Cisco Secure Firewall ISA3000

Developed specifically to withstand the harshest industrial environments, these industrial firewalls offer uncompromising end-to-end security with industrial design and operation in mind.

Product overview

The Cisco^® Secure Firewall ISA3000 is a true industrial firewall that provides OT-targeted protection based on proven enterprise-class security.

The ISA3000, with four data links, is a DIN rail mount, ruggedized appliance that provides the widest range of access, threat, and application controls for the harshest and most demanding industrial environments.

The ISA3000 bundles the proven security of the Cisco Secure Firewall with the visibility and control of industrial protocols and applications developed by leading automation vendors such as Omron, Rockwell, GE, Schneider, Siemens, and others. The ISA3000 is key as you start converging IT and OT security and capturing the benefits of your industrial digitization efforts.

As a foundational component of your IoT/OT security journey, the ISA3000 is the ideal ruggedized firewall to segment industrial networks, protect OT assets from potential threats, and build compliance with a variety of industrial standards, regulations, and guidelines such as NERC-CIP, ISA99/IEC62443, CFATS, ANSI/AWWA G430, and others.

Certified for deployment in the most demanding industries (power utilities, oil and gas, transportation, mining, manufacturing, water utilities, and more), the ISA3000 is widely used as a DMZ firewall to connect small, distributed industrial sites, enforce segmentation of large internal networks, and manage VPN connections to enable secure management of remote assets and seamless distributed operations.

The ISA3000 protects industrial processes and vulnerable control equipment. It leverages industry-leading threat detection and vulnerability exploit protection rules developed

by Cisco Talos^®, including thousands of industrial-focused rules. Using OpenAppID and Deep Packet Inspection (DPI) of industrial protocols, it even lets you write your own custom detectors to create alerts and block or allow traffic based on the industrial application flows you most care about. Cisco Advanced Malware Protection (AMP) is also built in to continuously track suspect file propagation.

Managed through either a user-friendly on-box device manager, on-premises centralized management, or a cloud-based management solution, the ISA3000 provides industrial-focused, out-of-the-box configuration and simplified operational management. And because these management tools are the same you already use with Cisco firewalls in your IT domain, it is easy to extend IT security to OT and enforce consistent security policies across domains.

As part of Cisco's comprehensive security portfolio, the ISA3000 interacts with your existing tools to deliver an integrated IT/OT security workflow. Cisco Cyber Vision provides host attribute information to enable construction of meaningful and contextual security policies. Cisco Identity Services Engine (ISE) can be leveraged to exchange unified policy updates as well as host context information using Security Group Tags (SGTs) for security enforcement. The ISA3000 can also exchange NetFlow information with Cisco Stealthwatch^®to provide network-level context information. The ISA3000 provides insights and alerts to Cisco SecureX^™to streamline event triage and correlation, enabling coordinated, single-click defenses.

With the ISA3000, you can build a secure IoT/OT infrastructure and leverage your existing IT security tools and expertise to help ensure production integrity, continuity, and safety.

• Threat Protection
• Application Control
• URL Filtering
• Malware Protection

• 10/100/1000Base-T
• 1000Base-X

• SFP (mini-GBIC)
• Expansion Slot

• FCC 47 CFR Part 15 Class A
• EN 55022A Class A
• VCCI Class A
• AS/NZS CISPR 22 Class A
• CISPR 11 Class A
• CISPR 22 Class A
• ICES 003 Class A
• CNS13438 Class A
• KN22
• EN55024
• CISPR 24
• AS/NZS CISPR 24
• KN24
• EN 61000-4-2 Electro Static Discharge
• EN 61000-4-3 Radiated RF
• EN 61000-4-4 Electromagnetic Fast Transients
• EN 61000-4-5 Surge
• EN 61000-4-6 Conducted RF
• EN 61000-4-8 Power Frequency Magnetic Field
• EN 61000-4-9 Pulse Magnetic Field
• EN 61000-4-18 Damped Oscillatory Wave
• EN-61000-4-29 DC Voltage Dips and Interruptions
• IEC/AS/NZS 62368.1
• EN 61000-6-1 Immunity for Light Industrial Environments
• EN 61000-6-2 Immunity for Industrial Environments
• EN 61000-6-4 Emission Standard for Industrial Environments
• EN 61326 Industrial Control
• EN 61131-2 Programmable Controllers
• IEEE 1613 Electric Power Stations Communications Networking
• IEC 61850-3 Electric Substations Communications Networking
• NEMA TS-2
• EN 50121-3-2
• EN 50121-4 
• EN 50155
• UL/CSA 60950-1
• EN 60950-1
• CB to IEC 60950-1 with all country deviations
• NOM to NOM-019-SCFI (through partners and distributor)
• UL 508
• CSA C22.2, No 142
• EN/IEC 61010-2-201
• UL/CSA 61010-1
• ANSI/ISA 12.12.01 (Class I, Div 2 A-D
• CSA C22.2 No 213 (Class 1, Div 2 A-D)
• UL/CSA 60079-0, -15
• IEC 60079-0, -15 (IECEx test report Class I, Zone 2, group II gases)
• EN 60079-0, -15 ATEX certification (Class I, Zone 2, group II gases)
• IEC 60068-2-30
• IEC60068-2-6 and IEC60068-2-27
• MIL-STD-810, Method 514.4
• Marine EN60945
• Industrial EN61131-2/IEC61131-2
• Railway EN61373 CAT 1B
• Smart Grid EN61850-3
• IEEE 1613
• ISO 9223: Corrosion
• Class C3-Medium
• Class C4-High
• EN 60068-2-52 (Salt Fog)
• EN 60068-2-60 (Flowing Mixed Gas)
• IEEE 802.1D MAC Bridges, Spanning Tree Protocol (STP)
• IEEE 802.1p Layer2 class-of-service (COS) prioritization
• IEEE 802.1q VLAN
• IEEE 802.1s Multiple Spanning-Trees
• IEEE 802.1w Rapid Spanning-Tree
• IEEE 802.1x Port Access Authentication
• IEEE 802.1AB Link Layer Discovery Protocol (LLDP)
• IEEE 802.3ad Link Aggregation (LACP)
• IEEE 802.3ah 100BASE-X single-mode fiber (SMF)/multimode fiber (MMF) only
• IEEE 802.3x full duplex on 10BASE-T
• IEEE 802.3 10BASE-T specification
• IEEE 802.3u 100BASE-TX specification
• IEEE 802.3ab 1000BASE-T specification
• IEEE 802.3z 1000BASE-X specification
• IEEE 1588v2 PTP

• China Restriction of Hazardous Substances (China RoHS)
• Restriction of Hazardous Substances (RoHS)
• Waste Electrical and Electronic Equipment Directive (WEEE)