300-320 · Question #611
During an upgrade of an existing data center, a network team must design segmentation into existing networks. Due to legacy applications, the IP addresses cannot change. Which firewall deployment…
The correct answer is C. transparent mode. Transparent (Layer 2) firewall mode inserts the firewall into an existing network segment without requiring IP address changes, acting as a 'bump in the wire.'
Question
During an upgrade of an existing data center, a network team must design segmentation into existing networks. Due to legacy applications, the IP addresses cannot change. Which firewall deployment model meets these requirements?
Options
- Arouted mode
- Bmulticontext mode
- Ctransparent mode
- Dcluster mode
How the community answered
(37 responses)- A3% (1)
- B5% (2)
- C84% (31)
- D8% (3)
Why each option
Transparent (Layer 2) firewall mode inserts the firewall into an existing network segment without requiring IP address changes, acting as a 'bump in the wire.'
Routed mode assigns IP addresses to firewall interfaces and acts as a Layer 3 hop, requiring IP address changes on surrounding network segments.
Multicontext mode creates multiple virtual firewall instances on a single appliance but does not eliminate the need for IP addressing changes at the segment boundary.
Transparent mode operates at Layer 2, forwarding traffic based on MAC addresses rather than routing it, so existing IP addressing schemes on both sides of the firewall remain completely unchanged - satisfying the legacy application constraint.
Cluster mode groups multiple firewall units for scalability and high availability but still requires normal interface IP addressing and does not avoid IP changes.
Concept tested: Firewall transparent mode Layer 2 deployment
Source: https://www.cisco.com/c/en/us/td/docs/security/asa/asa914/configuration/general/asa-914-general-config/intro-fw.html
Topics
Community Discussion
No community discussion yet for this question.