Cisco Firepower 1000 Series

About the Cisco Firepower 1000 Series

The Cisco Firepower 1000 Series is the entry point of the Firepower next-generation
firewall range — the appliances a small or mid-sized site buys when it has outgrown a
consumer router and needs real policy-based inspection. Four appliances make up the family:
the FPR1010, a fanless desktop unit for a small office or branch; and the
FPR1120, FPR1140 and FPR1150, three 1U rack appliances that step up in
throughput and connection capacity.

The single most important thing to understand about these part numbers is that the same
appliance is sold under two different software images, and the choice is written into the
SKU:

• ASA (FPR1010-ASA-K9) — runs the classic Cisco ASA software. A
  stateful Layer 3/4 firewall with site-to-site and remote-access VPN, configured through
  the familiar ASA CLI and ASDM. No next-generation inspection services.


• NGFW (FPR1010-NGFW-K9) — runs Cisco Firepower Threat Defense (FTD).
  The same hardware, but with the next-generation stack available: intrusion prevention,
  file and malware inspection, URL filtering and application visibility, managed from
  Firepower Management Center or the on-box manager.

The hardware is identical — an FPR1120 is an FPR1120 either way. What differs is the
software it ships with and therefore what the appliance can do. Buying the wrong one is not
something a licence change can fix after the fact; the image has to be reinstalled.

Two network modules extend the appliances where the fixed port set is not enough: the
FPR-NM-8X10G with eight SFP+ 10-Gigabit ports, and the FPR-NM-8X1G-F with eight
copper Gigabit ports.

How to Choose a Cisco Firepower 1000 Series Appliance

1. Pick the appliance by site size and throughput

• FPR1010 — desktop form factor, no rack ears needed, fanless. The right choice for
  a small branch or a retail site, and the cheapest way into the Firepower range.


• FPR1120 — 1U, the entry rack appliance. The usual step up when the 1010's
  connection table or VPN capacity becomes the constraint.


• FPR1140 — 1U, the mid-range. For a site running inspection services on more than
  a single internet link, or terminating a larger VPN estate.


• FPR1150 — 1U, the top of the series. Chosen when the site is close to outgrowing
  the 1000 Series entirely and wants headroom rather than another upgrade cycle.

2. Decide ASA or NGFW before anything else

This decision drives the whole purchase:

• Choose ASA if the requirement is a stateful firewall with IPsec VPN, the
  operators are trained on ASA, and there is no mandate for intrusion prevention or file
  inspection. It is simpler to run and simpler to troubleshoot.


• Choose NGFW (FTD) if the site must inspect traffic rather than merely permit it —
  intrusion prevention, malware detection, URL and application control — or if the estate
  is already managed from Firepower Management Center. This is the version that delivers
  the "next-generation" part of the product name.

In this catalogue the NGFW variants carry listed pricing and the ASA variants of the 1010,
1120 and 1140 are quoted on request, so tell us which image you need when you enquire.

3. Add a network module only if the fixed ports run out

Both appliances and modules are listed separately here. The FPR-NM-8X1G-F adds eight
copper Gigabit ports, which is the usual requirement when a site needs to separate several
internal zones without introducing an external switch. The FPR-NM-8X10G adds eight
SFP+ 10-Gigabit ports, for a fibre uplink or an aggregation position. Neither is needed on a
typical single-WAN branch deployment — order the module only where the port count, not the
feature set, is the constraint.

4. Plan the management model

The 1000 Series appliances can be managed individually through their on-box manager, or
centrally through Firepower Management Center alongside the rest of a Firepower estate. If
there is more than a handful of appliances, or if the intent is to move to a larger Firepower
platform later, plan for the central manager from the start — it changes which licence bundle
is the sensible one to buy.

Cisco Firepower 1000 Series Model Comparison

Appliances

Network modules

Prices are our current selling prices in US dollars, excluding shipping. Click a
model number for the full specification table and availability. ASA-image appliances are
quoted on request — send us the model and quantity and we will price them the same day.

Frequently Asked Questions

What is the difference between an FPR1010-ASA-K9 and an FPR1010-NGFW-K9?

The software image, not the hardware. The ASA version runs the classic Cisco ASA
firewall software: stateful Layer 3/4 inspection with IPsec and remote-access VPN.
The NGFW version runs Firepower Threat Defense, which is the same appliance with the
next-generation service stack — intrusion prevention, file inspection, URL and application
control. Both are the same physical FPR1010.

Can I convert an ASA appliance to NGFW later?

It requires re-imaging the appliance rather than simply enabling a feature, so in practice
you should choose the image at purchase time. If there is any chance the site will need
intrusion prevention or file inspection, buy the NGFW variant now.

Which model is right for a small branch office?

The FPR1010 — it is a fanless desktop appliance with no rack requirement, and it is
the lowest-cost entry into the Firepower range. Step up to the FPR1120 when the branch
needs a rack appliance or more VPN and connection capacity than the 1010 provides.

Do I need a network module?

Only if the built-in port set is insufficient. The FPR-NM-8X1G-F adds eight copper
Gigabit ports for segmenting internal zones; the FPR-NM-8X10G adds eight SFP+
10-Gigabit ports for fibre uplinks. A typical single-WAN branch deployment does not need
either.

How are these appliances managed?

Either locally through the on-box manager, or centrally through Cisco Firepower Management
Center alongside the rest of the Firepower estate. If you are deploying more than a few
appliances, or expect to add larger Firepower platforms later, plan for the central manager
from the outset.

Do you supply the licences and subscriptions too?

Yes. Tell us the appliance, the image (ASA or NGFW) and the services you intend to run, and
we will quote the appliance together with the applicable subscription rather than the hardware
on its own.