Which protocol establishes network redundancy in a switched Firepower device deployment?

In a switched (or transparent) deployment, the Firepower device operates at Layer 2, acting as a "bump in the wire." This mode is used to seamlessly integrate the firewall into an existing network segment. Network redundancy in such a Layer 2 topology is established using Spanning Tree Protocol (STP). STP prevents switching loops, which can occur when multiple paths exist between switches, by logically blocking redundant paths. The Firepower device, by default, forwards STP Bridge Protocol Data Units (BPDUs), allowing the surrounding switches to build a loop-free, redundant topology.

HSRP: This is a Cisco-proprietary Layer 3 protocol used to provide default gateway redundancy, which is not the function of a firewall in a switched/transparent deployment. GLBP: This is a Cisco-proprietary Layer 3 protocol for gateway redundancy and load balancing, which is irrelevant for a Layer 2 firewall implementation. VRRP: This is an IETF standard Layer 3 protocol for first-hop gateway redundancy, which does not apply to a device operating at Layer 2.

1. Cisco Secure Firewall Management Center Device Configuration Guide

7.2

Section: Transparent or Routed Firewall Mode for Firepower Threat Defense > How Transparent Firewall Mode Works

Content: This section explains that in transparent mode

the device acts as a Layer 2 firewall

connecting the same network on its interfaces. This establishes the Layer 2 context where STP operates.

2. Cisco Secure Firewall Management Center Device Configuration Guide

7.2

Section: Transparent or Routed Firewall Mode for Firepower Threat Defense > Guidelines and Limitations for Transparent Firewall Mode > Spanning Tree Protocol

Content: "The FTD in transparent mode forwards Spanning Tree Protocol (STP) BPDUs through the device by default. This allows STP to detect and prevent loops in your network. If you do not want to allow STP to pass through

you can create an access rule to deny BPDUs (destination MAC address 0180.c200.0000)." This directly confirms that STP is the expected protocol for managing the redundant switched topology where the Firepower device is deployed.