Cisco Firepower 9300 License

  • Technical Support
  • Last updated on: 07 Jan 2020

Cisco Firepower 9300 Series appliances

The Cisco Firepower 9300 is a scalable (beyond 1 Tbps when clustered), carrier-grade, modular platform designed for service providers, high-performance computing centers, large data centers, campuses, high-frequency trading environments, and other environments that require low (less than 5-microsecond offload) latency and exceptional throughput. Cisco Firepower 9300 supports flow-offloading, programmatic orchestration, and the management of security services with RESTful APIs. It is also available in Network Equipment Building Standards (NEBS)-compliant configurations. The 9300 Series platforms can run either the Cisco Adaptive Security Appliance (ASA) Firewall or Cisco Firepower Threat Defense (FTD).

Model overview

Cisco Firepower 9300 License

Cisco Firepower 9300 Series summary

Cisco Firepower 9300 Series summary

ModelFirewallNGFWNext-Generation Intrusion Prevention System (NGIPS)InterfacesOptional interfaces
SM-2475G21G30G8 x SFP+ on-chassis2 x NM’s: 1/10/40/100G, FTW
SM-3680G29G37G8 x SFP+ on-chassis2 x NM’s: 1/10/40/100G, FTW
SM-40(New)80G48G57G8 x SFP+ on-chassis2 x NMs: 1/10/40/100G, FTW
SM-4480G43G57G8 x SFP+ on-chassis2 x NM’s: 1/10/40/100G, FTW
SM-44 x 3234G132G148G8 x SFP+ on-chassis2 x NM’s: 1/10/40/100G, FTW
SM-48(New)80G55G65G8 x SFP+ on-chassis2 x NMs: 1/10/40/100G, FTW
SM-56(New)80G64G73G8 x SFP+ on-chassis2 x NMs: 1/10/40/100G, FTW
SM-56 x 3235G153G175G8 x SFP+ on-chassis2 x NMs: 1/10/40/100G, FTW

Detailed performance specifications and feature highlights

Table 1. Performance specifications and feature highlights for Cisco Firepower 9300 with the Cisco Firepower Threat Defense image

Detailed performance specifications and feature highlights

FeaturesSM-24SM-36SM-40SM-443 x SM-44SM-48SM-563 x SM-56
Throughput: Firewall (FW) + Application Visibility and Control (AVC) (1024B)25 Gbps34 Gbps54 Gbps50 Gbps148 Gbps64 Gbps70 Gbps168 Gbps
Throughput: FW + AVC + Intrusion Prevention System (IPS (1024B)21 Gbps29 Gbps48 Gbps43 Gbps132 Gbps55 Gbps64 Gbps153 Gbps
Maximum concurrent sessions, with AVC30 million30 million35 million30 million63 million35 million35 million60 million
Maximum new connections per second, with AVC130K185K380K295K850K450K490K1.1M
TLS (Hardware Decryption)27.5 Gbps8.5 Gbps10 Gbps10 Gbps25 Gbps11 Gbps12 Gbps28 Gbps
Throughput: NGIPS (1024B)30 Gbps37 Gbps57 Gbps57 Gbps148 Gbps66 Gbps73 Gbps175 Gbps
IPSec VPN throughput (1024B TCP w/Fastpath)13.5 Gbps16 Gbps20 Gbps17 Gbps51 Gbps25 Gbps27 Gbps81 Gbps1
Maximum VPN Peers20,00020,00020,00020,00060,00020,00020,00060,000
Centralized managementCentralized configuration, logging, monitoring, and reporting are performed by the Management Center or alternatively in the cloud with Cisco Defense Orchestrator
AVCStandard, supporting more than 4000 applications, as well as geolocations, users, and websites
AVC: OpenAppID support for custom, open-source application detectorsStandard
Cisco Security IntelligenceStandard, with IP, URL, and DNS threat intelligence
Cisco Firepower NGIPSAvailable; can passively detect endpoints and infrastructure for threat correlation and Indicators of Compromise (IoC) intelligence
Cisco Advanced Malware Protection (AMP) for NetworksAvailable; enables detection, blocking, tracking, analysis, and containment of targeted and persistent malware, addressing the attack continuum both during and after attacks. Integrated threat correlation with Cisco AMP for Endpoints is also optionally available
Cisco AMP Threat Grid sandboxingAvailable
URL filtering: number of categoriesMore than 80
URL filtering: number of URLs categorizedMore than 280 million
Automated threat feed and IPS signature updatesYes: class-leading Collective Security Intelligence (CSI) from the Cisco Talos® group (https://www.cisco.com/c/en/us/products/security/talos.html)
Third-party and open-source ecosystemOpen API for integrations with third-party products; Snort® and OpenAppID community resources for new and specific threats
High availability and clusteringActive/standby; for Cisco Firepower 9300 intrachassis clustering of up to 5 chassis is allowed
Cisco Trust Anchor TechnologiesCisco Firepower 9300 Series platforms include Trust Anchor Technologies for supply chain and software image assurance.

Note: Performance will vary depending on features activated, and network traffic protocol mix, and packet size characteristics. Performance is subject to change with new software releases. Consult your Cisco representative for detailed sizing guidance.

Table 2. ASA performance and capabilities on Cisco Firepower 9300

ASA performance and capabilities on Cisco Firepower 9300

FeaturesSM-24SM-36SM-40SM-443 x SM-44SM-48SM-563 x SM-56
Stateful inspection firewall throughput175 Gbps80 Gbps80 Gbps80 Gbps234 Gbps80 Gbps80 Gbps235 Gbps
Stateful inspection firewall throughput (multiprotocol)250 Gbps60 Gbps55 Gbps60 Gbps130 Gbps60 Gbps64 Gbps172 Gbps
Concurrent firewall connections55 million60 million55 million60 million70 million60 million60 million195 million
Firewall latency (UDP 64B microseconds)3.53.53.53.53.53.53.53.5
New connections per second800,0001.2 million1.6 million1.8 million4 million1.8 million2 million4.75 million
IPsec VPN throughput (450B UDP L2L test)15 Gbps18 Gbps25 Gbps20 Gbps60 Gbps327 Gbps30 Gbps74 Gbps
Maximum VPN Peers20,00020,00020,00020,00060,00020,00020,00060,000
Security contexts (included; maximum)10; 250
High availabilityActive/active and active/standby
ClusteringUp to 5 appliances with 3 security modules each
ScalabilityVPN load balancing, firewall clustering
Centralized managementCentralized configuration, logging, monitoring, and reporting are performed by Cisco Security Manager or alternatively in the cloud with Cisco Defense Orchestrator
Adaptive Security Device ManagerWeb-based, local management for small-scale deployments

Hardware specifications

Table 3. Cisco Firepower 9300 Series hardware specifications

Cisco Firepower 9300 Series hardware specifications

SpecificationDescription
Dimensions (H x W x D)5.25 x 17.5 x 32 in. (13.3 x 44.5 x 81.3 cm)
Form factor3 Rack Units (3RU), fits standard 19-in. (48.3-cm) square-hole rack
Security module slots3
Network module slots2 (within supervisor)
SupervisorCisco Firepower 9000 Supervisor with 8 x 10 Gigabit Ethernet ports and 2 network module slots for I/O expansion
Security modules●  Cisco Firepower 9000 Security Module 40 with 2 x SSDs in RAID-1 configuration

●  Cisco Firepower 9000 Security Module 48 with 2 x SSDs in RAID-1 configuration

●  Cisco Firepower 9000 Security Module 56 with 2 x SSDs in RAID-1 configuration

Network modules (2 module slots per chassis)●  8 x 10 Gigabit Ethernet Enhanced Small Form-Factor Pluggable (SFP+) network modules

●  4 x 40 Gigabit Ethernet Quad SFP+ network modules

●  2 x 100 Gigabit Ethernet Quad SFP28 network modules

●  4 x 100 Gigabit Ethernet Quad SFP28 network modules

Note: Cisco Firepower 9300 may also be deployed as a dedicated threat sensor, with fail-to-wire network modules. Please contact your Cisco representative for details.

Maximum number of interfacesUp to 24 x 10 Gigabit Ethernet (SFP+) interfaces; up to 8 x 40 Gigabit Ethernet (QSFP+) interfaces with 2 network modules; up to 8 x 100 Gigabit Ethernet interfaces with two network modules
Integrated network management ports1 x Gigabit Ethernet copper port (on supervisor)
Serial port1 x RJ-45 console
USB1 x USB 2.0
StorageUp to 4.8 TB per chassis (1.6 TB per security module in RAID-1 configuration)
Power supplies AC power supply-48V DC power supplyHVDC power supply
Input voltage200 to 240V AC-40V to -60V DC*240 to 380V DC
Maximum input current15.5A to 12.9A69A to 42A<14A at 200V
Maximum output power2500W2500W2500W
Frequency50 to 60 Hz
Efficiency (at 50% load)92%92%92% (at 50% load)
Redundancy1+1
Fans4 hot-swappable fans
Noise75.5 dBA at maximum fan speed
Rack mountableYes, mount rails included (4-post EIA-310-D rack)
Weight105 lb (47.7 kg) with one security module; 135 lb (61.2 kg) fully configured
Temperature: standard operatingUp to 10,000 ft (3000 M): 32 to 104°F (0 to 40°C) for SM-24 module

32 to 88°F (0 to 35°C) for SM-36 module at sea level

Altitude adjustment notes:

For SM-36, maximum temp is 35°C, for every 1000 feet above sea level subtract 1°C

Temperature: NEBS operatingLong term: 0 to 45°C, up to 6,000 ft (1829 m) Long term: 0 to 35°C, 6,000 to 13,000 ft (1829-3964 m) Short term: -5 to 55°C, up to 6,000 ft (1829 m)

Note: Cisco Firepower 9300 NEBS compliance applies only to SM-24,SM-40,SM-44 and SM-48 configurations.

Temperature: nonoperating-40 to 149°F (-40 to 65°C); maximum altitude is 40,000 ft
Humidity: operating5 to 95% noncondensing
Humidity: nonoperating5 to 95% noncondensing
Altitude: operatingSM-24: 0 to 13,000 ft (3962 m)

SM-36: 0 to 10,000 ft (3048 m); please see above Operating Temperature section for temperature adjustment notes

Altitude: nonoperating40,000 ft (12,192 m)

Table 4. Cisco Firepower 9300 Series NEBS, regulatory, safety, and EMC compliance

Cisco Firepower 1000 Series summary

SpecificationDescription
NEBSCisco Firepower 9300 is NEBS compliant with SM-24,SM-40, SM-44 and SM-48 Security Modules
Regulatory complianceProducts comply with CE markings per directives 2004/108/EC and 2006/108/EC
Safety●  UL 60950-1

●  CAN/CSA-C22.2 No. 60950-1

●  EN 60950-1

●  IEC 60950-1

●  AS/NZS 60950-1

●  GB4943

EMC: emissions●  47CFR Part 15 (CFR 47) Class A (FCC Class A)

●  AS/NZS CISPR22 Class A

●  CISPR22 CLASS A

●  EN55022 Class A

●  ICES003 Class A

●  VCCI Class A

●  EN61000-3-2

●  EN61000-3-3

●  KN22 Class A

●  CNS13438 Class A

●  EN300386

●  TCVN7189

EMC: immunity●  EN55024

●  CISPR24

●  EN300386

●  KN24

●  TVCN 7317

●  EN-61000-4-2, EN-61000-4-3, EN-61000-4-4, EN-61000-4-5, EN-61000-4-6, EN-61000-4-8, EN61000-4-11