Exam 300-710 topic 1 question 15 discussion

Using an inline set interface is a valid approach in some cases, but for extending a user segment through an FTD (Firepower Threat Defense) device in routed mode without creating another IP subnet, the recommended method is using a BVI (Bridge Virtual Interface). An inline set typically involves pairs of interfaces used for transparent or bridged mode, where traffic passes through the FTD device without routing, mainly used for intrusion prevention. In routed mode, using a BVI allows the device to bridge two or more interfaces at Layer 2 while still inspecting traffic at Layer 3 and 4. This allows you to maintain the same IP subnet across these interfaces.

I think the key word is inspection , since you can extend subnet in inline and Bridg group , but the answer is '"A" since the inline set interface is used for inspection .

BVI is for transparent mode

Extending a user segment without creating another segment. I believe only inline set can do it. Because it does not need to setup another IP address. Since the segment is already here, if we use BVI, it still needs to configure IP address and it would not be allowed as there is the same IP segment on one existing interface.

I have done this in a LAB. Option B looks to be correct.

The key here is Extend, so B. You can Have here BVI with no name and in that way the BVI acts as transparent firewall. So with that you have extended LAN network, the Gateway stays the same ( ex. GW is 192.168.1.1 and BVI is 192.168.1.2) so nothing changes for users. If you go with Inline, you do not extend network, Inline only has inline par interfaces and that does not extend the LAN

B. by using a BVI and creating a BVI IP address in the same subnet as the user segment. A Bridged Virtual Interface (BVI) can be configured on an FTD device in routed mode to extend a user segment without the need to create another IP subnet. The BVI is configured with an IP address in the same subnet as the user segment, and the user segment is then connected to one of the switch ports on the FTD device. The BVI is then configured to bridge the traffic between the user segment and the FTD device's inside network, allowing the FTD device to inspect the traffic passing through it.

In: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html Its stated that "The firewall mode only affects regular firewall interfaces, and not IPS-only interfaces such as inline sets or passive interfaces. IPS-only interfaces can be used in both firewall modes. See Inline Sets and Passive Interfaces for Firepower Threat Defense for more information about IPS-only interfaces. Inline sets might be familiar to you as "transparent inline sets," but the inline interface type is unrelated to the transparent firewall mode described in this chapter or the firewall-type interfaces." So Inline Interfaces have nothing to do with this deployment

"without creating another IP subnet". A BVI requires a subnet interface. Inline set acts like layer 2 but can be set up in a FTD in routed mode. No need for creating additionel IP-addresses or l3-interfaces. See "Inline IPS Interfaces" on CBT nuggets, Skill: Cisco Firepower IPS/IDS.

Correct answer is A. "Inline Set, with optional Tap mode—An inline set acts like a bump on the wire, and binds two interfaces together to slot into an existing network. This function allows the FTD to be installed in any network environment without the configuration of adjacent network devices." https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/inline_sets_and_passive_interfaces_for_firepower_threat_defense.html

Answer is A. On question say "FTD Device in Routed Mode". BVI is switched interface mode and only support transparent deployment mode

For me both options A and B are correct. Wording could do the trick here. We do not assign inline sets, we add them an assign interfaces to it.

Correct answer is: B

the question in not clear well

The key is here the "routed mode" statement. Inline set interface can be created only in IPS-only mode, not routed mode. So B is correct.

I think the key here might be the INSPECT keyword as inline-sets are meant to be used in a pure IPS setup that might be what they are hinting at

Answer A is correct