An engineer installs a Cisco FTD device and wants to inspect traffic within the same subnet passing through a firewall and inspect traffic destined to the Internet. Which configuration will meet…

Question

Options

• Atransparent firewall mode with IRB only
• Brouted firewall mode with BVI and routed interfaces
• Ctransparent firewall mode with multiple BVIs
• Drouted firewall mode with routed interfaces only

• A
  17% (3)
• B
  6% (1)
• C
  72% (13)
• D
  6% (1)

Explanation

The requirement has two parts: (1) inspect traffic between hosts on the same subnet (intra-subnet), and (2) inspect traffic destined to the Internet. Transparent mode is required for intra-subnet inspection because routed mode cannot forward traffic between hosts in the same IP subnet (it would need different subnets on each interface). Using multiple Bridge Virtual Interfaces (BVIs) in transparent mode allows the FTD to create separate bridge groups-one for the internal segment to inspect same-subnet traffic, and another that connects to the outside/Internet-facing interface. This configuration satisfies both requirements simultaneously. Pure routed mode (B or D) cannot inspect same-subnet traffic. Transparent mode with IRB only (A) does not provide the flexibility of multiple bridge domains needed for both use cases.

No community discussion yet for this question.