A network engineer implements a new Cisco Firepower device on the network to take advantage of its intrusion detection functionality. There is a requirement to analyze the traffic going across the device, alert on any malicious traffic, and appear as a bump in the wire How should this be implemented?

The requirement for the Cisco Firepower device to act as a "bump in the wire" explicitly calls for a transparent, Layer 2 deployment. In this mode, the device is inserted into a network segment without being a routed hop, meaning no IP addressing or default gateway changes are needed on adjacent devices. To achieve this, interfaces are configured into a bridge group, which allows the device to pass traffic between the interfaces at Layer 2 while still inspecting it for threats. This configuration fulfills the requirement to analyze traffic transparently.

A. Specify the BVl IP address as the default gateway for connected devices. A Bridge Virtual Interface (BVI) is used for management in transparent mode, not for routing user traffic. Making it a default gateway implies Layer 3 functionality, which contradicts the "bump in the wire" model.
B. Enable routing on the Cisco Firepower. Enabling routing places the device in Routed Mode (Layer 3), where it acts as a router hop. This is the opposite of a transparent, "bump in the wire" deployment.
C. Add an IP address to the physical Cisco Firepower interfaces. Assigning IP addresses to physical data interfaces is characteristic of Routed Mode. In Transparent Mode, only the management BVI has an IP address; the bridged physical interfaces do not.

1. Cisco Secure Firewall Management Center Device Configuration Guide

Version 7.2

Chapter: "Transparent or Routed Firewall Mode for Secure Firewall Threat Defense".

Section: "Transparent Firewall Mode"

Quote: "When you configure a transparent firewall

you are placing a Layer 2 firewall in the path of network traffic... Because the firewall is not a routed hop

you can easily introduce a transparent firewall into an existing network."

Quote: "You must configure a bridge group for a transparent firewall. A bridge group is a group of interfaces that the security appliance bridges."

2. Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager

Version 6.4

Chapter: "Interfaces".

Section: "Transparent Mode"

Quote: "In transparent mode

the Firepower Threat Defense device acts as a 'bump in the wire

' or a 'stealth firewall

' and is not seen as a router hop to connected devices. You must group the inside and outside interfaces together in a bridge group."