In short
The Cisco Secure Firewall 220 and 240P are compact branch firewalls running Threat Defense (-TD-K9) or ASA (-ASA-K9). The 240P adds PoE+ for phones or an access point. Threat Defense features take a T, TC, TM or TMC licence per appliance. Forever Systems, a Cisco Partner, can quote, supply and install them.
Order the Secure Firewall 200
Add products and licences to your basket, then check out when you are ready.
What the Secure Firewall 200 Series is
Cisco describes the 200 Series as "next-generation firewall capabilities specifically designed for distributed enterprises and small branch locations", supporting "both Cisco Firewall Threat Defense (FTD) and Cisco Adaptive Security Appliance (ASA) software". Cisco's Firewall finder lists it under "Small business and branch".
- Secure Firewall 220: compact desktop with 4 x 1000BASE-T and 1 x 1G SFP.
- Secure Firewall 240P: 8 x 1000BASE-T and 2 x 1G SFP, with 4 ports of IEEE 802.3at PoE+ (up to 25.5 W per port, 120 W total, in Cisco's data sheet).
Both take rack and wall mount kits, listed below.
Secure Firewall 200 models and part numbers
Press Add next to a part number to put it in your basket. Where a subscription or support option goes with the hardware, you choose it in the same step and it goes into your basket with the hardware. Part numbers come from the vendor; we confirm each line, quantity and term when we quote.
| Part number | Model | Vendor description | Key specs | What you order with it | Status | Basket |
|---|---|---|---|---|---|---|
| CSF220-TD-K9 | CSF220 | Cisco Secure Firewall 220 Appliance, Threat Defense | 4x 1G RJ-45 + 1x 1G SFP; desktop | Threat Defense feature licence (T, TC, TM or TMC), term at quote | Current | |
| CSF220-ASA-K9 | CSF220 | Cisco Secure Firewall 220 Appliance, ASA | 4x 1G RJ-45 + 1x 1G SFP; desktop | ASA image: optional strong encryption and security context licences | Current | |
| CSF240P-TD-K9 | CSF240P | Cisco Secure Firewall 240P Appliance, POE, Threat Defense | 8x 1G RJ-45 + 2x 1G SFP; desktop | Threat Defense feature licence (T, TC, TM or TMC), term at quote | Current | |
| CSF240P-ASA-K9 | CSF240P | Cisco Secure Firewall 240P Appliance, POE, ASA | 8x 1G RJ-45 + 2x 1G SFP; desktop | ASA image: optional strong encryption and security context licences | Current |
Add the Secure Firewall 200 to your basket
Add it and anything else you need, then check out when you are ready.
Threat Defense or ASA?
You choose the software image when you order, and the part number shows it: -TD-K9 is Cisco Firewall Threat Defense (the next-generation firewall image, with IPS, URL filtering and malware protection under licence) and -ASA-K9 is Cisco ASA (the stateful firewall and VPN image many networks already run).
- Threat Defense is managed on the box with Firewall Device Manager, or centrally with Secure Firewall Management Center or Cisco Security Cloud Control.
- ASA is managed with ASDM, or centrally with Cisco Security (opens in a new tab) Manager or Security Cloud Control.
For a new branch, Threat Defense gives the next-generation features; ASA suits estates already standardised on it. The detail is on ciscosecure.co.uk: Threat Defense (opens in a new tab), ASA (opens in a new tab) and moving from ASA to Threat Defense (opens in a new tab).
Secure Firewall 220 and 240P specifications
| Figure | Secure Firewall 220 | Secure Firewall 240P |
|---|---|---|
| Form factor | Compact desktop (rack and wall mount accessories available) | Compact desktop (rack and wall mount accessories available) |
| Fixed ports | 4x 1000BASE-T, 1x 1G SFP | 8x 1000BASE-T, 2x 1G SFP |
| PoE | None | 4 ports IEEE 802.3at PoE+, up to 25.5 W per port (120 W total) |
| NGFW throughput: FW + AVC + IPS, 1024 byte | 1.5 Gbps | 3 Gbps |
Throughput figures are Cisco data-sheet figures: Cisco Secure Firewall 200 Series data sheet (updated 6 Oct 2026) (opens in a new tab).
Not sure what you need?
Tell us about your sites and we will recommend the right kit and licences.
Licences you order with a Threat Defense appliance
Threat Defense features are licensed per appliance, as term subscriptions of 1, 3 or 5 years:
- T: threat (IPS). Cisco says "Threat/IPS (T) License is a requirement for the use of Malware (M) or URL (C) license features".
- TC: threat and URL filtering. TM: threat and malware. TMC: all three.
- AMP and URL single-feature licences, and a BSE base licence, also appear in Cisco's ordering guide for the 200 Series.
An active/passive HA pair needs a subscription on each unit. Smart Licensing and a Cisco Smart Account are needed before Threat Defense is ordered; we can set up or link your Smart Account as part of the quote. Licence renewals are on Cisco Secure Firewall licences (opens in a new tab) on softwarelicensing.uk, and what each tier includes is on Cisco firewall licensing (opens in a new tab).
What you order with it
Subscription and support part numbers for the hardware above. We confirm the right tier, term and quantity at quote.
Threat Defense licences: CSF220 appliance (Threat Defense image)
| Part number | Description | Term | Basket |
|---|---|---|---|
| CSF220-BSE | Cisco Secure Firewall 220 Base License | term confirmed at quote | |
| CSF220T-T | Cisco Secure Firewall 220 Threat Defense IPS License | term confirmed at quote | |
| CSF220T-TC | Cisco Secure Firewall 220 Threat Defense and URL License | term confirmed at quote | |
| CSF220T-TM | Cisco Secure Firewall 220 Threat Defense, Malware License | term confirmed at quote | |
| CSF220T-TMC | Cisco Secure Firewall 220 TD, Malware and URL License | term confirmed at quote | |
| L-CSF220-AMP-1Y | Cisco Secure Firewall 220 Adv Malware Protec Lic 1YR Subs | 1 year | |
| L-CSF220-AMP-3Y | Cisco Secure Firewall 220 Adv Malware Protec Lic 3YR Subs | 3 years | |
| L-CSF220-AMP-5Y | Cisco Secure Firewall 220 Adv Malware Protec Lic 5YR Subs | 5 years | |
| L-CSF220-BSE= | Cisco Secure Firewall 220 Base License | term confirmed at quote | |
| L-CSF220-T-1Y | Cisco Secure Firewall 220 Threat Defence 1Y Subscription | 1 year | |
| L-CSF220-T-3Y | Cisco Secure Firewall 220 Threat Defense 3Y Subscription | 3 years | |
| L-CSF220-T-5Y | Cisco Secure Firewall 220 Threat Defense 5Y Subscription | 5 years | |
| L-CSF220-TC-1Y | Cisco Secure Firewall 220 TD and URL Lic 1Y Subscription | 1 year | |
| L-CSF220-TC-3Y | Cisco Secure Firewall 220 TD and URL Lic 3Y Subscription | 3 years | |
| L-CSF220-TC-5Y | Cisco Secure Firewall 220 TD and URL Lic 5Y Subscription | 5 years | |
| L-CSF220-TM-1Y | Cisco Secure Firewall 220 TD, Malware Lic 1Y Subscription | 1 year | |
| L-CSF220-TM-3Y | Cisco Secure Firewall 220 TD, Malware Lic 3Y Subscription | 3 years | |
| L-CSF220-TM-5Y | Cisco Secure Firewall 220 TD, Malware Lic 5Y Subscription | 5 years | |
| L-CSF220-TMC-1Y | Cisco Secure Firewall 220 TD, Malware & URL Lic 1YR Subs | 1 year | |
| L-CSF220-TMC-3Y | Cisco Secure Firewall 220 TD, Malware & URL Lic 3YR Subs | 3 years | |
| L-CSF220-TMC-5Y | Cisco Secure Firewall 220 TD, Malware & URL Lic 5YR Subs | 5 years | |
| L-CSF220-URL-1Y | Cisco Secure Firewall 220 URL Filtering License 1YR Subs | 1 year | |
| L-CSF220-URL-3Y | Cisco Secure Firewall 220 URL Filtering License 3YR Subs | 3 years | |
| L-CSF220-URL-5Y | Cisco Secure Firewall 220 URL Filtering License 5YR Subs | 5 years | |
| L-CSF220T-AMP= | Cisco Secure Firewall 220 Adv Malware Protection License | term confirmed at quote | |
| L-CSF220T-T= | Cisco Secure Firewall 220 Threat Defense License | term confirmed at quote | |
| L-CSF220T-TC= | Cisco Secure Firewall 220 Threat Defense and URL License | term confirmed at quote | |
| L-CSF220T-TM= | Cisco Secure Firewall 220 Threat Defense, Malware License | term confirmed at quote | |
| L-CSF220T-TMC= | Cisco Secure Firewall 220 TD, Malware and URL License | term confirmed at quote | |
| L-CSF220T-URL= | Cisco Secure Firewall 220 URL Filtering License | term confirmed at quote |
Threat Defense licences: CSF240P appliance (Threat Defense image)
| Part number | Description | Term | Basket |
|---|---|---|---|
| CSF240P-BSE | Cisco Secure Firewall 240P Base License | term confirmed at quote | |
| CSF240PT-T | Cisco Secure Firewall 240P Threat Defense License | term confirmed at quote | |
| CSF240PT-TC | Cisco Secure Firewall 240P Threat Defense and URL License | term confirmed at quote | |
| CSF240PT-TM | Cisco Secure Firewall 240P Threat Defense, Malware License | term confirmed at quote | |
| CSF240PT-TMC | Cisco Secure Firewall 240P TD, Malware and URL License | term confirmed at quote | |
| L-CSF240P-BSE= | Cisco Secure Firewall 240P Base License | term confirmed at quote | |
| L-CSF240PT-AMP-1Y | Cisco Secure Firewall 240P Adv Malware Protec Lic 1YR Subs | 1 year | |
| L-CSF240PT-AMP-3Y | Cisco Secure Firewall 240P Adv Malware Protec Lic 3YR Subs | 3 years | |
| L-CSF240PT-AMP-5Y | Cisco Secure Firewall 240P Adv Malware Protec Lic 5YR Subs | 5 years | |
| L-CSF240PT-AMP= | Cisco Secure Firewall 240P Adv Malware Protection License | term confirmed at quote | |
| L-CSF240PT-T-1Y | Cisco Secure Firewall 240P Threat Defense 1Y Subscription | 1 year | |
| L-CSF240PT-T-3Y | Cisco Secure Firewall 240P Threat Defense 3Y Subscription | 3 years | |
| L-CSF240PT-T-5Y | Cisco Secure Firewall 240P Threat Defense 5Y Subscription | 5 years | |
| L-CSF240PT-T= | Cisco Secure Firewall 240P Threat Defense License | term confirmed at quote | |
| L-CSF240PT-TC-1Y | Cisco Secure Firewall 240P TD and URL Lic 1Y Subscription | 1 year | |
| L-CSF240PT-TC-3Y | Cisco Secure Firewall 240P TD and URL Lic 3Y Subscription | 3 years | |
| L-CSF240PT-TC-5Y | Cisco Secure Firewall 240P TD and URL Lic 5Y Subscription | 5 years | |
| L-CSF240PT-TC= | Cisco Secure Firewall 240P Threat Defense and URL License | term confirmed at quote | |
| L-CSF240PT-TM-1Y | Cisco Secure Firewall 240P TD, Malware Lic 1Y Subscription | 1 year | |
| L-CSF240PT-TM-3Y | Cisco Secure Firewall 240P TD, Malware Lic 3Y Subscription | 3 years | |
| L-CSF240PT-TM-5Y | Cisco Secure Firewall 240P TD, Malware Lic 5Y Subscription | 5 years | |
| L-CSF240PT-TM= | Cisco Secure Firewall 240P Threat Defense, Malware License | term confirmed at quote | |
| L-CSF240PT-TMC-1Y | Cisco Secure Firewall 240P TD, Malware & URL Lic 1YR Subs | 1 year | |
| L-CSF240PT-TMC-3Y | Cisco Secure Firewall 240P TD, Malware & URL Lic 3YR Subs | 3 years | |
| L-CSF240PT-TMC-5Y | Cisco Secure Firewall 240P TD, Malware & URL Lic 5YR Subs | 5 years | |
| L-CSF240PT-TMC= | Cisco Secure Firewall 240P TD, Malware and URL License | term confirmed at quote | |
| L-CSF240PT-URL-1Y | Cisco Secure Firewall 240P URL Filtering License 1YR Subs | 1 year | |
| L-CSF240PT-URL-3Y | Cisco Secure Firewall 240P URL Filtering License 3YR Subs | 3 years | |
| L-CSF240PT-URL-5Y | Cisco Secure Firewall 240P URL Filtering License 5YR Subs | 5 years | |
| L-CSF240PT-URL= | Cisco Secure Firewall 240P URL Filtering License | term confirmed at quote |
Mounting kits and accessories
Accessories Cisco lists for the 200 Series:
| Part number | Vendor description | Type | Basket |
|---|---|---|---|
| CSF200-WALL-MNT= | Cisco Secure Firewall 200 Series Wall-Mount Kit | Accessory | |
| CSF200-RCKMNT-FX= | Cisco Secure FW RackMount Kit, w/Fixed Brackets for CSF220 | Accessory | |
| CSF200-RCKMNT-SR= | Cisco Secure Firewall RackMount Kit, w/Slide Rails forCSF220 | Accessory | |
| CSF200-CBL-MGMT= | Cisco Secure Firewall 200 Series Cable Management | Accessory | |
| CSF200-ENC-K9 | Cisco Secure Firewall 200 ASA Strong Encryption (3DES/AES) | Accessory |
CSF200-ENC-K9 is the ASA strong encryption (3DES/AES) licence for ASA-image appliances.
Secure Firewall 200 or 1200?
The Secure Firewall 1200 Series is the next range up in Cisco's finder ("Branch"), with compact models from 6.5 Gbps firewall throughput and 1U models with 10G SFP+ ports. Choose the 200 Series for a small branch or shop on a single line; choose the 1200 for more users, more ports or 10G.
How to order
How ordering works. Press Add next to a part number and it goes into your basket; where a security subscription or support contract goes with the firewall, you choose it in the same step. Add any accessories, then View basket and Request a quote. We check every line, quantity and term against your sites and come back with a personalised quote by email. Nothing is charged online. We can also design, supply, stage, install and configure the firewalls, VPNs and policies as a project, with the scope confirmed at quote (see network installation).
Vendor sources
How we can help with your network
Forever Systems can design, supply, stage, install and configure the network around the hardware you buy here, as a project or one step at a time.
- Design: we look at your sites, users and existing kit and size the switches, wireless and firewalls to fit
- Supply: every order gets a personalised quote by part number, with the subscriptions and support each product needs
- Stage: we can pre-configure and label equipment before it reaches site
- Install: we can rack and mount switches, access points and firewalls on site
- Configure: VLANs, wireless, firewall policy, VPNs and management platforms set up and documented at handover
Scope is confirmed at quote, so you only pay for the parts of the project you need.
Frequently asked questions
What is the Cisco Secure Firewall 220?
Cisco's compact desktop branch firewall with 4 x 1000BASE-T and 1 x 1G SFP, ordered with Threat Defense (CSF220-TD-K9) or ASA (CSF220-ASA-K9) software.
What is the difference between the 220 and the 240P?
The 240P has 8 x 1000BASE-T and 2 x 1G SFP, 4 ports of PoE+ (120 W total) and a higher Cisco throughput figure (3 Gbps against 1.5 Gbps FW + AVC + IPS).
What does -TD-K9 mean?
The appliance ships with Cisco Firewall Threat Defense software. -ASA-K9 means it ships with ASA software.
Does the Secure Firewall 220 need a licence?
Threat Defense features such as IPS, URL filtering and malware protection need a T, TC, TM or TMC term licence per appliance. We quote the right one with the hardware.
Can the Secure Firewall 220 be rack-mounted?
Yes. Cisco lists CSF200-RCKMNT-FX= (fixed brackets) and CSF200-RCKMNT-SR= (slide rails) rack kits and a CSF200-WALL-MNT= wall-mount kit.
Ready to order?
Build your basket and check out when you are ready.