CCNA Deployment Questions

Transparent mode forwards traffic without an IP address on the data interfaces, bridging frames at Layer 2 using destination MAC addresses inside a Bridge Group. This satisfies the requirement to pass frames between internal and external interfaces without routing or NAT.

Passive mode copies traffic for inspection without sitting inline, so packets never traverse the sensor. This satisfies the stem's requirement that deployment be non-disruptive to the forwarding path, since a failure of the NGIPS cannot break connectivity.

Transparent mode places the FTD as a Layer 2 bridge, so it forwards traffic based on MAC addresses without altering IP addressing or routing. A bridge group binds the interfaces into a logical bridge, allowing inspection of traffic between the two segments while remaining invisible at Layer 3, which matches the requirement exactly.

VMXNET3 is a paravirtualised adapter designed for VMware, delivering higher throughput and lower CPU overhead than emulated E1000 or flexible adapters. It satisfies the stem's optimal-performance constraint for an FTD virtual appliance on ESXi, where inspection throughput depends heavily on efficient packet handling.

The cluster control link carries heartbeat health checks plus stateful failover traffic — connection state tables and configuration synchronisation — between cluster members. Continuous heartbeats over this dedicated link let each unit detect peer failure, so a node cannot unilaterally assume active status and cause a split-brain condition.

Transparent mode operates as a Layer 2 bridge, forwarding frames without participating in IP routing, so the Threat Defense device can sit inline within an existing subnet while endpoints retain their current default gateway. This directly satisfies the requirement to avoid redesigning gateway or routing configurations during insertion.

Dynamic PAT using the outside interface address allows many inside hosts to share the single dynamic ISP address, which matches the scenario. Manual NAT rules can be added later for static translations, and the automatic NAT rules handle the general inside-to-outside traffic without conflicting.

In routed mode the FTD acts as a Layer 3 hop, so it needs a default or static route pointing to the next-hop gateway to forward traffic off its connected subnets; without it, packets destined beyond directly attached networks are dropped.

State synchronisation between HA peers requires an isolated Layer 2 path, so the dedicated failover/state link carries only failover hello and stateful replication traffic. Mixing this with data or management interfaces risks asymmetric replication and split-brain, so the stem's strict reservation is satisfied only by this dedicated link.

LACP requires at least one side to initiate negotiation. Configuring both peers as active, or one active and the other passive, forms the port channel; if both sides are passive, no LACPDUs are sent and the EtherChannel never negotiates.

In Distributed mode, every cluster member actively processes traffic rather than concentrating flows on a single owner, spreading load across all nodes. This satisfies the scenario's requirement that processing is not centralised on one unit.

Stateful failover replicates the inspection state table, but dynamic NAT translations are synchronised separately. With NAT sync disabled, the standby lacks the translation entries, so returning packets for long-lived TCP flows cannot be untranslated and the connections drop after failover.

The Control Plane IP provides a single, stable management endpoint for the whole cluster, so the FMC registers and manages the cluster as one logical device rather than individual member units. Data Plane IPs handle traffic, while this address carries management and cluster control traffic.

In Active/Standby Threat Defense, interface monitoring tracks designated interfaces; when failures exceed the configured failure threshold count, the standby unit assumes the active role. This satisfies the stem's requirement for an automatic failover trigger, unlike a single transient interface blip.

OSPF on Cisco Secure Firewall Threat Defense requires three distinct steps: global process enablement, area association, and interface-level activation. Because routed interfaces bound to security zones only participate once OSPF is enabled on them, all three are mandatory for dynamic routing across zones.

GigabitEthernet0/0 serves as the dedicated management interface on a virtual FTD, carrying administrative traffic such as SSH, HTTPS, and the FDM or FMC registration channel. This satisfies the stem's constraint by separating out-of-band management from data-plane interfaces, so device administration remains reachable independently of inspected traffic.

Firepower Management Center is the only component that provides centralised policy, event and device management across multiple FTD appliances. Distributed deployments require FMC to push unified access control, intrusion and malware policies to every managed device, satisfying the stem's mandatory central management constraint.

FTD HA requires a dedicated failover link carrying hello, stateful failover and role-election traffic between peers. Configuring that interface and its IP addressing during initial setup is mandatory; without it the pair cannot form or synchronise state.

Inline inspection maintains per-flow state, so both directions of a TCP session must traverse the same device. Asymmetric routing breaks this, causing dropped or reset connections; the constraint is that flow symmetry must be preserved across the inline pair.

FTDv runs as a virtual machine on ESXi, delivering the same unified NGFW/NGIPS feature set in virtualised form. This satisfies the deployment-method requirement by using a supported hypervisor rather than dedicated hardware, enabling flexible placement in virtualised data centres.

The configure manager add command on the FTD CLI supplies the management center address and a registration key, which allows the device to initiate the registration handshake. This is the required first step before the management center can discover and add the device.

The Control Link is the dedicated interface over which the master and slave units exchange state and configuration data, satisfying the requirement for control plane communication in an FTD cluster. It carries heartbeat and synchronisation traffic, distinct from the data and replication links, ensuring cluster state stays consistent across units.

Hardware bypass pairs use an external bypass switch that physically bridges the two inline interfaces when the FTD software process or power fails, so traffic keeps flowing without inspection. This directly satisfies the stem's requirement for uninterrupted traffic during software failure, which software-based fail-to-wire cannot guarantee.

Passive mode satisfies the stem's no-blocking constraint because the FTD interfaces receive copies of traffic rather than sitting inline, so packets are analysed and events generated without any forwarding decision or drop action. Unlike inline sets or routed modes, it cannot interrupt flows, making it ideal for pure monitoring.

A security zone is a logical grouping that can contain multiple interfaces, including physical ports, subinterfaces, and EtherChannels. Grouping them lets one zone apply consistent policy to several interfaces, satisfying the rule that zones aggregate interfaces.

Transparent mode uses a bridge group virtual interface (BVI) to forward traffic at Layer 2 without altering IP headers. Assigning physical interfaces to the bridge group and adding VLAN subinterfaces allows the device to bridge multiple VLANs transparently, meeting both requirements.

A routed interface is a Layer 3 interface assigned an IP address, supporting static routes, dynamic routing protocols and NAT, which ISP handoffs require. It satisfies the ISP connectivity requirement because the FTD must route traffic between the internet-facing link and internal networks, unlike a transparent Layer 2 interface.

Fv in AWS supports both Smart Licensing bring-your-own-licence and Pay-As-You-Go purchased through the AWS Marketplace. BYOL suits existing entitlements, while PAYG bills hourly through AWS, satisfying the throughput and feature-activation licensing requirement for cloud deployment.

The interface Name is a logical label that security policies and NAT rules reference instead of a physical identifier, letting rules survive interface changes. This satisfies the requirement to identify the interface within policy and NAT configuration.

A Track object polls the IP SLA operation's return code, translating reachability into a tracked state that route injection can reference. This satisfies the stem's requirement for static route tracking, because without a Track object the SLA probe's results never influence the route table, leaving the static route permanently installed regardless of path failure.

Preempt lets a higher-priority unit reclaim the active role once it recovers, which is exactly the behaviour described. Disabling preempt would keep the standby unit active after failover, avoiding the secondary interruption caused by the recovered unit seizing control again.

Snort Bypass is an inline-set-specific feature: when the inspection engine is overloaded, it lets packets pass uninspected rather than dropping them, preserving availability. Passive interfaces cannot bypass because they never forward traffic, so this behaviour satisfies the inline deployment constraint in the stem.

The CCL carries state synchronisation, heartbeats and failover traffic between cluster nodes, so it needs a dedicated Layer 2 segment with high bandwidth and low latency. Sharing it with data traffic or routing it at Layer 3 would break clustering.

Cluster stability depends on all nodes being managed consistently, so synchronised FMC management ensures uniform policy and configuration across every unit. This satisfies the stem's requirement for a critical feature, since divergent management causes inconsistent cluster behaviour and node instability.

The master unit assigns flow ownership across the FTD cluster, directing each new connection to a specific slave for processing. This satisfies the stem's requirement for the unit responsible for distributing flows, since the master handles centralised load-balancing decisions while slaves forward the traffic themselves.

The FTD initiates an outbound TCP connection on port 8305 to the manager's IP address or registration FQDN, which is how registration and subsequent management traffic are established. This satisfies the prerequisite that connectivity must originate from the managed device toward the management platform.

Link Aggregation Control Protocol actively negotiates link bundling with the peer and monitors member state, so it can be used on Threat Defense port channels. It satisfies the requirement for a supported dynamic aggregation method rather than static configuration alone.

NAT tables are synchronised across the failover link so translated flows survive a unit switch. This satisfies the stem's synchronisation requirement, preserving address translation state and preventing existing connections from breaking during FTD high availability failover.

Separating management, internal and external traffic onto distinct virtual NICs prevents management-plane contention with data-plane throughput, satisfying the performance constraint. It also preserves out-of-band management reachability if a data interface fails, supporting availability. AWS and Azure both cap single-NIC bandwidth, so multiple interfaces aggregate capacity.

Active/Standby is a valid FTD high availability mode, pairing two appliances so one actively forwards traffic while the peer stays ready to assume the role. It satisfies the question's requirement for a legitimate HA mode, alongside Active/Active, using stateful failover over a dedicated link.

Routed mode makes the FTD a Layer 3 hop, with each interface on a distinct IP subnet, so it forwards between networks and applies NAT translation. Transparent mode bridges at Layer 2 without NAT, and passive mode only monitors, so routed mode satisfies both constraints.

Editing the static route under Devices > Device Management > Routing > Static Route lets you attach a Track object, so the route is withdrawn from the routing table when the tracked object goes down. This satisfies the stem's requirement that link failure removes the route, and FMC pushes the tracked static route configuration to the managed threat defence device.

Port Channel aggregates multiple physical links into one logical interface, using EtherChannel to load-balance traffic and provide link redundancy. This satisfies the requirement for handling traffic across several physical links as a single logical interface.

LACP negotiates the aggregation between devices.

Transparent Mode lets FTD sit inline as a bump-in-the-wire without re-addressing the existing network, so it can be inserted into an L2 segment without changing IP routing or topology, satisfying the simplified L2 insertion reason.

RAM governs the size of connection and translation tables the FTD can hold, plus Snort inspection memory. Under-provisioning causes table exhaustion and dropped flows, so provisioned RAM directly caps throughput and concurrent-session capacity in virtual deployments.

A trunk port carries multiple VLANs tagged with 802.1Q headers, so the FTD must terminate those tags on a sub-interface. Each sub-interface maps a VLAN tag to a logical interface, letting one physical port serve several VLANs, which a plain physical interface cannot.

In FTD clustering, the flow owner is the single unit that holds and maintains the connection state for a given flow, ensuring stateful inspection consistency. Other units forward that flow's packets to it, satisfying the traffic distribution definition.

In public clouds, FTDv cannot rely on traditional Layer 2 failover, so it must integrate with cloud route tables to redirect traffic during failover. This satisfies the stem's requirement by addressing the routing mechanism needed for HA in that environment.

Static route tracking monitors a specified target with ICMP probes, withdrawing the route from the routing table when that target becomes unreachable. This satisfies the stem's requirement by ensuring traffic only follows a path verified as live, rather than blackholing packets through a failed next hop.

Transparent mode uses a Bridge Virtual Interface grouping two interfaces into a bridge group, forwarding frames at Layer 2 without altering IP headers or performing routing; this lets the firewall sit inline between segments on the same subnet.

An Up/Down port channel means the interface is administratively up but the bundle is not operational. Mismatched LACP settings between member links prevent the channel from forming, leaving the aggregate down while physical ports remain up.

A SPAN or TAP port delivers a mirrored copy of production traffic, so the NGIPS analyses packets out-of-band without sitting inline. This satisfies the passive-mode constraint: no traffic traverses the appliance, so inspection cannot drop, delay, or alter production flows, while full detection and monitoring continue.

Stateful failover requires a dedicated failover and state link to replicate connection state between peers. If this interface lacks physical connectivity or matching configuration, units still pass traffic independently but cannot synchronise state, so failover breaks.

The 'show cluster info' and 'show cluster state' commands expose node membership, roles and synchronisation status directly from the firewall CLI. They confirm whether the data node has joined the cluster and whether configuration is in sync, isolating the failure to membership or replication.

The cluster control link carries heartbeat and health-check messages between FTD nodes, letting each unit detect peer liveness and trigger failover when a node stops responding. This satisfies the stem's requirement for the mechanism determining whether a node remains active within the cluster.

Manual NAT processes rules in order, so placing an identity rule for traffic to the internal server farm above the dynamic PAT rule ensures that server-bound traffic is not translated while internet-bound traffic is translated to the outside interface. This ordering gives precise control and satisfies both requirements in a single policy.

Identical software versions are mandatory because configuration and state synchronisation between FTD HA peers relies on matching internal schema and database formats. A version mismatch prevents the active unit from replicating configuration and connection state to the standby, breaking failover. This directly satisfies the stem's requirement for successful synchronisation across both units.

Loss of heartbeat on the failover link causes the standby unit to assume the active peer has failed, so it transitions itself to Active and takes over traffic forwarding. This split-brain risk is why a dedicated, reliable failover link is required.

Port Channels aggregate multiple physical links into one logical EtherChannel, providing the bandwidth and even traffic distribution clustered Threat Defense nodes require across the switch infrastructure. The stem's scaling constraint is satisfied because the cluster's inter-node and data traffic spreads across bundled links, preventing any single uplink becoming a bottleneck.

Non-Promiscuous mode makes the interface accept only frames addressed to its own MAC. Traffic forwarded by an upstream device to other destinations is therefore ignored, so the FTD cannot inspect flows not explicitly directed at it.

Security Zones bind one or more interfaces into a named logical group, so Access Control Policy rules reference the zone rather than individual interfaces. This satisfies the requirement for simplified, consistent policy application across the Threat Defense device's interfaces.

FTDv sizing determines the vCPU, memory and disk allocation needed to sustain the targeted throughput; under-provisioning causes packet drops and unsupported performance. Meeting Cisco's published sizing guidelines is therefore a prerequisite for proper operation on VMware ESXi.

Cluster control traffic carries heartbeat and state replication, so it demands a dedicated, low-latency link isolated from data interfaces. Sharing that path with data traffic introduces latency and jitter that can trigger false failover or split-brain conditions.

User Defined Routes override Azure's system routes, so asymmetric or misdirected traffic between the external and internal ENIs causes the intermittent drops described. Verifying UDR entries confirms each subnet steers packets to the correct FTDv interface, satisfying the stem's requirement to check Azure-side routing configuration.

The frequency interval sets how often the tracking probe is sent to the target, expressed in seconds. It satisfies the stem's requirement by defining probe timing, whereas the timeout value governs how long the system waits before declaring the tracked object unreachable.

The sftunnel uses encrypted TLS for management.

ECMP hashes each flow's 5-tuple (source/destination IP, source/destination port, protocol) to one next hop, so every packet in a TCP session follows the same path and session state stays consistent across the two upstream routers.

The BVI acts as the L3 interface for the transparent firewall, allowing management traffic.

The Management Interface carries management-plane traffic between the FTD virtual instance and its manager, so it satisfies the requirement to communicate with the FMC. Deployments register, receive policy, and send events over this dedicated interface, keeping management traffic separate from the data interfaces that handle inspected user traffic.

Three missed heartbeats trigger a failover: the standby assumes the Active role, since the primary is presumed failed. This satisfies the HA requirement that traffic continues uninterrupted when the primary stops responding, with the standby taking over within the configured hello and hold-time thresholds.

LACP dynamically negotiates which interfaces join the EtherChannel and continuously monitors member links via its control protocol, detecting failures and removing failed links from the bundle. This satisfies the stem's requirement for automated negotiation and failure detection, unlike static EtherChannel modes such as "on", which provide neither.

An SLA Monitor object defines the ICMP echo reachability check that static route tracking polls; the route's tracked object references it, so failure of the primary ISP's monitored address withdraws the route and traffic fails over to the secondary ISP.

Fail Open with hardware bypass lets traffic continue passing through the inline pair if the device loses power or panics. The bypass-capable network module physically bridges the interfaces, satisfying the requirement for uninterrupted flow during failure.

A registration key authenticates the FTD to the FMC during initial registration, satisfying the requirement for a secure management channel. Without it, the FMC cannot establish the management connection needed to configure and monitor the device. The key must be generated on the FMC and entered on the FTD within the timeout window.