Cisco Firepower 2100 Series

About the Cisco Firepower 2100 Series

The Cisco Firepower 2100 Series sits one step above the entry-level 1000 Series in the
Firepower next-generation firewall range. Where the 1000 Series is a desktop or small 1U
appliance for a branch, the 2100 Series is a 1U rack platform built for the internet edge of a
mid-sized organisation — a site that terminates several internet links, runs a substantial VPN
estate, and inspects traffic rather than merely permitting it.

Four appliances make up the family, stepping up in throughput and connection capacity:

• FPR2110 — the entry point of the series.


• FPR2120 — the mid-range model, and the usual default where the 2110 is close to
  its limit.


• FPR2130 — for a larger site with heavier inspection load.


• FPR2140 — the top of the range, for the largest deployment in this series.

Three things distinguish the 2100 Series from the 1000 Series below it. It has a
network module (NetMod) bay so the port configuration can be extended after purchase;
it supports redundant power supplies, which a rack-mounted internet edge appliance
generally needs; and it has an SSD slot for local event storage. Those three features
are what you are paying for over an equivalent-throughput 1000 Series appliance, and they are
the reason this series is the usual choice for an edge that has to stay up.

Reading a part number

A model such as FPR2130-ASA-K9 decodes in three parts:

• FPR2130 — the appliance.


• ASA — the software image. ASA is the classic Cisco ASA firewall software:
  stateful Layer 3/4 inspection with IPsec and remote-access VPN.
  NGFW is Cisco Firepower Threat Defense (FTD) — the same appliance with the
  next-generation service stack available: intrusion prevention, file and malware
  inspection, URL filtering and application control. A model with no image suffix
  (such as FPR2130-K9) is the base appliance.


• -K9 — Cisco's strong-encryption designation, present on essentially every part
  number.

As on the 1000 Series, the hardware is identical between the ASA and NGFW variants of the
same model — what differs is the software installed, and that is not something a licence
change can convert after the fact.

How to Choose a Cisco Firepower 2100 Series Appliance

1. Size the appliance by inspected throughput, not by link speed

The model number steps up in capacity, and the step that matters is the throughput the
appliance can sustain with inspection enabled. That figure is always lower than the raw
interface speed, and it is the number that determines whether an appliance is adequate. A site
with a single 1G internet link does not automatically need the smallest model in the series —
if it must inspect VPN traffic from hundreds of remote workers, the load is not the internet
link but the inspection itself. Size on concurrent sessions and inspected throughput, and
leave headroom; a firewall running at its ceiling is one policy change away from becoming the
bottleneck for the whole site.

2. Decide the software image first

This drives everything else, exactly as it does on the 1000 Series:

• ASA — a stateful Layer 3/4 firewall with IPsec VPN. Choose it where the operators
  are trained on ASA, the requirement is firewalling and VPN, and there is no mandate for
  intrusion prevention or file inspection.


• NGFW (Firepower Threat Defense) — the same appliance with the next-generation
  stack: intrusion prevention, malware and file inspection, URL and application control.
  This is the production choice for an internet edge that must inspect rather than permit.


• Base appliance (no suffix) — the hardware on its own, for deployments that will
  be imaged and licensed to a specific central-management model.

In this catalogue the ASA and NGFW variants of each model are both listed with their own
pricing, so the two can be compared directly — note that the price relationship between ASA
and NGFW is not consistent across models, since it reflects what is in stock rather than a
fixed list differential.

3. Plan the NetMod and the network module

The 2100 Series has a single NetMod bay, and the module fitted determines the interface mix
beyond the fixed ports. The FPR2K-NM-8X10G provides eight 10-Gigabit SFP+ ports — the
usual choice where the appliance aggregates several internal segments or connects to a 10G
core. A blanking plate (FPR2K-NM-BLANK) covers the bay if no module is fitted. Because
there is only one bay, decide the module at order time: it is not a slot you can expand
incrementally.

4. Decide on redundancy and storage

Two accessory decisions separate a lab deployment from a production one. Power
supplies: the chassis takes redundant supplies (the FPR2K-PWR-AC-400 AC and
FPR2K-PWR-DC-350 DC options), and a single-supply internet edge appliance is a single
point of failure. Storage: the SSD (FPR2K-SSD100, FPR2K-SSD200) holds
local event and logging data — needed where events must be retained on-box rather than sent
straight to a manager. The slide rail kit (FPR2K-SLIDE-RAILS) is also a separate item,
which is easy to overlook when ordering a rack appliance.

5. New or remanufactured?

Some models are available in a remanufactured variant carrying the -RF suffix
(for example FPR2130-NGFW-K9-RF in this catalogue). As with the industrial routers,
the -RF suffix is the thing to check when comparing prices — it denotes a
factory-remanufactured unit offered below the equivalent new part. If your procurement
requires new equipment, confirm the part number does not carry the suffix.

Cisco Firepower 2100 Series Model Comparison

Appliances

Network module and blanks

Power supplies, cooling and mounting

Solid-state storage

Prices are our current selling prices in US dollars, excluding shipping. Click a
model number for the full specification table and availability. Power supplies, fan modules,
blanks and the 200 GB SSD are quoted on request — send us the appliance and we will price the
complete configuration.

Frequently Asked Questions

What is the difference between the 1000 Series and the 2100 Series?

Capacity and resilience features. The 1000 Series is the entry tier — a desktop or
small 1U appliance for a branch, with fixed ports. The 2100 Series is a 1U platform for
a mid-sized internet edge, and it adds three things: a NetMod bay so ports can be
extended after purchase, support for redundant power supplies, and an SSD slot
for local event storage. Those are the features a production edge appliance needs and a branch
appliance can do without.

What does the ASA or NGFW suffix mean?

The software image. ASA is the classic Cisco ASA firewall software — stateful Layer
3/4 inspection with IPsec and remote-access VPN. NGFW is Firepower Threat Defense, which
adds intrusion prevention, file and malware inspection and URL and application control. Both
run on identical hardware; the difference is what the appliance is capable of doing, and it
cannot be switched afterwards by adding a licence.

Which model should I choose?

Size on inspected throughput and concurrent sessions, not on internet link speed.
In practice the 2120 is the usual starting point for a mid-sized site, the 2110
fits a smaller deployment, and the 2130 and 2140 are for heavier inspection loads.
If the appliance will terminate a large VPN estate, that load — not the internet link —
is usually what pushes the requirement up a model.

What is the NetMod bay for?

Extending the port configuration. The FPR2K-NM-8X10G adds eight 10-Gigabit SFP+
ports, which is the usual requirement where the appliance connects to several internal segments
or to a 10G core. There is only one bay, so choose the module at order time — it is not an
incrementally expandable slot.

Do I need redundant power supplies?

On a production internet edge, yes. A firewall with a single power supply is a single point
of failure for the entire site's connectivity, and the chassis accepts redundant supplies for
exactly that reason. Power supplies are listed separately on this page, AC and DC variants
both.

What is the SSD for?

Local event storage and logging. Where events have to be retained on the appliance — rather
than streamed straight to a management centre, or where a retention requirement applies —
the SSD provides the local capacity. The 100 GB and 200 GB options are listed here; if no SSD
is fitted, a blanking plate covers the bay.

Are the -RF models different hardware?

No — -RF denotes a factory-remanufactured unit of the same part number, which is why
it appears with the same model prefix and the suffix appended. It is offered below the price of
the equivalent new appliance. If your procurement requires new equipment, confirm the part
number does not carry the suffix.

Do you supply the licences and subscriptions?

Yes. Tell us the appliance, the image (ASA or NGFW) and the services you intend to run, and
we will quote the appliance together with the applicable subscription and support rather than
the hardware on its own.