Exam 300-710 topic 1 question 142 discussion

The Cisco FTD configured with two physical interfaces assigned to a BVI and connected to different VLANs on the same switch is set up to support the transparent firewall mode. In transparent mode, the firewall operates at Layer 2, and does not modify the IP address or MAC address of the packets passing through it. In this mode, the firewall is transparent to the devices on either side of it, and can be inserted into the network without changing the IP addressing or topology.

Transparent Mode the FTD acts as a "bump in the wire" or a Layer 2 bridge between network segments. It does not route traffic (like in Routed Mode) but instead forwards traffic between interfaces based on Layer 2 information (MAC addresses). The use of a BVI allows the FTD to bridge traffic between the two physical interfaces while applying security policies.

Transparent. This mean 2 brigde group, 2 BVI IPs.

About Transparent Firewall Mode: Layer 2 connectivity is achieved by using a "bridge group" where you group together the inside and outside interfaces for a network, and the FTD device uses bridging techniques to pass traffic between the interfaces. Each bridge group includes a Bridge Virtual Interface (BVI) to which you assign an IP address on the network. You can have multiple bridge groups for multiple networks. In transparent mode, these bridge groups cannot communicate with each other. https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html

Actually, BVI can run in both routed and transparent. In this situation I think it is transparent. Here is what AI has to say about it: On the Cisco Firepower Threat Defense (FTD) device, you can use a Bridge Virtual Interface (BVI) in both transparent and routed firewall modes. In transparent mode, Layer 2 connectivity is achieved by using a "bridge group" where you group together the inside and outside interfaces for a network, and the FTD device uses bridging techniques to pass traffic between the interfaces. Each bridge group includes a BVI to which you assign an IP address on the network¹. In routed mode, the FTD device routes between BVIs and regular routed interfaces. If you do not need clustering or EtherChannel member interfaces, you might consider using routed mode instead of transparent mode². Is there anything else you would like to know? 😊

A bridge group is a group of interfaces that the FTD device bridges instead of routes. All interfaces are on the same network. The bridge group is represented by a Bridge Virtual Interface (BVI) that has an IP address on the bridge network. You can route between routed interfaces and BVIs, if you name the BVI. In this case, the BVI acts as the gateway between member interfaces and routed interfaces. If you do not name the BVI, traffic on the bridge group member interfaces cannot leave the bridge group. Normally, you would name the interface so that you can route member interfaces to the internet. One use for a bridge group in routed mode is to use extra interfaces on the FTD device instead of an external switch. You can attach endpoints directly to bridge group member interfaces. You can also attach switches to add more endpoints to the same network as the BVI.

To me routed is the right answer because each interface is on a different VLAN, if you have a regular bump in the wire configuration like transparent mode you won't be able to route traffic to each other, so you will need to have a bridge group in routed mode.

C for sure