The Cisco Secure Firewall ISA3000 is a ruggedized, DIN rail mount industrial firewall for protecting operational technology (OT), industrial control systems (ICS), substations, manufacturing cells, distributed sites, and industrial DMZs. It combines four Gigabit Ethernet data links, industrial environmental tolerances, stateful Layer 2 through Layer 7 inspection, VPN, routing, NAT, application control, and industrial protocol visibility in a fanless appliance designed for harsh operating conditions.
Product role in industrial networks
The ISA3000 is intended for security segmentation between industrial zones, manufacturing cells, enterprise networks, industrial DMZs, and remote operational sites. It can operate as a transparent or routed firewall and supports both copper and fiber uplink designs.
Typical deployment roles include:
- Industrial DMZ firewall
- Cell or zone segmentation firewall
- WAN security device for substations and isolated assets
- Site-to-site VPN endpoint
- Remote access VPN gateway
- Security perimeter for industrial control systems
- Boundary firewall between enterprise IT and OT networks
- Distributed firewall for transportation, mining, water, power, oil and gas, and manufacturing environments
The appliance provides four data interfaces in one of two physical arrangements:
- Four copper Gigabit Ethernet ports
- Two copper Gigabit Ethernet ports and two SFP fiber ports
All copper data ports support full traffic bypass operation. This capability is relevant where traffic continuity is required during power, software, or security-service events. The platform also supports passive deployment learning mode, software updates without traffic loss, connection limitations, latency detection and mitigation, and quality-of-service policies.
Management options include:
- Cisco Firepower Device Manager for local, on-box administration
- Cisco Firepower Management Center for centralized configuration, monitoring, logging, and reporting
- Cisco Defense Orchestrator for cloud-based management
- Multidevice management for hundreds of devices
- User-specific administrative access and control customization
Security and OT control functions
The ISA3000 applies enterprise firewall controls to industrial traffic while adding visibility into OT protocols and applications. Its inspection model includes stateful inspection from Layer 2 through Layer 7, identity-based access policies, application control, intrusion prevention, VPN, and security intelligence.
Industrial protocol support includes:
- BACnet
- Common Industrial Protocol (CIP)
- Companion Specification for Energy Metering (COSEM)
- Connection Oriented Transport Protocol (COTP)
- Distributed Network Protocol (DNP3)
- EtherNet/IP
- Generic Object Oriented Substation Events (GOOSE)
- Generic Substation Events (GSE)
- Emission Control Protocol
- Fujitsu Device Control
- Honeywell Control Station/NIF Server
- Honeywell Esperion DSA Server Monitor
- IEC 60870-5-104
- IEC 61850 MMS
- ISO Manufacturing Message Specification (MMS)
- Modbus
- Omron FINS
- OPC Unified Architecture (OPC-UA)
- Q.931
- Siemens S7
- SRC
- TPKT
For selected protocols, application identification can extend to individual commands. The data sheet specifically identifies application IDs for individual CIP applications, IEC 60870-5-104 commands, and IEC 61850 MMS commands. This enables policies to be applied at a more granular level than a simple IP address and port rule.
Application controls include visibility into:
- Industrial applications
- DMZ infrastructure
- Individual protocol commands and values
- ICS and OT protocol flows
- Application hosts and network relationships
The appliance supports Cisco OpenAppID for custom and open-source application detectors. This is useful when a site uses proprietary or uncommon industrial applications that require local identification logic.
Threat detection and malware controls
The ISA3000 uses Cisco Talos-developed detection rules and includes more than 55,000 rules and threat identifiers, including hundreds of industrial-focused rules. Capabilities cover industrial equipment exploit protection, protocol abuse identification, web-based control system protection, network behavior analytics, passive device discovery, and Indicators of Compromise tracking.
Threat mapping functions include:
- Passive device identification
- Mobile device identification
- Application host network mapping
- Vulnerability and host network mapping
- User and host network mapping
- Passive endpoint and infrastructure detection
- NetFlow tracking
- Traffic variance detection
- Correlation policies and responses
- Router-based remediation actions
- Custom threat identifiers
- Creation of wholly new identifiers
File tracking supports approved file tracing, suspect file tracing, and malware matching.
Available security services and functions include:
| Security function | Support |
|---|---|
| TLS decryption | Supported |
| OpenAppID custom detectors | Standard |
| IP, URL, and DNS security intelligence | Standard |
| Cisco Firepower NGIPS | Available |
| Cisco Secure Firewall malware protection | Available |
| Cisco Secure Malware Analytics sandboxing | Available |
| Automated threat feed and IPS signature updates | Supported |
| Open API for third-party integrations | Supported |
| Snort and OpenAppID community resources | Supported |
| Active/standby failover | Supported |
| Cisco Trust Anchor technologies | Included |
Cisco Secure Firewall malware protection supports detection, blocking, tracking, analysis, and containment of targeted and persistent malware. Optional correlation with Cisco Secure Endpoint is also identified.
Network services and access control
The ISA3000 provides the network services commonly required at industrial sites without requiring separate infrastructure for every function. Supported services include DNS, DHCP, AAA, IPv4 routing, IPv6 host support, NAT, VLAN trunking, logging, and time synchronization.
Layer 3 routing support includes:
- IPv4 static routing
- Routing Information Protocol (RIP)
- Enhanced Interior Gateway Routing Protocol (EIGRP)
- Intermediate System to Intermediate System (IS-IS)
- Open Shortest Path First (OSPF)
- Border Gateway Protocol (BGP)
NAT functions include:
- Static NAT
- Dynamic NAT
- Dynamic PAT
- Identity NAT
- Port translation
- One-to-many translation
- Nonstandard port translation
The platform supports 802.1Q trunks and IPv6 hosts. IPv6 management-related support includes HTTP over IPv6 and SNMP over IPv6.
Logging can be sent to or collected through:
- Local logs
- Syslog
- Security Analytics and Logging
- eStreamer
- Logs in the management application
- SIEM platforms such as QRadar and Splunk
Industrial timing requirements are addressed through hardware-enabled IEEE 1588v2 Precision Time Protocol using the default profile.
Access control features include:
- ISA99 and IEC 62443 segmentation enforcement
- NERC-CIP electronic security perimeter enabling features
- Remote access VPN
- Site-to-site VPN
- Cisco AnyConnect network access control
- Cisco ISE support
- Cisco Secure Desktop
- Citrix and VMware clientless connections
- Global automated or manual block lists
- Global allow lists
- Third-party intelligence feeds
- File allow and block lists
- Application-level access control
- 802.1X
- Active Directory integration
- Security Group Tag based policies
- MACsec
- MAC Authentication Bypass
- Remote access endpoint security state enforcement
Cisco TrustSec support includes in-band and out-of-band identity, Security Group Tag policies, 802.1X, MACsec, and MAB.
Performance and sizing guidance
Performance depends on the enabled inspection functions and packet size. The published measurements use 1024-byte traffic unless otherwise stated.
| Performance metric | Published value |
|---|---|
| NGIPS throughput | 500 Mbps |
| Firewall plus AVC throughput | 375 Mbps |
| Firewall plus AVC plus IPS throughput | 350 Mbps |
| Maximum concurrent sessions with AVC | 50,000 |
| Maximum new connections per second with AVC | 2,700 |
| IPsec VPN throughput using 1024-byte TCP with Fastpath | 50 Mbps |
| Maximum VPN peers | 25 |
| AVC application coverage | More than 4,000 applications |
| URL filtering coverage | More than 80 categories |
| Categorized URLs | More than 280 million |
| IPv4 MACsec ACEs with default TCAM template | 1,000 |
| Defined interfaces | 200, or 400 with FTD |
| VLAN count | 5, or 100 with FTD |
| VLAN count with Security Plus on ASA | 100 |
| Bidirectional unique subnet NAT entries | 128 |
| Expanded translated NAT entries | Tens of thousands when properly designed |
Presales sizing should use the throughput figure associated with the actual policy stack. A design requiring firewall inspection, AVC, and IPS should be evaluated against the 350 Mbps published figure rather than the 500 Mbps NGIPS-only figure. VPN sizing should use the 50 Mbps IPsec value when encrypted traffic is a significant portion of the workload.
The 50,000 concurrent-session limit and 2,700 new-connections-per-second limit apply with AVC enabled. These values should be compared with the expected number of controllers, engineering workstations, historians, remote users, sensors, cameras, and other connected devices.
For high-availability designs, two appliances are required because the supported clustering and redundancy model is active/standby failover. The Security Plus option enables HA on the ASA-based product family and also provides SSL VPN, greater connection count, and VLAN trunking.
Hardware, power, and industrial construction
The appliance uses a four-core Intel Atom processor rated for industrial temperature operation. Memory and storage are fixed or onboard except for the removable SD flash card.
| Hardware item | Specification |
|---|---|
| Processor | Four-core Intel Atom industrial-temperature processor |
| DRAM | 8 GB soldered memory |
| Onboard flash | 16 GB |
| mSATA storage | 64 GB |
| Removable storage | 1 GB industrial-temperature SD flash card |
| Console ports | Mini-USB and RJ-45 traditional console |
| Management interface | Dedicated 10/100/1000 Ethernet port |
| Security hardware | Anti-counterfeit and anti-tamper chip |
| Recovery | Factory reset option |
| Alarm inputs | Two dry-contact inputs for open or closed detection |
| Alarm output | One Form C relay |
| Dimensions | 11.2 x 13 x 16 cm |
| Dimensions in inches | 4.41 x 5.12 x 6.30 in. |
| Weight | 1.9 kg |
| Cooling | Fanless, convection cooled |
| Power architecture | Dual internal DC |
| Nominal input options | Plus or minus 12 V DC, 24 V DC, or 48 V DC |
| Maximum input range | 9.6 V DC to 60 V DC |
| Power consumption | 24 W |
The fanless design has no moving parts and is suited to sites where mechanical simplicity and reduced maintenance are important. The provided specifications do not state an acoustic noise value in decibels. The applicable engineering fact is that the appliance is fanless and convection cooled.
The alarm I/O can be integrated with external industrial monitoring equipment. The two alarm inputs detect dry-contact open or closed states, while the Form C relay provides an alarm output for external signaling.
Environmental and physical deployment limits
The ISA3000 is designed for industrial environments and supports vibration, shock, surge, and electrical noise immunity. Operating conditions depend on the enclosure configuration:
| Environmental parameter | Specification |
|---|---|
| General operating temperature | -40 to +74 C |
| Vented enclosure operating temperature | -40 to +70 C |
| Sealed enclosure operating temperature | -40 to +60 C |
| Fan or blower-equipped enclosure operating temperature | -40 to +75 C |
| Storage temperature | -40 to +85 C |
| Operating altitude | 0 to 15,000 ft |
| Relative humidity | 5% to 95%, noncondensing |
| Ingress protection | IP30 |
| Corrosion classification | ISO 9223 C3-Medium and C4-High |
The appliance is qualified against shock and vibration requirements associated with industrial, railway, marine, smart grid, and electric power environments. Referenced standards include IEC 60068-2-6, IEC 60068-2-27, MIL-STD-810 Method 514.4, EN 60945, EN 61131-2, IEC 61131-2, EN 61373 Category 1B, EN 61850-3, and IEEE 1613.
The product also lists compliance or certification coverage for industrial control, substation, transportation, hazardous-location, and industrial automation environments. Hazardous-location deployment requires the applicable installation conditions, including enclosure requirements such as an IP54 enclosure where specified by the product documentation.
The published MTBF values are model-specific:
| Model | MTBF |
|---|---|
| ISA-3000-4C | 398,130 hours |
| ISA-3000-2C2F | 376,580 hours |
Ordering matrix
Base appliance models
| Product number | Base software | Copper ports | SFP ports | Bypass | Best For |
|---|---|---|---|---|---|
| ISA-3000-2C2F-K9 | ASA | 2 | 2 | Enabled on all copper ports | Mixed copper and fiber industrial links using ASA |
| ISA-3000-4C-K9 | ASA | 4 | 0 | Enabled on all copper ports | Copper-only sites using ASA |
| ISA-3000-2C2F-FTD | FTD | 2 | 2 | Enabled on all copper ports | Mixed copper and fiber sites using FTD |
| ISA-3000-4C-FTD | FTD | 4 | 0 | Enabled on all copper ports | Copper-only sites using FTD |
The ASA-based models support optional ASA plus Firepower Services licensing. The ordering information notes that Cisco Firepower Services 7.0 is the last Firepower Services release to run on Cisco ASA.
ASA plus Firepower Services options
| Product number | Function | Best For |
|---|---|---|
| L-ISA3000SEC+-K9 | Security Plus, HA enablement, SSL VPN, greater connection count, VLAN trunking | ASA deployments requiring redundancy, expanded connections, or trunking |
| L-ISA3000-TA-1Y | Threat/Application subscription | Shorter subscription requirement |
| L-ISA3000-TA-3Y | Threat/Application subscription | Multi-year threat and application coverage |
| L-ISA3000-TA-5Y | Threat/Application subscription | Longer-term threat and application coverage |
| L-ISA3000-AMP-1Y | Threat Defense Malware Protection | Malware protection for shorter subscription periods |
| L-ISA3000-AMP-3Y | Threat Defense Malware Protection | Multi-year malware protection |
| L-ISA3000-AMP-5Y | Threat Defense Malware Protection | Longer-term malware protection |
| L-ISA3000-URL-1Y | Threat Defense URL Filtering | URL filtering for shorter subscription periods |
| L-ISA3000-URL-3Y | Threat Defense URL Filtering | Multi-year URL filtering |
| L-ISA3000-URL-5Y | Threat Defense URL Filtering | Longer-term URL filtering |
| L-ISA3000-TC-1Y | Threat and URL Filtering | Combined threat and URL controls |
| L-ISA3000-TC-3Y | Threat and URL Filtering | Multi-year combined threat and URL controls |
| L-ISA3000-TC-5Y | Threat and URL Filtering | Longer-term combined threat and URL controls |
| L-ISA3000-TM-1Y | Threat and Malware Protection | Combined threat and malware controls |
| L-ISA3000-TM-3Y | Threat and Malware Protection | Multi-year combined threat and malware controls |
| L-ISA3000-TM-5Y | Threat and Malware Protection | Longer-term combined threat and malware controls |
| L-ISA3000-TMC-1Y | Threat, Malware Protection, and URL | Full protection bundle for shorter subscription periods |
| L-ISA3000-TMC-3Y | Threat, Malware Protection, and URL | Multi-year full protection bundle |
| L-ISA3000-TMC-5Y | Threat, Malware Protection, and URL | Longer-term full protection bundle |
FTD subscription options
| Product number | Function | Best For |
|---|---|---|
| L-ISA3000T-T-1Y | Threat/Application subscription | FTD deployment with shorter coverage |
| L-ISA3000T-T-3Y | Threat/Application subscription | FTD deployment with multi-year coverage |
| L-ISA3000T-T-5Y | Threat/Application subscription | FTD deployment with longer-term coverage |
| L-ISA3000T-AMP-1Y | Threat Defense Malware Protection | FTD malware protection for shorter periods |
| L-ISA3000T-AMP-3Y | Threat Defense Malware Protection | FTD multi-year malware protection |
| L-ISA3000T-AMP-5Y | Threat Defense Malware Protection | FTD longer-term malware protection |
| L-ISA3000T-URL-1Y | Threat Defense URL Filtering | FTD URL filtering for shorter periods |
| L-ISA3000T-URL-3Y | Threat Defense URL Filtering | FTD multi-year URL filtering |
| L-ISA3000T-URL-5Y | Threat Defense URL Filtering | FTD longer-term URL filtering |
| L-ISA3000T-TC-1Y | Threat and URL Filtering | FTD combined threat and URL controls |
| L-ISA3000T-TC-3Y | Threat and URL Filtering | FTD multi-year combined threat and URL controls |
| L-ISA3000T-TC-5Y | Threat and URL Filtering | FTD longer-term combined threat and URL controls |
| L-ISA3000T-TM-1Y | Threat and Malware Protection | FTD combined threat and malware controls |
| L-ISA3000T-TM-3Y | Threat and Malware Protection | FTD multi-year combined threat and malware controls |
| L-ISA3000T-TM-5Y | Threat and Malware Protection | FTD longer-term combined threat and malware controls |
| L-ISA3000T-TMC-1Y | Threat, Malware Protection, and URL | FTD full protection bundle for shorter periods |
| L-ISA3000T-TMC-3Y | Threat, Malware Protection, and URL | FTD multi-year full protection bundle |
| L-ISA3000T-TMC-5Y | Threat, Malware Protection, and URL | FTD multi-year full protection bundle |
| L-ISA3000T-TMC-5Y | Threat, Malware Protection, and URL | FTD longer-term full protection bundle |
Ruggedized SFP modules
| Product number | Type | Best For |
|---|---|---|
| GLC-SX-MM-RGD= | 1000BASE-SX ruggedized | Short-range multimode fiber |
| GLC-LX-SM-RGD= | 1000BASE-LX/LH ruggedized | Single-mode or supported long-reach fiber designs |
| GLC-FE-100FX-RGD= | 100BASE-FX ruggedized | Ruggedized multimode or supported fiber Ethernet deployments |
| GLC-FE-100LX-RGD= | 100BASE-LX ruggedized | Ruggedized single-mode fiber deployments |
Suggested power supplies
| Product number | Details | Best For |
|---|---|---|
| PWR-IE50W-AC-IEC | AC to DC 24 V, 2.1 A DIN rail supply; 100 to 240 VAC input; 50 to 60 Hz; IEC plug | DIN rail installations requiring an IEC input connection |
| PWR-IE50W-AC | AC to DC 24 V, 2.1 A DIN rail supply; 100 to 240 VAC or 125 to 250 VDC input | Sites requiring AC or high-voltage DC input flexibility |
Warranty and services
All ISA3000 product IDs include a 5-year limited hardware warranty. Warranty terms and service conditions are provided through Cisco’s warranty information resources.
Cisco service programs are positioned to support:
- Proactive or expedited problem resolution
- Reduced network downtime
- Lower total cost of ownership through specialist expertise
- Supplemental support for existing operational teams
- Network investment protection
- Network operation optimization
- Preparation for new applications and expanded network intelligence
For industrial deployments, service planning should account for the remote location of many sites, the operational impact of firewall outages, the need for controlled maintenance windows, and the staffing requirements for centralized monitoring and incident response. The appliance’s local management option supports site-level access, while centralized and cloud-based management support common operating procedures across multiple industrial locations.