Deployment practice questions

An EtherType access list is blocking the encapsulated traffic or ARP requests between the bridge groups.

Transparent firewalls pass IP traffic by default, but non-IP traffic or specific Layer 2 control protocols require EtherType rules, and proper ARP inspection/learning is necessary.

All security modules in the cluster must be identical in model, memory, and interface module composition.

FTD clustering demands hardware uniformity: every chassis must match in model, memory, and interface module composition. Mixed nodes break the cluster's flow distribution and state synchronisation, so identical Secure Firewall 9300 modules are mandatory for the aggregate throughput design.

Configure Source NAT (SNAT) on the FTDv so that traffic appears to originate from the firewall interface IP, ensuring symmetrical return paths.

Using SNAT ensures that return traffic from servers comes back to the firewall instance's IP address rather than directly to the client, preventing asymmetric routing drops.

Interface eth0 must be dedicated exclusively to the management network, and data interfaces must follow a strict sequential mapping starting with eth1.

KVM maps virtual NICs to physical interfaces by PCI slot order, so eth0 must be reserved for management and data interfaces assigned sequentially from eth1; violating this ordering breaks interface mapping and prevents the FTDv from booting correctly.

It ensures that the active unit retains the virtual MAC addresses of the interfaces, preventing the need for downstream switches to relearn MAC-to-port mappings.

MAC address persistence keeps the shared virtual MACs on whichever unit is active, so after failover the new active unit presents identical MACs; downstream switches therefore need not relearn MAC-to-port bindings, avoiding the intermittent drops caused by relearning.

Create an OSPF routing process and define the OSPF area ID in FMC under Device Routing settings.

An OSPF process with a defined area ID must exist before interfaces can participate; the area ID governs which routers form adjacencies. Creating the process and area in FMC's Device Routing settings satisfies the foundational configuration required for adjacency.

Enable OSPF on the desired routed interfaces participating in the routing exchange.

OSPF adjacency requires the protocol enabled on each participating routed interface; without interface-level activation, hello packets are never exchanged. Enabling OSPF on the desired interfaces satisfies the requirement for neighbour discovery and adjacency formation on the Threat Defense device.

The administrator must manage cloud provider route tables (e.g., AWS Route Tables or Azure UDRs) to steer traffic through the firewall ENIs.

Cloud route tables (AWS Route Tables, Azure UDRs) determine where traffic flows, since the hypervisor, not the firewall, controls packet delivery. Steering traffic through the firewall ENIs therefore requires explicit provider-side route configuration, a constraint absent on physical hardware.

The virtual machine instance type dictates the maximum supported throughput, interface count, and CPU/memory allocation.

In cloud deployments the instance type (for example AWS c5.large or Azure D-series) caps throughput, interface count and CPU/memory, because the hypervisor enforces those limits. Physical appliances instead derive capacity from fixed hardware, making this sizing constraint cloud-specific.

Licensing can utilize either Bring Your Own License (BYOL) or Pay-As-You-Go (PAYG) models through marketplace integrations.

Cloud marketplaces offer BYOL and PAYG licensing, letting administrators pay hourly through the provider or reuse existing entitlements. Physical appliances use traditional licensing tied to hardware serial numbers, so marketplace-integrated consumption models are unique to virtual cloud deployments.

A dedicated link must be available to serve as the stateful failover control and health monitoring link.

Active/Standby requires a dedicated failover link carrying stateful failover data plus hello and health-monitoring traffic between peers. Without this separate path, state synchronisation and peer liveness detection cannot function, so the pair will not form.

Both FTD devices must be running the exact same software version and maintenance patch level.

Identical software and patch levels prevent state-sharing and failover failures between the FTD peers, since mismatched builds break the HA heartbeat and configuration synchronisation. This satisfies the stem's prerequisite that both appliances match exactly before forming the Active/Standby pair, ensuring reliable replication and seamless transition.

Both FTD devices must be identical hardware models with matching interface counts and module types.

HA failover requires symmetric hardware: identical FTD models, interface counts and module types, so both units can replicate configuration and pass traffic identically. Mismatched interfaces would prevent standby from taking over the active unit's full role.

One unit is elected as the control node, while the other units function as data nodes sharing the processing load.

Clustering assigns a control role to one module and data roles to the others.

All cluster members share a common configuration and synchronized connection state table across the Cluster Control Link.

Configuration and state are synchronized across members via the CCL.

The firewall operates as a Layer 2 bridge, forwarding frames based on destination MAC addresses.

Transparent mode performs Layer 2 bridging.

Bridge Virtual Interfaces (BVIs) are assigned IP addresses to allow management access and gateway functionality.

BVIs have management IP addresses in transparent mode.

An IP SLA monitor or BFD session configured to periodically ping or probe the target next-hop IP address.

IP SLA or BFD provides the continuous reachability probing that static route tracking depends on; without a monitor generating up/down events against the next-hop, the tracking object has no state to report and failover cannot trigger.

A tracking object that references the IP SLA operation and reports its up/down state.

A tracking object binds the IP SLA operation to the static route, converting probe results into an up/down state that the route monitors. Without it, the SLA probe runs but no route can react, so failover never triggers. This satisfies the stem's requirement for a component linking IP SLA monitoring to static route tracking.

A backup static route configured with a higher metric, tied to the tracking object so it activates when the primary route fails.

A backup static route with a higher administrative distance, bound to the same tracked object, provides the failover path once the primary route is withdrawn. This satisfies the high-availability requirement: when IP SLA detects the primary next hop failing, the tracked object goes down and the floating static route installs into the routing table.

ECMP distributes traffic across multiple equal-cost next-hop routes to optimize bandwidth utilization and path redundancy.

ECMP spreads flows across multiple equal-cost next-hop paths, delivering the bandwidth aggregation and path redundancy the high-availability design requires. On FTD, hashing is per-flow, so a single connection stays on one path, preserving stateful inspection while separate flows balance across links. This satisfies the stem's optimisation and redundancy constraints.

Traffic flow hashing algorithms are used to ensure packets belonging to the same TCP/UDP session take the same path.

ECMP relies on flow hashing, typically a five-tuple hash of source and destination IP, ports and protocol, so every packet in a given TCP/UDP session resolves to one next-hop path. This preserves session symmetry, preventing asymmetric routing that would break stateful inspection across the Threat Defense units.

ECMP can be populated via dynamic routing protocols such as OSPF and BGP, or via static routes with equal metrics.

ECMP on FTD supports population through dynamic routing protocols including OSPF and BGP, as well as static routes configured with equal metrics. This satisfies the stem's requirement for identifying valid ECMP characteristics, since FTD's ECMP implementation relies on the routing table having multiple next-hop entries of identical cost to load-balance traffic.

Configure the firewall data interfaces to operate in passive mode so they do not attempt to forward or drop traffic.

Passive mode prevents the data interfaces from transmitting or dropping frames, which is essential because the Catalyst switch SPAN port only mirrors copies of traffic. Without it, the firewall would attempt to forward or discard the mirrored packets, breaking inspection and potentially disrupting the monitored segment.

Configure a SPAN (Switched Port Analyzer) or RSPAN session on the upstream switch to mirror traffic toward the firewall's passive interface.

A SPAN or RSPAN session copies frames from the monitored switch ports or VLANs and forwards them out the destination port toward the firewall's passive interface. This satisfies the stem's requirement for passive NGIPS inspection, since the firewall analyses mirrored copies without inline placement, preserving traffic flow while receiving the packets it must inspect.

Configure the interface as a routed interface with an IP address, relying on standard Layer 3 routing.

A routed interface operates at Layer 3, terminating the subnet and routing traffic while updating the source and destination MAC addresses.

Enable an Inline Set with Snort Bypass enabled so traffic passes through the hardware interface pair without inspection when Snort is busy.

Snort Bypass lets trusted bulk flows traverse the inline set uninspected when the Snort engine is overloaded, preserving the inline path rather than dropping packets. This directly satisfies the requirement that certain trusted transfers bypass inspection without breaking the inline flow, while other traffic remains analysed.

Both units must have different management IP addresses assigned to their respective management interfaces.

Each unit in an HA pair needs a unique management IP address so FMC can reach and manage both independently; identical addresses would cause an IP conflict and prevent the secondary from registering or receiving configuration.

Azure assigns IP configurations via DHCP directly to each attached virtual NIC, which must correspond to the FMC interface settings.

Azure's platform assigns IP configurations to each attached virtual NIC via DHCP, so the FMC interface settings must match those Azure-assigned addresses. This satisfies the stem's multi-NIC deployment constraint, since Azure controls addressing rather than the firewall appliance itself.

A dedicated high-speed, low-latency Cluster Control Link (CCL) must be connected between all nodes.

A dedicated Cluster Control Link is mandatory because cluster nodes exchange heartbeat, state synchronisation and director-election traffic over it. A high-speed, low-latency link prevents false node failures and keeps stateful failover timely, satisfying the prerequisite that the CCL be connected and configured before cluster initialisation.

All cluster members must be of the exact same physical or virtual model with identical interface counts.

Clustering requires identical hardware or virtual models with matching interface counts, since the cluster operates as one logical device sharing a common configuration. Mixed models would break interface mapping and state synchronisation, so homogeneity must be verified before initialisation.

Data interfaces on all cluster units must be connected to upstream/downstream switches using Port Channels.

Data interfaces must connect via Port Channels (EtherChannels) to upstream and downstream switches, providing the link redundancy and load distribution clustering requires. Bundling links ensures traffic survives individual link failure during failover between cluster members.

The active unit is chosen based on health status, preemption settings, and designated failover priorities.

Failover election combines unit health, preemption configuration, and the assigned failover priorities to determine which appliance becomes active. Priority values break ties when both units are healthy, while preemption settings decide whether a recovered higher-priority unit reclaims the active role, satisfying the stem's requirement to explain how designations and priorities drive failover.

Transparent mode

Transparent mode operates at Layer 2 and bridges traffic without changing subnet schemes.