352-001 · Question #315
Which two options are characteristics of firewall transparent mode operations in a firewall solution design? (Choose two.)
The correct answer is B. OSPF adjacencies can be established through the firewall. D. Multicast traffic can traverse the firewall.. In transparent mode, a firewall is a Layer 2 bump-in-the-wire that passes routing protocol packets and multicast traffic without altering IP addressing or participating in spanning tree.
Question
Which two options are characteristics of firewall transparent mode operations in a firewall solution design? (Choose two.)
Options
- AThe firewall acts like a router hop in the network.
- BOSPF adjacencies can be established through the firewall.
- CChanges in the existing IP addressing and subnets are required.
- DMulticast traffic can traverse the firewall.
- EThe firewall can participate actively on spanning tree.
How the community answered
(30 responses)- A17% (5)
- B73% (22)
- C7% (2)
- E3% (1)
Why each option
In transparent mode, a firewall is a Layer 2 bump-in-the-wire that passes routing protocol packets and multicast traffic without altering IP addressing or participating in spanning tree.
Acting as a router hop - having IP addresses on each interface and routing traffic between subnets - is the behavior of routed mode, not transparent mode, which operates purely as a Layer 2 bridge.
In transparent mode the firewall operates at Layer 2 and does not terminate IP routing, so OSPF hello packets traverse the firewall unmodified and routers on each side can establish full adjacencies as if the firewall were absent. This is a primary use case for transparent mode - inserting security inspection without disrupting an existing routing design.
Transparent mode explicitly requires no changes to existing IP addressing or subnets, which is the opposite of what this choice states and is one of its key operational advantages over routed mode.
Transparent mode firewalls pass multicast traffic because they perform Layer 2 bridging and do not require IP-level multicast routing configuration to forward multicast frames. This allows multicast group memberships and data streams to cross the firewall boundary transparently without any multicast-specific firewall policy.
In transparent mode the firewall passes BPDUs through but does not run the spanning tree algorithm as a bridge node or generate its own BPDUs, so it does not actively participate in spanning tree as this choice claims.
Concept tested: Firewall transparent mode Layer 2 bridging and traffic passthrough behavior
Source: https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/general/asa-96-general-config/intro-fw.html
Topics
Community Discussion
No community discussion yet for this question.