Cisco ASA Transparent Mode for Same-Subnet Traffic Filtering
Which Cisco ASA deployment model is used to filter traffic between hosts in the same IP subnet using higher-level protocols without readdressing the network?
Community Votes
80% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests ASA deployment modes and transparent mode's Layer 2 filtering capability; the trap is assuming a bridged firewall cannot inspect higher-level protocols.
Cisco ASA transparent mode is a Layer 2 deployment that filters traffic between hosts in the same IP subnet without requiring IP readdressing. This page confirms transparent mode (D) as the correct answer for the 350-701 exam scenario.
Many candidates choose routed mode (C), thinking a firewall must route between subnets to filter traffic, but routed mode would require readdressing the same subnet.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Transparent mode on Cisco ASA operates as a Layer 2 bridge, allowing the firewall to be inserted between hosts in the same IP subnet without changing IP addressing. It can filter traffic using higher-level protocols because ACLs, EtherType filters, and application inspections still apply even though the ASA does not route packets. This matches the question's requirement exactly: same-subnet hosts, higher-level protocol filtering, no readdressing. The suggested answer D is therefore correct, and the vote majority (80 for D) also reflects this. As eafea4l noted, "You can place a transparent firewall between the LAN and the next-hop Layer 3 device" without having to readdress the network devices.Why the Other Options Are Wrong
Multiple context mode (A) partitions a single ASA into multiple virtual firewalls, but it is an administration and virtualization feature, not a deployment model for same-subnet bridging. Single context mode (B) is the default mode where the ASA is one logical device; it does not by itself define how traffic between same-subnet hosts is filtered without readdressing. Routed mode (C) requires each ASA interface to be assigned an IP address and acts as a Layer 3 hop, so deploying it would change the network addressing scheme. Thus, A, B, and C do not satisfy the "without readdressing the network" condition.Community Comment Notes
Commenters were overwhelmingly aligned with transparent mode: eafea4l placed the ASA between the LAN and the next-hop Layer 3 device without readdressing, citing the official SCOR 350-701 cert guide. Premium_Pils linked Cisco community and netseccloud resources on transparent mode, reinforcing that it avoids reconfiguring existing segments. masal pointed out that the reference link confirms D, while GARBADOUR questioned whether transparent mode is "a bridge with no routing capabilities," which is exactly why it can filter same-subnet traffic without readdressing. The apparent tension disappears because transparent mode still enforces ACLs and inspections even though it does not route.Exam Strategy
When you see "without readdressing the network" in an ASA deployment question, immediately eliminate routed mode (C) because it requires interface IPs and Layer 3 hops. Transparent mode (D) is the only option that bridges same-subnet traffic while still enforcing higher-level protocol filters.
Frequently Asked Questions
Why is routed mode wrong when the ASA can also filter same-subnet traffic?
Routed mode requires IP addresses on each interface and routes between subnets, so it would force readdressing. Transparent mode bridges the same subnet and still applies ACLs for higher-level filtering.
Does multiple context mode filter same-subnet traffic without readdressing?
No. Multiple context mode is a virtualization feature that creates separate virtual firewalls; it does not by itself provide Layer 2 same-subnet filtering without readdressing.