Exam 300-206 topic 2 question 17 discussion

agreed B D

answer should be B;D not A;B bcz it support site to site vpn Transparent Firewalls Transparent firewalls are known as Bumps in the Wire. They work purely at layer 2 and is not seen as a hop; opposed to layer 3 routed firewalls which decrement TTL. By bridging interfaces the ASA can forward traffic transparently to the end user/device. It is important to remember there are limitations to transparent firewalls in its capabilities and to keep this in mind when designing networks with Cisco ASA firewall. Forwarding is done with destination MAC addresses. Features that are not supported are: • QoS • DHCP relay ○ Cannot be a DHCP server but can pass relay commands with extended ACL • VPN termination ○ only site-to-site VPN for management is supported. • Extended ACLs can pass connections. ○ SSL VPN is not supported. • Dynamic/Multicast Routing ○ Need ACL to pass traffic. • Dynamic DNS It is important to be aware that the address assigned to the BVI is the management IP. This address will not be seen by traffic transiting across the ASA. Each bridge group can support four interfaces whilst each context can have eight bridge groups. We will discuss contexts later.