The Cisco Secure Firewall 200 series is a cost-effective, highly efficient addition to our low-end firewall family. It is designed for enterprise branches, retail businesses, and small locations, and offers robust, affordable security with advanced threat intelligence, cloud security features, and optimized performance for comprehensive enterprise-grade protection. The Cisco Secure Firewall 220 is a compact network security appliance in the Cisco Secure Firewall family.The Cisco Secure Firewall 200 series supports Cisco Secure Firewall Threat Defense and Cisco Secure ASA software.

The following figure shows the Secure Firewall 220.

The following table lists the features for the Secure Firewall 220.

The chassis has a Kensington lock that accepts a standard Kensington T-bar locking mechanism for securing the chassis.

The following figure shows the location of the Kensington lock on the CSF-220.

The compliance label on the bottom of the chassis contains the chassis serial number, regulatory compliance marks, and the Digital Documentation Portal QR code that points to the getting started guide, the regulatory and compliance guide, the zero-touch provisioning guide, and the hardware installation guide.

The following figure shows an example compliance label found on the bottom of the CSF-220 chassis.

The Do Not Stack label is on the top of the chassis cover. The following figure shows the Do Not Stack label.

The Hot System warning label is on the rack-mount tray as seen in the following figure.

Management port

The Secure Firewall 200 series chassis has one 1-Gbps Cisco RJ-45 management port. It is restricted to network management access. Connect to the management port with an RJ-45 cable.

Console ports

The chassis has two external console ports, a Cisco RJ-45 serial port and a Type C USB serial port, which provide management access through an external system. Only one console port can be active at a time. When a cable is plugged into the USB console port, the RJ-45 port becomes inactive. Conversely, when the USB cable is removed from the USB port, the RJ-45 port becomes active. The console ports do not have any hardware flow control. You can use the CLI to configure the chassis through either serial console port by using a terminal server or a terminal emulation program on a computer.

• RJ-45 (8P8C) port—Supports RS-232 signaling to an internal UART controller. The RJ-45 console port does not support a remote dial-in modem. You can use an adapter to convert the RJ45-to-DB9 connection if necessary.

• Type C USB port—Lets you connect to a USB port on an external computer. You can plug and unplug the USB cable from the console port without affecting Windows HyperTerminal operations. We recommend shielded USB cables with properly terminated shields. The default setting is 9600 baud. Use this for the initial connection. Baud rates for the USB console port are 1200, 2400, 4800, 9600, 19200, 38400, 57600, and 115200 bps.

USB Type A port

The chassis contains a standard USB 3.0 Type A port for an external USB drive that you can use for the startup image, configuration, backup and other standard uses for flash storage.

• Supports EXT2/3/4 or VFAT/FAT32 format

• Identified as the following drive ID depending on the CLI:

  • FxOS local-mgmt—usbdrive:

  • FxOS—usbA:

  • ASA and Firewall Threat Defense—disk1:

  • ROMMON—usb:

• Output power of 5 volts, up to a maximum of 0.5 A (2.5 USB power units)

The Type A USB port does not support Cisco Secure Package (CSP) image upload support.

Network ports

The chassis has four 1-Gbps RJ-45 Gigabit Ethernet (1G/100M/10M Auto Duplex Auto MDI-X Base-T interfaces) ports. The ports are numbered Ethernet 1/1 to Ethernet 1/4. Each port includes a pair of LEDs, one each for connection status and link status. The ports are named and numbered Gigabit Ethernet 1/1 through Gigabit Ethernet 1/4.

Each RJ-45 (8P8C) copper port supports auto Medium Dependent Interface Crossover (MDI/X) as well as auto-negotiation for interface speed, duplex, and other negotiated parameters, and are MDI/X-compliant.

Power button

The push power button is located on the rear panel. It controls power to the system. When the AC power is first turned on, you do not have to press the power button because the system turns on by default. The system is OFF when the button is sticking out and ON when the button is pushed in. During the shutdown process the power LED flashes green indicating that the process has started. Once the shutdown is complete, the system is powered off. Wait for the system power LEDs to turn off before unplugging the AC power cables.

At the ROMMON or FX-OS prompt:

• Press the power button for 5 seconds and release it to initiate a power cycle. The power LED flashes green at a rate of 2 Hz.

• Press the power button for 15 seconds and release it to initiate a graceful shutdown. The power LED flashes green at a rate of 10 Hz.

Note	Firewall Threat Defense requires a graceful shutdown.

Caution

If you remove the system power cords before the graceful shutdown is complete, disk corruption can occur. You can move the power switch to OFF before the shutdown. The system ignores it.

Note	After removing power from the chassis by unplugging the power cord, wait at least 10 seconds before turning power back ON. You want to keep the system power off, including the standby power, for 10 seconds.

Factory reset button

The chassis has a recessed reset button that resets the system to the factory default. Pushing and holding the button down with a pin for five seconds resets the chassis to its default state following the next reboot. You can use the reset button if the current credentials are lost and you want to initialize the box without having console access.

Note	Configuration variables are reset to factory default, but the flash is not erased and no files are removed.

Note	If power is lost between when you pushed the reset button and when the reset process is complete, the process stops and you have to push the button again after the system powers back on.

The LEDs are found on the rear panel of the Secure Firewall 200 series.

The following figure shows the LEDs on the rear panel of the Secure Firewall 220 and describes their states.

The following table contains hardware specifications for the Secure Firewall 220.

The following table lists the field-replaceable product IDs (PIDs) associated with the Secure Firewall 220 compact appliance. You can order the spare components and replace them yourself. If any internal components fail, you must get a return material authorization (RMA) for the entire chassis.

Note	Use the show inventory command to display a list of the PIDs for your Secure Firewall 220.