Cisco Firepower 1000 Series

About the Cisco Firepower 1000 Series

The Cisco Firepower 1000 Series is the entry point of the Firepower next-generation firewall range — the appliances a small or mid-sized site buys when it has outgrown a consumer router and needs real policy-based inspection. Four appliances make up the family: the FPR1010, a fanless desktop unit for a small office or branch; and the FPR1120, FPR1140 and FPR1150, three 1U rack appliances that step up in throughput and connection capacity.

The single most important thing to understand about these part numbers is that the same appliance is sold under two different software images, and the choice is written into the SKU:

• ASA (FPR1010-ASA-K9) — runs the classic Cisco ASA software. A stateful Layer 3/4 firewall with site-to-site and remote-access VPN, configured through the familiar ASA CLI and ASDM. No next-generation inspection services.
• NGFW (FPR1010-NGFW-K9) — runs Cisco Firepower Threat Defense (FTD). The same hardware, but with the next-generation stack available: intrusion prevention, file and malware inspection, URL filtering and application visibility, managed from Firepower Management Center or the on-box manager.

The hardware is identical — an FPR1120 is an FPR1120 either way. What differs is the software it ships with and therefore what the appliance can do. Buying the wrong one is not something a licence change can fix after the fact; the image has to be reinstalled.

Two network modules extend the appliances where the fixed port set is not enough: the FPR-NM-8X10G with eight SFP+ 10-Gigabit ports, and the FPR-NM-8X1G-F with eight copper Gigabit ports.

How to Choose a Cisco Firepower 1000 Series Appliance

1. Pick the appliance by site size and throughput

• FPR1010 — desktop form factor, no rack ears needed, fanless. The right choice for a small branch or a retail site, and the cheapest way into the Firepower range.
• FPR1120 — 1U, the entry rack appliance. The usual step up when the 1010's connection table or VPN capacity becomes the constraint.
• FPR1140 — 1U, the mid-range. For a site running inspection services on more than a single internet link, or terminating a larger VPN estate.
• FPR1150 — 1U, the top of the series. Chosen when the site is close to outgrowing the 1000 Series entirely and wants headroom rather than another upgrade cycle.

2. Decide ASA or NGFW before anything else

This decision drives the whole purchase:

• Choose ASA if the requirement is a stateful firewall with IPsec VPN, the operators are trained on ASA, and there is no mandate for intrusion prevention or file inspection. It is simpler to run and simpler to troubleshoot.
• Choose NGFW (FTD) if the site must inspect traffic rather than merely permit it — intrusion prevention, malware detection, URL and application control — or if the estate is already managed from Firepower Management Center. This is the version that delivers the "next-generation" part of the product name.

In this catalogue the NGFW variants carry listed pricing and the ASA variants of the 1010, 1120 and 1140 are quoted on request, so tell us which image you need when you enquire.

3. Add a network module only if the fixed ports run out

Both appliances and modules are listed separately here. The FPR-NM-8X1G-F adds eight copper Gigabit ports, which is the usual requirement when a site needs to separate several internal zones without introducing an external switch. The FPR-NM-8X10G adds eight SFP+ 10-Gigabit ports, for a fibre uplink or an aggregation position. Neither is needed on a typical single-WAN branch deployment — order the module only where the port count, not the feature set, is the constraint.

4. Plan the management model

The 1000 Series appliances can be managed individually through their on-box manager, or centrally through Firepower Management Center alongside the rest of a Firepower estate. If there is more than a handful of appliances, or if the intent is to move to a larger Firepower platform later, plan for the central manager from the start — it changes which licence bundle is the sensible one to buy.

Cisco Firepower 1000 Series Model Comparison

Appliances

Network modules

Prices are our current selling prices in US dollars, excluding shipping. Click a model number for the full specification table and availability. ASA-image appliances are quoted on request — send us the model and quantity and we will price them the same day.

Frequently Asked Questions

What is the difference between an FPR1010-ASA-K9 and an FPR1010-NGFW-K9?

The software image, not the hardware. The ASA version runs the classic Cisco ASA firewall software: stateful Layer 3/4 inspection with IPsec and remote-access VPN. The NGFW version runs Firepower Threat Defense, which is the same appliance with the next-generation service stack — intrusion prevention, file inspection, URL and application control. Both are the same physical FPR1010.

Can I convert an ASA appliance to NGFW later?

It requires re-imaging the appliance rather than simply enabling a feature, so in practice you should choose the image at purchase time. If there is any chance the site will need intrusion prevention or file inspection, buy the NGFW variant now.

Which model is right for a small branch office?

The FPR1010 — it is a fanless desktop appliance with no rack requirement, and it is the lowest-cost entry into the Firepower range. Step up to the FPR1120 when the branch needs a rack appliance or more VPN and connection capacity than the 1010 provides.

Do I need a network module?

Only if the built-in port set is insufficient. The FPR-NM-8X1G-F adds eight copper Gigabit ports for segmenting internal zones; the FPR-NM-8X10G adds eight SFP+ 10-Gigabit ports for fibre uplinks. A typical single-WAN branch deployment does not need either.

How are these appliances managed?

Either locally through the on-box manager, or centrally through Cisco Firepower Management Center alongside the rest of the Firepower estate. If you are deploying more than a few appliances, or expect to add larger Firepower platforms later, plan for the central manager from the outset.

Do you supply the licences and subscriptions too?

Yes. Tell us the appliance, the image (ASA or NGFW) and the services you intend to run, and we will quote the appliance together with the applicable subscription rather than the hardware on its own.