How Does FTD Inspect Same-Subnet and Internet Traffic?
An engineer installs a Cisco FTD device and wants to inspect traffic within the same subnet passing through a firewall and inspect traffic destined to the Internet. Which configuration will meet this requirement?
Community Insight
It tests whether you know FTD supports Integrated Routing and Bridging — bridging and routing at the same time in routed mode — and the trap is assuming transparent mode alone, or routed interfaces alone, can meet both halves of the requirement.
Cisco FTD can only inspect traffic that stays inside one subnet by bridging it through a bridge group BVI, while Internet-bound traffic must be routed to another subnet. This page explains why routed firewall mode with a BVI plus routed interfaces (option B) satisfies both requirements on a single FTD.
Option C is the classic wrong pick: engineers assume multiple BVIs in transparent mode give the FTD a path to the Internet, but transparent mode never routes between different subnets, so it cannot serve as the Internet gateway without an external router.
Community Discussion (9 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is correct because the scenario contains two different forwarding requirements that must be met by the same FTD. Same-subnet traffic has no routing decision to make, so it must be bridged: a bridge group with a BVI lets the FTD inspect frames moving between two interfaces in the same Layer 2 domain. Traffic destined to the Internet does require a routing decision, so the FTD needs a routed interface (or a BVI that routes toward one) acting as the default gateway for that subnet. Routed firewall mode supports both constructs simultaneously, which is Integrated Routing and Bridging (IRB), and it is exactly the combination the question describes. As donciga put it, a "BVI / bridge group inspects and forwards traffic between interfaces on the same subnet" while routed interfaces handle other networks.Why the Other Options Are Wrong
Option A fails because transparent mode with only IRB/BVI functionality never routes between subnets, so there is no path for Internet-bound traffic unless an external router exists. Option C is the most tempting distractor, but adding more BVIs only creates more Layer 2 bridge groups — as gaprendizaje wrote, "Having multiple BVIs in transparent mode wouldn't help at all," since each BVI is still a separate bridged domain with no routing between them. Option D fails from the other direction: routed interfaces each belong to their own subnet, so they cannot bridge two interfaces sitting in the same subnet, meaning the same-subnet inspection requirement is never met. Option B is the only choice that provides one mechanism for each half of the requirement.Community Comment Notes
Most learners converge on B — wordisbondkid said it "can fulfill requirements of both," and gaprendizaje described it precisely as "one BVI for same subnet inspection and one routed interface for Internet connectivity." z6st2a1jv gave the decisive technical argument that a "Transparent firewall will not allow the traffic out to the intenet," because it does not route between inside and outside subnets. Kris92 pushed back that the question "doesn't say the traffic needs to be routed by the FTD," which is the fairest objection, but the wording asks for a single configuration that inspects both flows, and only routed mode with a BVI and routed interfaces does that. TodaniTE and tinyJoe voted C, with tinyJoe pointing at the Cisco transparent-versus-routed mode document; that document in fact shows bridge groups in routed mode, which supports the B answer.Official Reference
Exam Strategy
Split the requirement into "bridge it" versus "route it" before looking at the options: same-subnet traffic can only be bridged (BVI/bridge group) and traffic leaving the subnet can only be routed. Then eliminate any single-mode option that cannot do both jobs in one FTD unless the question mentions an external router. Remember the FTD twist that bridge groups can exist inside routed mode, so "routed mode" does not exclude a BVI.
Frequently Asked Questions
Why can't transparent mode with multiple BVIs inspect Internet-bound traffic?
Transparent mode only bridges within the same subnet; it cannot route between inside and outside networks, so Internet traffic would need an external router, unlike option B.
Does FTD routed mode really support a BVI bridge group?
Yes — FTD supports Integrated Routing and Bridging, so a BVI forwards same-subnet traffic while routed interfaces handle traffic to other networks.