Cisco Firepower 2100 Series

About the Cisco Firepower 2100 Series

The Cisco Firepower 2100 Series sits one step above the entry-level 1000 Series in the Firepower next-generation firewall range. Where the 1000 Series is a desktop or small 1U appliance for a branch, the 2100 Series is a 1U rack platform built for the internet edge of a mid-sized organisation — a site that terminates several internet links, runs a substantial VPN estate, and inspects traffic rather than merely permitting it.

Four appliances make up the family, stepping up in throughput and connection capacity:

• FPR2110 — the entry point of the series.
• FPR2120 — the mid-range model, and the usual default where the 2110 is close to its limit.
• FPR2130 — for a larger site with heavier inspection load.
• FPR2140 — the top of the range, for the largest deployment in this series.

Three things distinguish the 2100 Series from the 1000 Series below it. It has a network module (NetMod) bay so the port configuration can be extended after purchase; it supports redundant power supplies, which a rack-mounted internet edge appliance generally needs; and it has an SSD slot for local event storage. Those three features are what you are paying for over an equivalent-throughput 1000 Series appliance, and they are the reason this series is the usual choice for an edge that has to stay up.

Reading a part number

A model such as FPR2130-ASA-K9 decodes in three parts:

• FPR2130 — the appliance.
• ASA — the software image. ASA is the classic Cisco ASA firewall software: stateful Layer 3/4 inspection with IPsec and remote-access VPN. NGFW is Cisco Firepower Threat Defense (FTD) — the same appliance with the next-generation service stack available: intrusion prevention, file and malware inspection, URL filtering and application control. A model with no image suffix (such as FPR2130-K9) is the base appliance.
• -K9 — Cisco's strong-encryption designation, present on essentially every part number.

As on the 1000 Series, the hardware is identical between the ASA and NGFW variants of the same model — what differs is the software installed, and that is not something a licence change can convert after the fact.

How to Choose a Cisco Firepower 2100 Series Appliance

1. Size the appliance by inspected throughput, not by link speed

The model number steps up in capacity, and the step that matters is the throughput the appliance can sustain with inspection enabled. That figure is always lower than the raw interface speed, and it is the number that determines whether an appliance is adequate. A site with a single 1G internet link does not automatically need the smallest model in the series — if it must inspect VPN traffic from hundreds of remote workers, the load is not the internet link but the inspection itself. Size on concurrent sessions and inspected throughput, and leave headroom; a firewall running at its ceiling is one policy change away from becoming the bottleneck for the whole site.

2. Decide the software image first

This drives everything else, exactly as it does on the 1000 Series:

• ASA — a stateful Layer 3/4 firewall with IPsec VPN. Choose it where the operators are trained on ASA, the requirement is firewalling and VPN, and there is no mandate for intrusion prevention or file inspection.
• NGFW (Firepower Threat Defense) — the same appliance with the next-generation stack: intrusion prevention, malware and file inspection, URL and application control. This is the production choice for an internet edge that must inspect rather than permit.
• Base appliance (no suffix) — the hardware on its own, for deployments that will be imaged and licensed to a specific central-management model.

In this catalogue the ASA and NGFW variants of each model are both listed with their own pricing, so the two can be compared directly — note that the price relationship between ASA and NGFW is not consistent across models, since it reflects what is in stock rather than a fixed list differential.

3. Plan the NetMod and the network module

The 2100 Series has a single NetMod bay, and the module fitted determines the interface mix beyond the fixed ports. The FPR2K-NM-8X10G provides eight 10-Gigabit SFP+ ports — the usual choice where the appliance aggregates several internal segments or connects to a 10G core. A blanking plate (FPR2K-NM-BLANK) covers the bay if no module is fitted. Because there is only one bay, decide the module at order time: it is not a slot you can expand incrementally.

4. Decide on redundancy and storage

Two accessory decisions separate a lab deployment from a production one. Power supplies: the chassis takes redundant supplies (the FPR2K-PWR-AC-400 AC and FPR2K-PWR-DC-350 DC options), and a single-supply internet edge appliance is a single point of failure. Storage: the SSD (FPR2K-SSD100, FPR2K-SSD200) holds local event and logging data — needed where events must be retained on-box rather than sent straight to a manager. The slide rail kit (FPR2K-SLIDE-RAILS) is also a separate item, which is easy to overlook when ordering a rack appliance.

5. New or remanufactured?

Some models are available in a remanufactured variant carrying the -RF suffix (for example FPR2130-NGFW-K9-RF in this catalogue). As with the industrial routers, the -RF suffix is the thing to check when comparing prices — it denotes a factory-remanufactured unit offered below the equivalent new part. If your procurement requires new equipment, confirm the part number does not carry the suffix.

Cisco Firepower 2100 Series Model Comparison

Appliances

Network module and blanks

Power supplies, cooling and mounting

Solid-state storage

Prices are our current selling prices in US dollars, excluding shipping. Click a model number for the full specification table and availability. Power supplies, fan modules, blanks and the 200 GB SSD are quoted on request — send us the appliance and we will price the complete configuration.

Frequently Asked Questions

What is the difference between the 1000 Series and the 2100 Series?

Capacity and resilience features. The 1000 Series is the entry tier — a desktop or small 1U appliance for a branch, with fixed ports. The 2100 Series is a 1U platform for a mid-sized internet edge, and it adds three things: a NetMod bay so ports can be extended after purchase, support for redundant power supplies, and an SSD slot for local event storage. Those are the features a production edge appliance needs and a branch appliance can do without.

What does the ASA or NGFW suffix mean?

The software image. ASA is the classic Cisco ASA firewall software — stateful Layer 3/4 inspection with IPsec and remote-access VPN. NGFW is Firepower Threat Defense, which adds intrusion prevention, file and malware inspection and URL and application control. Both run on identical hardware; the difference is what the appliance is capable of doing, and it cannot be switched afterwards by adding a licence.

Which model should I choose?

Size on inspected throughput and concurrent sessions, not on internet link speed. In practice the 2120 is the usual starting point for a mid-sized site, the 2110 fits a smaller deployment, and the 2130 and 2140 are for heavier inspection loads. If the appliance will terminate a large VPN estate, that load — not the internet link — is usually what pushes the requirement up a model.

What is the NetMod bay for?

Extending the port configuration. The FPR2K-NM-8X10G adds eight 10-Gigabit SFP+ ports, which is the usual requirement where the appliance connects to several internal segments or to a 10G core. There is only one bay, so choose the module at order time — it is not an incrementally expandable slot.

Do I need redundant power supplies?

On a production internet edge, yes. A firewall with a single power supply is a single point of failure for the entire site's connectivity, and the chassis accepts redundant supplies for exactly that reason. Power supplies are listed separately on this page, AC and DC variants both.

What is the SSD for?

Local event storage and logging. Where events have to be retained on the appliance — rather than streamed straight to a management centre, or where a retention requirement applies — the SSD provides the local capacity. The 100 GB and 200 GB options are listed here; if no SSD is fitted, a blanking plate covers the bay.

Are the -RF models different hardware?

No — -RF denotes a factory-remanufactured unit of the same part number, which is why it appears with the same model prefix and the suffix appended. It is offered below the price of the equivalent new appliance. If your procurement requires new equipment, confirm the part number does not carry the suffix.

Do you supply the licences and subscriptions?

Yes. Tell us the appliance, the image (ASA or NGFW) and the services you intend to run, and we will quote the appliance together with the applicable subscription and support rather than the hardware on its own.