An engineer wants to connect a single IP subnet through a Cisco FTD firewall and enforce policy. There is a requirement to present the internal IP subnet to the outside as a different IP address. What

Configuring NAT on a downstream router bypasses the FTD for NAT functionality, preventing it from consistently enforcing policy with its own NAT rules, which is contrary to the requirement.

Configuring NAT on an upstream router would similarly bypass the FTD for the core NAT function, not fulfilling the requirement for the FTD to manage the IP address presentation.

Implementing Network Address Translation (NAT) to present an internal subnet as a different external IP address is a Layer 3 function. Cisco FTD devices perform Layer 3 functions like NAT and routing when operating in routed mode, allowing them to participate in IP routing between segments and translate addresses.

Transparent mode operates at Layer 2 and does not perform Layer 3 routing or NAT. While it can inspect traffic, it relies on external routers for L3 forwarding and address translation.