FPR3110-NGFW-K9 – 8x1G RJ45 + 8×1/10G SFP+ Ports – 1/10G Module Slot – 17 Gbps IPS – NGFW Firewall
Shop Expert-Recommended Accessories for the FPR3110-NGFW-K9
Explore optics, stacking accessories, modules, and power supplies—all verified by our engineers for use with this model.-
SFP-10G-SR-S
10GBASE-SR SFP+ - S-Class - 400m OM4 MMFOriginal price was: $853.95.$52.00Current price is: $52.00. -
SFP-10G-LR-S
10GBASE-LR SFP+ - S-Class - 10km SMFOriginal price was: $2,439.88.$150.00Current price is: $150.00. -
GLC-LH-SMD
1000BASE-LX/LH SFP - 10km SMF / 550m MMF - DOMOriginal price was: $1,260.58.$95.80Current price is: $95.80. -
GLC-TE
1000BASE-T SFP - RJ-45 Cat5 Copper - 100m ReachOriginal price was: $570.10.$70.00Current price is: $70.00. -
GLC-SX-MMD
1000BASE-SX SFP - MMF 850nm - DOMOriginal price was: $633.46.$59.00Current price is: $59.00.
Why Layer23-Switch
Stocked, Shipped and Supported by One Team
Ships in 1 Business Day
In-stock orders leave our Hong Kong or U.S. warehouse within 1 business day after payment, with tracking by email.
LSCare Warranty
3years on enterprise equipment
Free CCIE Support
Certified engineers help before and after you buy. Reply within 1 business day by email or live chat.
Verify Before You Pay
100%factory-sealed
Get label and serial photos before shipment, and check every serial number with Cisco.
FPR3110-NGFW-K9 Description
The FPR3110-NGFW-K9 is a Cisco Secure Firewall 3110 Threat Defense appliance, a 1RU next-generation firewall for internet edge and private cloud perimeters. The firewall is rated at 17.0 Gbps of FW + AVC + IPS throughput on 1024B packets across 8 RJ-45 and 8 1/10G SFP+ ports, with one module slot, 2 million concurrent sessions with AVC and 3,000 VPN peers. The module slot recognizes only 1G and 10G network modules, and the appliance ships with the Threat Defense image rather than ASA.
Quick Specs
|
Parameter |
Specification |
|---|---|
|
Software image |
Cisco Secure Firewall Threat Defense |
|
Form factor |
1RU |
|
Fixed data ports |
8 x 10M/100M/1GBASE-T RJ-45, 8 x 1/10G SFP+ |
|
Network module slot |
1 slot for 1/10G modules; up to 24 Ethernet ports in total |
|
Throughput: FW + AVC + IPS (1024B) |
17.0 Gbps |
|
TLS throughput |
4.8 Gbps |
|
IPsec VPN throughput (1024B TCP, fastpath) |
8 Gbps |
|
Maximum concurrent sessions, with AVC |
2 million |
|
Maximum new connections per second, with AVC |
130,000 |
|
Maximum VPN peers |
3,000 |
|
Default power supply |
FPR3K-PWR-AC-400, 400W AC (one of two bays filled) |
|
Storage |
1 x 900 GB NVMe SSD, second slot for RAID1 |
|
Supported Threat Defense releases |
7.1 and later, except 7.4.0 |
Product Performance
Key Features
The 17.0 Gbps rating holds with firewall, application visibility and IPS all enabled on 1024B packets, and the NGIPS-only figure is the same 17.0 Gbps. Field results shift with the features in use, the protocol mix, packet size and software release.
Decrypted traffic is rated at 4.8 Gbps, measured with 50% TLS 1.2 traffic using AES256-SHA and 2048-bit RSA keys. That is about 28% of the 17.0 Gbps inspection rating, so a policy that decrypts most sessions is planned against the TLS number.
Two appliances pair as active/standby or active/active, and up to 8 chassis can run as one cluster. Every member must be the same model and generation with identical licensing, and an active/standby Threat Defense pair carries two subscriptions.
IPsec VPN is rated at 8 Gbps for 1024B TCP traffic over Fastpath, with 3,000 VPN peers per appliance. VPN offload on Threat Defense 7.2 raises the projected figure to 11.0 Gbps.
One network module slot takes the 16 fixed ports to as many as 24, using FPR3K-XNM-8X10G or one of the 1G and 10G hardware-bypass modules. FPR3K-XNM-8X25G, FPR3K-XNM-4X40G and the 2-port 100G module are not recognized by the software in this chassis.
Firewall Device Manager comes with the Threat Defense image and manages a single appliance on the box. Larger estates use Firewall Management Center or Cisco Security Cloud Control, and from Threat Defense 7.4.1 the appliance can run in multi-instance mode with container instances.
Application Scenarios
At the internet edge of a regional office or mid-size campus, the firewall connects the core switches to the service provider circuits and applies access control, IPS and URL filtering in one Threat Defense policy.
Remote employees running Cisco Secure Client connect to the appliance at headquarters, which terminates their VPN sessions together with site-to-site IPsec tunnels from partner sites.
A data center or private cloud perimeter can place up to 8 appliances in one cluster in front of the server networks, with the members managed centrally from Firewall Management Center.
Product Comparison
|
Parameter |
FPR3110-NGFW-K9 | |||
|---|---|---|---|---|
|
Software image |
Threat Defense |
ASA |
Threat Defense |
Threat Defense |
|
Stateful inspection firewall throughput (1500B UDP) |
Not applicable |
18.0 Gbps |
Not applicable |
Not applicable |
|
Throughput: FW + AVC + IPS (1024B) |
17.0 Gbps |
Not applicable |
10 Gbps |
21.0 Gbps |
|
IPsec VPN throughput |
8 Gbps (1024B TCP w/Fastpath) |
8 Gbps (450B UDP L2L test) |
5.5 Gbps (1024B TCP w/Fastpath) |
10 Gbps (1024B TCP w/Fastpath) |
|
Maximum concurrent sessions |
2 million with AVC |
2 million firewall connections |
1.5 million with AVC |
4 million with AVC |
|
Maximum VPN peers |
3,000 |
3,000 |
2,000 |
7,000 |
|
Integrated I/O |
8 x RJ-45 and 8 x 1/10G SFP |
8 x RJ-45 and 8 x 1/10G SFP |
8 x RJ-45 and 8 x 1/10G SFP |
8 x RJ-45 and 8 x 1/10G SFP |
|
Network modules |
8 x 1/10G Options |
8 x 1/10G Options |
8 x 1/10G Options |
8 x 1/10G Options |
|
Clustering |
Up to 8 chassis |
Up to 8 chassis |
Not supported |
Up to 8 chassis |
FPR3110-NGFW-K9 and FPR3120-NGFW-K9 share the same ports and 1/10G module options, but FPR3120-NGFW-K9 is rated 21.0 Gbps of FW + AVC + IPS with 4 million sessions and 7,000 VPN peers against 17.0 Gbps, 2 million and 3,000. Loads above those limits move to the larger model. Inspected traffic within 10 Gbps, 1.5 million sessions and 2,000 VPN peers fits FPR3105-NGFW-K9, provided the design does not need clustering, which that model lacks. FPR3110-ASA-K9 is the same 3110 hardware running ASA instead of Threat Defense; its 18.0 Gbps is a 1500B UDP stateful figure with no IPS rating, and it suits sites that standardize on ASA.
Ordering Checklist
- Threat Defense subscription: Add an L-FPR3110T term PID such as L-FPR3110T-TMC-5Y, choosing T, TC, TM, TMC, URL or AMP in 1-, 3- or 5-year terms. Threat (T) is required before Malware (M) or URL (C) features work.
- Smart Licensing account: Create the end customer’s Smart Licensing account in Smart Software Manager before the Threat Defense order. Every license on the order is deposited into that account.
- Network module: Select FPR3K-XNM-8X10G or a 1G or 10G hardware-bypass module such as FPR3K-XNM-6X10SRF. FPR3K-XNM-8X25G and FPR3K-XNM-4X40G are not recognized by the software in the FPR3110-NGFW-K9.
- Second power supply: Add FPR3K-PWR-AC-400= for 1+1 redundancy, because the chassis ships with one 400W AC supply. A DC build uses FPR3K-PWR-DC-400= supplies only, since AC and DC cannot be mixed.
- Second SSD: Add FPR3K-SSD900= for slot 2 to run software RAID1 with the factory 900 GB SSD. SSDs taken from other firewall platforms cannot be used.
- Rack kit: Add FPR3K-SLIDE-RAILS= for a 4-post rack or FPR3K-BRKT= for 2-post mounting. Rails and brackets are in the box only when they are ordered.
Optional Add-ons
|
Model |
Description |
|---|---|
|
400W AC power supply for the empty bay, giving 1+1 redundancy | |
|
400W DC power supply for DC sites; replaces AC supplies rather than mixing with them | |
|
900 GB NVMe SSD for slot 2 software RAID1 | |
|
FPR3K-XNM-8X10G= |
8-port 1/10G SFP+ network module |
|
FPR3K-XNM-6X10SRF= |
6-port 10G SR multimode hardware-bypass network module |
|
FPR3K-XNM-6X10LRF= |
6-port 10G LR single-mode hardware-bypass network module |
|
FPR3K-XNM-6X1SXF= |
6-port 1G SX multimode hardware-bypass network module |
|
FPR3K-XNM-8X1GF= |
8-port 10/100/1000Base-T hardware-bypass network module |
|
10G SFP+ optic supported on the fixed SFP+, management and FPR3K-XNM-8X10G ports | |
|
10G SFP+ optic supported on the fixed SFP+, management and FPR3K-XNM-8X10G ports | |
|
1G SFP supported on the fixed SFP+, management and FPR3K-XNM-8X10G ports | |
|
FPR3K-FAN= |
Spare dual fan module |
|
FPR3K-SLIDE-RAILS= |
Slide rail kit for 4-post racks |
|
FPR3K-BRKT= |
Rack-mount brackets for 2-post mounting |
|
FPR3K-CBL-MGMT= |
Cable management brackets |
|
FPR3K-FIPS-KIT= |
FIPS opacity shield kit |
Front View
|
1 |
RJ-45 console port |
2 |
Recessed factory reset button |
|
3 |
SSD-1 |
4 |
SSD-2 |
|
5 |
Network module (NM-2) |
6 |
System LEDs |
|
7 |
Type A USB 3.1 port |
8 |
Gigabit Ethernet management port:Secure Firewall Threat Defense—Management 0 (also referred to as Management 1/1 and Diagnostic 1/1)ASA—Management 1/1 |
|
9 |
Reset button LED |
10 |
Pullout asset card with chassis serial number, getting started guide QR code, and LTP QR code |
|
11 |
Eight fixed RJ-45 ports (NM-1)RJ-45 ports named Ethernet 1/1 through 1/8 left to right; for a list of supported SFPs. |
12 |
Eight fixed SFP+ ports (NM-1)SFP+ ports named Ethernet 1/9 through 1/16 left to right; for a list of supported SFPs. |
Rear View
|
1 |
Power on/off switch |
2 |
Power supply module (PSU-1) |
|
3 |
Power supply module FAIL LED (PSU-1) |
4 |
Fan module LED (FAN-1) |
|
5 |
Fan module (FAN-1) |
6 |
Fan module LED (FAN-2) |
|
7 |
Fan module (FAN-2) |
8 |
Power supply module (PSU-2) |
|
9 |
Power supply module FAIL LED (PSU-2) |
10 |
Chassis power LEDNote This power LED has the same behavior as the front panel LED. See Front Panel LEDs for more information. |
|
11 |
Power supply module OK LED (PSU-1) |
12 |
Power supply module connector (PSU-1) |
|
13 |
Power supply module OK LED (PSU-2) |
14 |
Power supply module connector (PSU-2) |
|
15 |
Two-post grounding padNote The two-post grounding lug and two screws are included in the accessory kit. |
— |
Specifications
| Parameter | Specification | Parameter | Specification |
|---|---|---|---|
| Product ID | FPR3110-NGFW-K9 | Cisco ordering description | Cisco Secure Firewall 3110 Appliance with Threat Defense software |
| Software image | Cisco Secure Firewall Threat Defense | Supported Threat Defense releases | 7.1, 7.2, 7.3, 7.4.1–7.4.x, 7.6, 7.7 and 10.x (7.4.0 not supported) |
| Multi-instance mode | Threat Defense 7.4.1 and later | Local on-device management | Firewall Device Manager, included with the Threat Defense image |
| Centralized management | Firewall Management Center or Cisco Security Cloud Control | Form factor (rack units) | 1RU |
| Integrated I/O | 8 x 10M/100M/1GBASE-T Ethernet interfaces (RJ-45), 8 x 1/10 Gigabit (SFP) Ethernet interfaces | Network module slots | 1 |
| Network modules | 8 x 1/10G options: FPR3K-XNM-8X10G, FPR3K-XNM-6X1SXF, FPR3K-XNM-6X10SRF, FPR3K-XNM-6X10LRF, FPR3K-XNM-8X1GF | Maximum number of interfaces | Up to 24 total Ethernet ports (8x1G RJ-45, 8×1/10G SFP, and network module) |
| Integrated network management ports | 1 x 1/10G SFP | Serial port | 1 x RJ-45 console |
| USB | 1 x USB Type-A (900 mA) | SSD storage | 1x 900 GB NVMe SSD, 1x spare slot for software RAID1 |
| DRAM | 64 GB | Throughput: FW + AVC (1024B) | 17.0 Gbps |
| Throughput: FW + AVC + IPS (1024B) | 17.0 Gbps | Throughput: NGIPS (1024B) | 17.0 Gbps |
| Maximum concurrent sessions, with AVC | 2 million | Maximum new connections per second, with AVC | 130,000 |
| TLS throughput | 4.8 Gbps (50% TLS 1.2 traffic, AES256-SHA, RSA 2048B keys) | IPSec VPN throughput (1024B TCP w/Fastpath) | 8 Gbps |
| Projected IPSec VPN throughput with VPN offload (FTD 7.2) | 11.0 Gbps | Maximum VPN peers | 3,000 |
| High availability | Active/active, active/standby | Clustering | Up to 8 chassis |
| Application visibility (AVC) | Standard, more than 4000 applications, geolocations, users, and websites | Cisco security intelligence | Standard, with IP, URL, and DNS threat intelligence |
| URL Filtering: number of categories | More than 80 | URL Filtering: number of URLs categorized | More than 280 million |
| Deployment modes | Firewall or dedicated IPS | Q-in-Q (stacked VLAN) | Up to two 802.1Q headers per packet on inline sets and passive interfaces |
| Cisco trust anchor technologies | Included | Power supply configuration | Single 400W AC; dual 400W AC optional; single or dual 400W DC optional |
| Default power supply | FPR3K-PWR-AC-400, 400W AC (one installed) | AC input voltage | 100 to 240V AC |
| AC maximum input current | < 6A at 100V | AC maximum output power | 400W |
| AC input frequency | 50 to 60 Hz | DC input voltage | -48V to -60VDC |
| DC maximum output power | 400W | DC efficiency | >88% at 50% load |
| Power redundancy | 1+1 AC or DC with dual supplies; AC and DC supplies cannot be mixed | Fan modules | 2 hot-swappable fan modules (2 fans each), 3+1 redundancy |
| Airflow | Front to rear (I/O side to non-I/O side), cold aisle to hot aisle | Noise | 65 dBA at 25°C, 74 dBA maximum |
| Sound power | 72 dB typical, 80 dB maximum | Dimensions (H x W x D) | 1.75 x 17 x 20 in. (4.4 x 43.3 x 50.8 cm) |
| Weight | 10.5 kg (23 lb) with 1 power supply, 1 network module, fan modules, 1 SSD | Mounting | 19-inch 4-post EIA-310-D rack; 2-post fixed mount brackets optional |
| Temperature: operating | 0°C to 40°C (32°F to 104°F) | Temperature: nonoperating | -20°C to 65°C (-4°F to 149°F) |
| Altitude: operating | 10,000 ft (max) | Altitude: nonoperating | 40,000 ft (max) |
| Safety certifications | UL 62368-1, CAN/CSA-C22.2 No. 62368-1, EN 62368-1, IEC 62368-1, IEC 60950-1, AS/NZS 62368-1, GB4943 | EMC: emissions | FCC 47CFR15 Class A, AS/NZS CISPR 32 Class A, EN55032/CISPR 32 Class A, ICES-003 Class A, VCCI Class A, KS C 9832 Class A, CNS-13438 Class A, EN61000-3-2, EN61000-3-3 |
| EMC: immunity | IEC/EN61000-4-2, IEC/EN61000-4-3, IEC/EN61000-4-4, IEC/EN61000-4-5, IEC/EN61000-4-6, IEC/EN61000-4-11, KS C 9835 | EMC: ETSI/EN | EN 300 386, EN55032/CISPR 35, EN55024/CISPR 24, EN55035/CISPR 35, EN61000-6-1 |
| Regulatory compliance | CE markings |
Quality Certifications
Customer Reviews
Questions & Answers
-
What throughput does FPR3110-NGFW-K9 reach with firewall, AVC and IPS enabled?
-
Do Malware and URL features on FPR3110-NGFW-K9 need a Threat Defense subscription?
-
Which Threat Defense releases support FPR3110-NGFW-K9, and which one does not?
-
Which legacy network module PIDs does FPR3110-NGFW-K9 not recognize?
-
How many SSD, power supply and fan module bays does FPR3110-NGFW-K9 have, and how many are populated?
-
What is the weight of FPR3110-NGFW-K9 with its standard components?
Warranty
Layer23-Switch.com offers genuine, high-quality ICT products at competitive wholesale prices—ensuring exceptional value without compromising quality.
All items are brand new, original, and factory-sealed.
Upon request, each unit can be fully tested and verified by a Cisco CCIE-certified engineer to ensure perfect working condition before shipment.
Our Cisco CCIE-certified experts provide free professional support via phone, email, online chat, or remote login—helping you deploy and troubleshoot with confidence.
If you are not satisfied with your purchase, you may request an exchange or full refund. Our customer service team will guide you through the return process quickly and smoothly. Visit Return Policy page for more information.
We support multiple secure payment and logistics options, backed by industry-leading verification:
Visit How to Pay page for more information
Extended, Worry-Free Warranty Coverage Factory New Sealed Enterprise Hardware:
· 3 Years Factory New Sealed
Visit Warranty Policy page for more information
Verify, plan, and comparewith confidence
Use practical tools to check device details, review lifecyclemilestones, and compare hardware before you buy.
Layer23 is now our default answer when we need hardware.
No issues to report. Everything went well.
We’ve sent referrals based on our positive reorder experiences.
Business is booming, we needed better security. You delivered.
This is the way. Secure connection established. Hardware is pristine.