED flashes green at a rate of 10 Hz.

Note	Threat Defense requires a graceful shutdown. See the Getting Started Guide for the procedure.

Caution

If you remove the system power cords before the graceful shutdown is complete, disk corruption can occur. You can move the power switch to OFF before the shutdown. The system ignores it.

Note	After removing power from the chassis by unplugging the power cord, wait at least 10 seconds before turning power back ON. You want to keep the system power off, including the standby power, for 10 seconds.

Factory reset button

The chassis has a recessed reset button that resets the system to the factory default. Push and hold the button down with a pin for five seconds resets the chassis to its default state following the next reboot.

Note	Use the reset button if the current credentials are lost and you want to initialize the box without having console access.

Note	Configuration variables are reset to factory default, but the flash is not erased and no files are removed.

Note	If power is lost between when you pushed the reset button and when the reset process is complete, the process stops and you have to push the button again after the system powers back on.

The LEDs are found on the rear panel of the Secure Firewall 220.

The following figure shows the LEDs on the rear panel of the Secure Firewall 220 and describes their states.

The following table contains hardware specifications for the Secure Firewall 220.

The following table lists the field-replaceable PIDs associated with the Secure Firewall 220 compact appliance. The spare components are ones that you can order separately from the appliance. If any internal components fail, you must get a return material authorization (RMA) for the entire chassis. See the Cisco Returns Portal for more information.

Note	See the show inventory command in the Cisco Secure Firewall Threat Defense Command Reference or the Cisco Secure Firewall ASA Series Command Reference to display a list of the PIDs for your Secure Firewall 220.