Cisco Firepower 4100 Series Firewalls

The Firepower 4100 Series — now sold as the Cisco Secure Firewall 4100 — is Cisco’s high-throughput NGFW tier in a single rack unit. Four models are in production: the 4112, 4115, 4125, and 4145. On paper they look alike, since each pairs a Secure Firewall 4000 Supervisor, eight on-chassis 10G SFP+ ports, and two network-module slots with a choice of ASA or Threat Defense software. What separates them is headroom: ASA stateful firewall throughput is 40 Gbps on the 4112 and 80 Gbps across the other three, while Threat Defense inspection (FW+AVC+IPS) runs from 19 Gbps on the 4112 up to 53 Gbps on the 4145.

Secure Firewall 4100 Models Compared: 4112, 4115, 4125 and 4145

Read the table by Threat Defense throughput rather than ASA. Three of the four models share the same 80 Gbps ASA ceiling, so the FTD inspection figure and session capacity are what actually move between tiers.

The platform underneath is identical on every model — a Secure Firewall 4000 Supervisor, eight 10G SFP+ ports, two network-module slots for 1/10/40/100G expansion, multi-instance support, and clustering of up to 16 appliances. Two things break that symmetry. The 4125 is the only NEBS-compliant model in the series, and dual power is standard only on the 4125 and 4145; the 4112 and 4115 ship with one 1100W AC supply and take a second for 1+1 redundancy.

Which Firepower 4100 Model Fits Your Deployment?

Since the chassis, port layout, and clustering are the same across the range, the model decision comes down to inspection throughput and session scale.

• • The 4112 is the entry point. Take it when you want the 4100 architecture — multi-instance, module expansion, clustering — but only need up to 19 Gbps of Threat Defense throughput and 10 million sessions.

• • The 4115 earns its place when you need the full 80 Gbps ASA ceiling but 33 Gbps of inspection and 15 million sessions are enough.

• • Specify the 4125 for heavier inspection (45 Gbps), 25 million sessions and 800 GB of storage, dual power as standard, or a NEBS requirement — it is the only model that meets NEBS.

• • At the top, the 4145 pushes Threat Defense throughput to 53 Gbps and 30 million sessions, with dual 1100W supplies out of the box.

One sizing trap is worth calling out: the 4115, 4125, and 4145 all advertise 80 Gbps of ASA throughput, but that is not the number you live with once AVC and IPS are switched on. Size on Threat Defense throughput — 33, 45, and 53 Gbps respectively — and the real gaps between the models reappear.

ASA or Threat Defense: Picking the 4100 Software Image

The hardware does not change between the two part numbers; the software image does. An -ASA-K9 unit (FPR4112-ASA-K9 through FPR4145-ASA-K9) ships with Cisco Secure Firewall ASA and is driven from the CLI or ASDM — the natural pick if your team already runs ASA policy. An -NGFW-K9 unit (FPR4112-NGFW-K9 through FPR4145-NGFW-K9) ships with Threat Defense (FTD) and is managed from Firewall Management Center or Cisco Defense Orchestrator for unified NGFW and IPS policy.

Treat the two decisions as independent: choose the model for throughput, the image for your management stack. Because the same chassis carries either image, the only thing to lock down before ordering is which one your platform expects.

Buying a Firepower 4100 from Layer23-Switch

Every 4100 we ship is brand-new, original Cisco hardware, covered by a 3-year warranty and RMA support, with global delivery. Layer23-Switch is a Cisco certified partner. Prices and current stock sit on each model’s page; because 4100-class units tend to move in project quantities and lead times shift, it is worth confirming availability on the exact ASA or NGFW part number before you commit a BOM.