IRB Support in Transparent vs Routed Mode on NGFW
Short answer
B IRB is supported only in routed mode because transparent mode operates exclusively at Layer 2 bridging without Layer 3 routing interfaces like the BVI.
Question
Key Takeaways
The main trap is confusing the ability to create bridge groups in transparent mode with the ability to use IRB; IRB requires a Layer 3 BVI interface, which is exclusive to routed mode.
Learn why Integrated Routing and Bridging (IRB) is restricted to routed mode on Cisco NGFWs, as transparent mode handles only Layer 2 bridging without Layer 3 routing capabilities.
Common mistake: Candidates often choose Option D, believing that since static routes can be added for locally generated traffic in transparent mode, full routing (including IRB) is supported. However, IRB specifically refers to inter-vlan or inter-subnet routing via a BVI, which is not present in transparent mode.
Expert Analysis
Transparent Mode vs. Routed Mode Fundamentals
The core concept tested here is the distinction between Layer 2 bridging and Layer 3 routing within Cisco Next-Generation Firewall (NGFW) operational modes. Transparent mode operates strictly at Layer 2, acting as a "stealth" bridge that forwards frames based on MAC addresses without inspecting or modifying IP headers for routing purposes. In this mode, the firewall does not participate in IP routing; it simply passes traffic between connected segments.
Integrated Routing and Bridging (IRB) Constraints
IRB is a feature that allows a single device to perform both bridging and routing. It achieves this by using a Bridge Group Virtual Interface (BVI) as a Layer 3 interface. While IRB can be used in conjunction with bridge groups, its defining characteristic is the assignment of an IP address to the BVI to enable routed traffic flow. This functionality is inherently tied to Routed Mode, where interfaces are configured as Layer 3 ports or members of a bridge group that uses an IRB interface for gateway services.
In Transparent Mode, there is no BVI interface used for routing decisions because the device does not route. Although you can create Bridge Groups in transparent mode, they function purely as Layer 2 domains. The comments highlight confusion regarding the word "also" in documentation, but the critical distinction is that IRB requires a Layer 3 interface (the BVI) to function, which is not a standard component of pure transparent bridging operations. Therefore, stating that IRB is supported only in routed mode is the most accurate reflection of the architectural boundary: if you need IRB, you are effectively operating in a routed context, even if some interfaces are bridged.
Why Other Options Are Incorrect
Option A suggests an external switch is required, which is irrelevant to the internal configuration capability of the NGFW. Options C and D suggest configuring IPv4 routes on specific interfaces. In transparent mode, you cannot configure IP addresses on physical interfaces (they remain unaddressed), and while you can add static routes for traffic originating from the firewall itself, you do not configure routing tables on interfaces for forwarding traffic through the bridge. The fundamental limitation is that IRB, by definition, relies on the BVI mechanism which is a routed-mode construct.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
When analyzing firewall mode questions, immediately check the OSI layer of operation. If the question involves 'bridging,' 'transparent,' or 'MAC addresses,' assume Layer 2 only. If it involves 'routing,' 'IP addresses,' or 'BVI,' assume Layer 3/Routed. Never assume Layer 3 features exist in Layer 2-only modes unless explicitly stated as a hybrid exception, which is rare for IRB.
Frequently Asked Questions
Can I configure IP addresses on physical interfaces in transparent mode?
What is the BVI interface used for?
Community Votes
50% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
gaprendizaje 👍 1 Answered BB is correct to me. IRB is only suported in routed mode. Transparent mode is only bridging, no routing. https://www.cisco.com/c/en/us/td/docs/security/firepower/70/fdm/fptd-fdm-config-guide-700/fptd-fdm-interfaces.html#:~:text=In%20routed%20mode%2C%20you%20can%20also%20use%20Integrated%20Routing%20and%20Bridging
-
Jackiesteele69 👍 1 Answered Dper the configuration guide for transparent mode: You can, however, add static routes for traffic originating on the Firewall Threat Defense device for bridge group member interfaces. You can also allow dynamic routing protocols through the Firewall Threat Defense device using an access rule.
-
kvothe86 👍 1B is wrong. In your source, it is written “In routed mode, you can also use Integrated Routing and Bridging with some interfaces as bridge group members and others as Layer 3 interfaces” Key word is “also” not “only”
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.