How Do You Configure a BVI for FTD Transparent Mode in FMC?
An administrator configures a Cisco Secure Firewall Threat Defense device in transparent mode. To configure the BVI, the administrator must: • add a bridge-group interface • configure a bridge-group ID • configure the bridge-group interface description • add bridge-group member interfaces How must the engineer perform these actions?
Community Insight
It tests whether you know that Firepower Management Center treats an unnamed interface as unusable — including a BVI and the physical interfaces that join the bridge group — while the trap is reaching for the Layer 3 attribute (an IP address) simply because a BVI looks like a routed interface.
For a Cisco Secure Firewall Threat Defense device in transparent mode, the bridge virtual interface (BVI) and its member interfaces must each be given a logical name in Secure Firewall Management Center before the bridge group can be saved and used in policies. This page establishes that, of the actions listed, configuring a name for the bridge-group interface (C) is the step that makes the BVI configuration take effect.
Most learners choose B and configure an IP address for the bridge-group interface, because the BVI is commonly described as the 'routed-style' interface of a transparent deployment; an address gives the BVI Layer 3 reachability but is not the field that is missing from the listed BVI-creation workflow in FMC.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
In FMC, an interface is only usable once it carries a logical name: that name is the handle referenced by security zones, access control, NAT, platform settings and reporting, and an unnamed interface stays effectively disabled on the Interfaces tab. The described workflow — add the bridge-group interface, set the bridge-group ID, enter a description, add member interfaces — never produces a functioning BVI until the Name field is populated, and the same rule applies to each physical member interface that must be associated with the BVI. This matches the single learner comment on the question, where federicopolenta answered C and observed that without an assigned name "the physical interface cannot be associated with the BVI interface". Configuring a name for the bridge-group interface is therefore the action that actually makes the transparent-mode bridge group operative.Why the Other Options Are Wrong
A is tempting because Cisco best practice is to place the BVI and its members in the same security zone, but zone assignment is a policy-scoping choice, not a prerequisite for creating the bridge group interface. B describes the BVI's IPv4/IPv6 addressing, which provides Layer 3 presence and lets the FTD route between the bridged segment and other networks — useful, but optional and not what completes the listed steps. D is invalid because routed versus transparent is a device-level firewall mode, not a per-interface setting; the scenario already states the device is in transparent mode, so there is no interface mode to toggle in FMC. That leaves C as the only option that is both required and consistent with how FMC validates interface configuration.Community Comment Notes
Only one comment is recorded, from federicopolenta, who selected C and tied it directly to FMC's naming requirement for bridge-group members. There is no dissenting opinion to weigh against it, and the single like is weak evidence on its own — the value here is the reasoning rather than the vote count. Treated as a hypothesis, the comment's reasoning holds up against FMC behavior, which is why C is confirmed as the answer on this page. Anyone reviewing the BVI topic should remember that the naming rule applies to both the BVI itself and every physical interface you drag into the bridge group.Exam Strategy
When a 300-710 question mentions bridge groups or a BVI, check for the interface-name requirement first: FMC considers an unnamed interface unusable, and bridge-group members must be named before they can join the BVI. Also remember that transparent versus routed is a device-level firewall mode, which quickly eliminates distractors about setting an interface's mode.
Frequently Asked Questions
Why must you configure a name for the bridge-group interface in FMC?
FMC only lets you use an interface that has a logical name, because that name is what security zones, NAT and access policies reference. An unnamed BVI stays unusable.
Does a BVI need an IP address in FTD transparent mode?
Not strictly. The BVI only needs an address if the FTD must route between the bridged segment and other networks; pure Layer 2 bridging works without one.