199-01 · Question #219
In a Steelhead deployment, the customer decides to use Full Transparency and block all incoming/outgoing TCP connections on port 7800 on their firewall.However, they are finding all TCP connections…
The correct answer is B. "destination oobtransparency"; since the OOB (out-of-band) splice needs transparency also. See the full explanation below for the reasoning.
Question
In a Steelhead deployment, the customer decides to use Full Transparency and block all incoming/outgoing TCP connections on port 7800 on their firewall.However, they are finding all TCP connections are passing through the Steelheads (even ones that should be optimized via the in-path rule set). If Full Transparency uses the original IP addresses and TCP ports for inner connections, what is needed to fix the problem?
Options
- A"no in-path enable"; since we don't really need in-path in this case
- B"destination oobtransparency"; since the OOB (out-of-band) splice needs transparency also
- C"inner connection max 50"; since the default inner connection pool count of 20 is insufficient
- DNo command needed, the connections are really optimized even though we report connections
How the community answered
(61 responses)- A7% (4)
- B75% (46)
- C15% (9)
- D3% (2)
Community Discussion
5
Carlos M.Jun 26, 2026B is correct. Full Transparency keeps the original client IP and port for the inner connection, but the OOB channel also needs transparency configured ("destination oobtransparency") so the firewall sees port 7800 traffic from the expected addresses and allows it through instead of blocking the splice.
Mei-Ling H.Jun 28, 2026Good point on the OOB side, but worth flagging for exam wording: the command is "destination-transparency" under the OOB service policy, not a standalone "oobtransparency" keyword, so if the question gives you an option with that exact syntax it is a trap.
Mei-Ling H.Jun 12, 2026Why does OOB splice transparency affect whether port 7800 gets blocked?
Carlos M.Jun 14, 2026Right, and the short reason is that when a middlebox splices TCP without OOB transparency it strips or mangles the URG pointer, so a stateful inspection engine downstream sees malformed segments on a non-standard port and drops them, which is exactly what bites JGroups traffic on 7800.
Prof. SaraJun 19, 2026Good question to sit with, because the trap here is assuming Full Transparency covers every connection leg between the two Steelheads, when in reality the inner data connection and the OOB splice are separate animals. Before I say more, tell me: when the Steelheads establish that out-of-band control splice to coordinate the optimized session, what IP and port do you think it uses by default, and does your firewall rule account for that path specifically?