Cisco 1200 Series, CSF-1230, CSF-1240, CSF-1250 Manual

Features

The Cisco Secure Firewall 1200 Series is a family of network security appliances for enterprise branches. The appliances are powered by a network processor that delivers high performance and power efficiency in modern branch security workloads. The 1200 Series includes three 1U rack-mount models: 1230, 1240 and 1250.

See Product ID Numbers, a list of the product IDs (PIDs) associated with the Secure Firewall 1200 series

The Secure Firewall 1200 series supports Cisco Firepower Threat Defense and Cisco Secure ASA software. See the Cisco Secure Firewall Threat Defense Compatibility Guide and the Cisco Secure Firewall ASA Compatibility guide, which provide Cisco software and hardware compatibility, including operating system and hosting environment requirements, for each supported version.

The following figure shows the Cisco Secure Firewall 1200 series chassis.

Figure1:CSF-1230,CSF-1240,and CSF-1250

The following table lists the features for the Secure Firewall 1200 series.

Table 1: CSF-1230, CSF-1240, and CSF-1250 Features

Feature	CSF-1230	CSF-1240	CSF-1250
Form factor	1 RU
Mounting	Rack mount EIA-310D (19-inch) rack (2-post mounting)
Airflow	I/O side to non-I/O side with I/O side air intake Rear panel to front panel (cold aisle to hot aisle)
System memory	16 GB	32 GB	32 GB
Management port	One 1-Gbps copper RJ-45 Gigabit Ethernet 10/100/1000 BaseT Restricted to network management access only; connect with an RJ-45 cable
Console ports	One Cisco Serial (RS-232 on RJ-45) One USB Type C 3.0 Provides management access through an external system; you cannot use both ports at the same time.
USB port	One USB 3.0 Type A Allows attachment of an external device such as mass storage
Network ports	Eight 1000BaseT 1		Eight 1000/2500 BaseT 2
Small form-factor pluggable (SFP) ports	Four SFP+ (1/10Gbps) Port numbering is left to right, top to bottom; ports are named Gigabit Ethernet 1/9 through 1/12. Each port includes a pair of LEDs, one each for connection status and link status.
Supported SFPs	See Supported SFP/SFP+/QSFP+ Transceivers for a list of the supported SFPs.
Power switch	Yes On rear panel; rocker-type power on/off switch Note The power switch controls system power and operates as a soft notification switch that supports the graceful shutdown of the system. Graceful shutdown reduces the risk of system software and data corruption. If you accidentally push the power switch to ON while unpacking your chassis, make sure the power switch is set to OFF before you connect AC power for the first time. The chassis powers on and boots up as soon as the AC power is applied when the power button is in the ON position.
Reset button	Small recessed button Push and hold with a pin for 5 seconds; resets the chassis to its default state following the next reboot. Note Configuration variables are reset to factory default, but the flash is not erased and no files are removed.
AC power supply	One AC power supply Internal component only; not field-replaceable. You must return the chassis to Cisco for power supply replacement. See the Cisco Returns Portal for more information.
Redundant power	No
Fan	Two fixed fans The fans are internal; there is no user access. The fan is not field-replaceable; you must return the chassis to Cisco for fan replacement. See the Cisco Returns Portal for more information.
Storage	One slot 960-GB U.2 NVME The drive is field-replaceable. See Replace the SSD for more information.
Flash	Internal 16 GB eMMC. Not field-replaceable.

¹ Each RJ-45 (8P8C) copper port supports auto Medium Dependent Interface Crossover (MDI/X) as well as auto-negotiation for interface speed, duplex, and other negotiated parameters, and are MDI/X-compliant. Port numbering is left to right, top to bottom; ports are named Gigabit Ethernet 1/1 through 1/8. Each port includes a pair of LEDs, one each for connection status and link status.

² Each RJ-45 (8P8C) copper port supports auto Medium Dependent Interface Crossover (MDI/X) as well as auto-negotiation for interface speed, duplex, and other negotiated parameters, and are MDI/X-compliant. Port numbering is left to right, top to bottom; ports are named Gigabit Ethernet 1/1 through 1/8. Each port includes a pair of LEDs, one each for connection status and link status

Console Ports
The 1200 series has two external console ports, a Cisco RJ-45 serial port and a Type C USB serial port. Only one serial console port can be active at a time. When a cable is plugged into the USB console port, the RJ-45 port becomes inactive. Conversely, when the USB cable is removed from the USB port, the RJ-45 port becomes active. The console ports do not have any hardware flow control. You can use the CLI to configure the chassis through either serial console port by using a terminal server or a terminal emulation program on a computer.

• RJ-45 (8P8C) port—Supports RS-232 signaling to an internal UART controller. The RJ-45 console port does not support a remote dial-in modem. You can use an adapter to convert the RJ45-to-DB9 connection if necessary.
• Type C USB port—Lets you connect to a USB port on an external computer. You can plug and unplug the USB cable from the console port without affecting Windows HyperTerminal operations. We recommend shielded USB cables with properly terminated shields. The default setting is 9600 baud. Use this for the initial connection. Baud rates for the USB console port are 1200, 2400, 4800, 9600, 19200, 38400, 57600, and 115200 bps.

External Flash Storage
The chassis provides a USB Type A port that you can use to attach an external device. The USB port can provide output power of 5 volts and up to a maximum of 1 A (5 W of USB power).

• External USB drive (optional)—You can use the external USB Type A port to attach a data-storage device. The external USB drive identifier isdisk1. When the chassis is powered on, a connected USB drive is mounted as disk1 and is available for you to use. Additionally, the file-system commands that are available to disk0 are also available to disk1, including copy, format, delete, mkdir, pwd, cd, and so on.
• FAT-32 File System—The 1200 series only supports FAT-32-formatted file systems for the external USB drive. If you insert an external USB drive that is not in FAT-32 format, the system mounting process fails, and you receive an error message. You can enter the commandformat disk1: to format the partition to FAT-32 and mount the partition to disk1 again; however, data might be lost.

Package Contents

The following figure shows the package contents for the Secure Firewall 1230, 1240, and 1250. Note that the contents are subject to change, and your exact contents might contain additional or fewer items depending on what you ordered.

Pullout Asset Tag and Compliance Label

Figure 2:CSF-1230, CSF-1240,and CSF-1250 PackageContents

Pullout Asset Tag and Compliance Label

The pullout asset card on the front panel of the chassis contains the chassis model name, part number, serial number, the common language equipment identifier (CLEI), and the Digital Documentation Portal QR code that points to the getting started guide, the regulatory and compliance guide, the zero-touch deployment guide, and the hardware installation guide.

The following figure shows an example pullout asset card on the front panel of the chassis.

Figure 3: Pullout Asset Card on the Front Panel of the Chassis

The following figure shows the location of the compliance label on the bottom of the chassis.

Figure 4:Compliance Label on the Bottom of the Chassis

The following figure shows a sample compliance label found on the bottom of the chassis.

Figure 5:Sample Compliance Label

Front Panel

The following figure shows the front panel of the Secure Firewall 1230, 1240, and 1250. See Front Panel LEDs, for descriptions of the front panel LEDs.

Figure 6: CSF-1230,CSF-1240, and CSF-1250 Front Panel

Front Panel LEDs

The following figure shows the LEDs on the front panel of the Secure Firewall 1230, 1240, and 1250 and describes their states.

Figure 7:CSF-1230, CSF-1240, and CSF-1250 Front Panel LEDs

1	Management Status of the management ports: Link status (L): Off—No link, or port is not in use. Green—Link established. Green, flashing—Link activity.	2	Management Status of the management ports: Connection-speed status (S): Green, flashing—One flash every three seconds = 10 Mbps. Green, flashing—Two rapid flashes = 100 Mbps. Green, flashing—Three rapid flashes = 1000 Mbps.
3	Network Status of the network ports (applies to CSF-1230 and CSG-1240): Link status (L): Off—No link, or port is not in use. Green—Link established. Green, flashing—Link activity. Status of the network ports (applies to CSF-1250): Link status (L): Off—No link, or port is not in use. Green, flashing—Link activity.	4	Network Status of the network ports (applies to CSF-1230 and CAF-1240): Connection-speed status (S): Green, flashing—One flash every three seconds = 10 Mbps. Green, flashing—Two rapid flashes = 100 Mbps. Green, flashing—Three rapid flashes = 1000 Mbps. Status of the network ports (applies to CSF-1250): Connection-speed status (S): Off—No link, or port is not in use. Green—Link established
5	Power Power supply status: Off —Power supply off. Green—Power supply on. Amber—System is powering up or system firmware is updating. Green, flashing—System in process of a graceful shutdown.	6	System System operating status: Off—System has not booted up yet. Green, flashing—System is booting up. Green—System has booted up; normal system function. Amber—System failed to boot. Amber, flashing—Boot failed.
7	Security Cloud Control SCC status: Green, flashing slowly (twice in five seconds)—Cloud connected. Green and amber, flashing—Cloud connection failure. Green—Cloud disconnected. Note The LED pattern applies to zero-touch provisioning (ZTP). See the Easy Deployment Guide for Cisco Secure Firewall Threat Defense with Cisco Security Cloud Control for more information.	8	Active Status of the failover pair: Off—System is in standby mode. Green—System is in active mode.
9	Alarm Status of the alarms: Off—No alarms. Yellow—Power supply, temperature too high, and/or fan failures.	10	SSD Status of the SSD: Off— No SSD present. Green—SSD detected. Green, flashing—Activity on the SSD. Note See Replace the SSD for the procedure for replacing a failed SSD.

Rear Panel

The following figure shows the rear panel of the Secure Firewall 1230, 1240, and 1250. See Ground the Chassisfor the procedure for attaching the grounding lug.

Figure 8: CSF-1230, CSF-1240, and CSF-1250 Rear Panel

1	Power switch Note The power switch provides a way to gracefully shut down the system and place it in standby. The power supply and fan remain active and the fan may continue to spin at slow speed. To achieve total power shut down, unplug the power supply from the chassis. If you accidentally push the power switch to ON while unpacking your chassis, make sure the power switch is set to OFF before you connect AC power for the first time. The chassis powers on and boots up as soon as the AC power is applied when the power button is in the ON position.	2	Power cord socket
3	Internal fan	4	Internal fan
5	Grounding lug pad		—

Hardware Specifications

The following table contains hardware specifications for the Secure Firewall CSF-1230, CSF-1240, and CSF-1250.

Supported SFP/SFP+/QSFP+ Transceivers

The SFP/SFP+/QSFP+ transceiver is a bidirectional device with a transmitter and receiver in the same physical package. It is a hot-swappable optical or electrical (copper) interface that plugs into the SFP/SFP+/QSFP+ ports on the fixed ports and the network module ports, and provides Ethernet connectivity.

The 1-Gbps and 10-Gbps transceivers are supported on the fixed ports for the following models and software versions:

• CSF-1230, CSF-1240, CSF-1250
• Threat defense Version 7.7 and ASA Version 9.23.1

See Cisco SFP Modules for Gigabit Ethernet Applications Data Sheet for more information.

The following figure shows the components of a transceiver.

Figure 9: SFP Transceiver

Safety Warnings
Take note of the following warnings:

Statement 1055—Class 1/1M Laser
Invisible laser radiation is present. Do not expose to users of telescopic optics. This applies to Class 1/1M laser products.

Statement 1056—Unterminated Fiber Cable
Invisible laser radiation may be emitted from the end of the unterminated fiber cable or connector. Do not view directly with optical instruments. Viewing the laser output with certain optical instruments, for example, eye loupes, magnifiers, and microscopes, within a distance of 100 mm, may pose an eye hazard.

Statement 1057—Hazardous Radiation Exposure
Use of controls, adjustments, or performance of procedures other than those specified may result in hazardous radiation exposure.

Use appropriate ESD procedures when inserting the transceiver. Avoid touching the contacts at the rear, and keep the contacts and ports free of dust and dirt. Keep unused transceivers in the ESD packing that they were shipped in.

Although non-Cisco SFPs are allowed, we do not recommend using them because they have not been tested and validated by Cisco. Cisco TAC may refuse support for any interoperability problems that result from using an untested third-party SFP transceiver.

The following table lists the supported 1-Gbps transceivers for the fixed ports (not supported for management port).

³ Depending on fiber grade and core size, operating distance may vary.

⁴ Depending on fiber grade and core size, operating distance may vary.

The following table lists the supported transceivers for the fixed ports (not supported for the management port).

Table 5: CSF-1230, CSF-1240, and CSF-1250 Series PIDs