Most engineers think…
Most people assume that if FTD 'sees' a malicious packet, it blocks it. That assumption is wrong often enough to fail an interview and to let a real attack through in production.
Whether FTD can drop a packet depends on the interface mode, not just the policy. An inline pair sits in the traffic path and can drop; an inline tap inspects a copy and can only alert; and passive/SPAN receives a mirror and never drops. On top of that sits device-wide firewall mode — routed or transparent. Knowing which mode can actually act on traffic is the difference between a firewall that protects and one that just watches.
① Firewall mode — routed vs transparent
The first choice is device-wide: an FTD runs in one firewall mode for the whole device. Routed mode is the default and the common case — the firewall is a routed L3 hop. Each interface has an IP address, and the device does routing, NAT and VPN. You point networks at it as a gateway.
Transparent mode makes the firewall an L2 bump-in-the-wire. It bridges between interfaces on the same subnet using a Bridge Virtual Interface (BVI), so you can drop it into an existing segment without re-IP-ing the network. The hosts keep their addresses and never know a firewall appeared between them.
The interview line: routed = an L3 gateway that routes/NATs/VPNs; transparent = an invisible L2 bridge (BVI) you insert without re-addressing. Firewall mode is per device, not per interface.
In interviews, say it cleanly: firewall mode (routed or transparent) is set device-wide; interface mode (inline pair, inline tap, passive) is per interface and decides whether you can act on traffic. Conflating the two is the classic FTD slip — keep them in separate sentences.
Which firewall mode lets you insert FTD into an existing segment without re-IP-ing the hosts?
② Inline IPS — inline pair vs inline tap
Once firewall mode is set, each interface gets an interface (IPS) mode that decides whether it can act. An inline pair places two interfaces directly in the traffic path; packets physically pass through FTD, so Snort can drop a malicious packet before it reaches the destination. This is true IPS — active blocking.
Why inline tap is different
An inline tap also sits in the path, but FTD inspects a copy and forwards the original regardless. It tells you what would have been blocked without risking the live traffic — perfect for tuning an IPS policy before you commit to dropping. The catch: inline tap cannot stop the attack; it only alerts.
The interview line: inline pair = in the path, can drop; inline tap = inspects a copy, alerts only. If the requirement is 'block it', you need an inline pair, not a tap.
Routed = an L3 gateway that does routing, NAT and VPN (the default). Transparent = an L2 bridge using a BVI that you insert without re-IP-ing the network.
Two interfaces in the traffic path — packets pass through FTD, so Snort can DROP a malicious packet. This is active IPS blocking.
Inspects a copy while forwarding the original; tells you what would be blocked. Cannot drop — perfect for tuning before you go inline.
Receives a mirrored copy (SPAN locally, or GRE-encapsulated for ERSPAN). Monitor only — alerts on threats but never drops a packet.
▶ Watch an inline pair drop a malicious packet
How an inline IPS pair stops an attack in the path. Press Play for the healthy drop, then Break it to see why passive mode fails.
Which interface mode can actually DROP a malicious packet?
③ Monitor-only — passive/SPAN & ERSPAN
Sometimes you only want visibility, with zero risk to traffic. In passive (SPAN) mode the FTD interface receives a mirrored copy of traffic from a switch SPAN/mirror port. FTD is not in the path: it can detect threats and raise events, but it can never drop a packet, because the real packet already went on its way.
ERSPAN is the same idea over distance: the mirrored traffic is encapsulated in GRE and sent to FTD across a routed network, so the monitoring sensor does not need to be cabled next to the source switch. It is still passive — alerts only, no dropping.
The interview line: passive/SPAN and ERSPAN are monitor-only — great for evaluation and visibility, but they alert and never block. If you must stop traffic, you cannot do it from a passive interface.
A very common production miss: an IPS in passive/SPAN mode raises beautiful alerts but never stops anything, because it only sees a copy. If the requirement is to actually block, a passive (or inline tap) interface cannot do it — you must move to an inline pair.
What is true of a passive/SPAN interface when it detects an attack?
④ Choosing a mode + security zones
Now put it together. Use passive/SPAN (or ERSPAN) when you want to evaluate FTD or gain visibility with no risk — a proof of concept, or watching a sensitive segment. Use an inline pair when you need to actively block. Use inline tap as the safe middle step to tune the IPS policy before going inline. Choose transparent firewall mode when you must insert the device into an existing segment without re-IP-ing; choose routed when the firewall should be the L3 gateway doing routing, NAT and VPN.
Security zones tie it together
Security zones group interfaces (for example inside, outside, dmz) so you write access control and IPS policy per zone rather than per physical port. That keeps policy readable and lets you move interfaces without rewriting rules.
The interview line: passive to watch, inline to block, transparent to insert without re-IP, routed to be the gateway — and zones to group interfaces for policy.
Sneha at a Pune hospital faces this
FTD is clearly detecting a known exploit in its events, but the attack still reaches the server every time — the firewall sees it yet never stops it.
The monitoring interface was deployed in passive/SPAN mode, so FTD only receives a mirrored copy and can alert but cannot drop the original packet.
Check the interface configuration: the interface is set to passive, not an inline pair, which is why intrusion events appear but no packet is ever dropped.
FMC ▸ Devices ▸ Interfaces ▸ interface mode ▸ Inline SetsRe-cable and reconfigure the segment as an inline pair (an inline set) so traffic passes through FTD and Snort can drop the malicious packets, not just log them.
Re-test the exploit: the intrusion event now shows the packet was dropped (block action) and the server no longer receives the attack.
Do not close a 'we blocked it' ticket on the alert alone. Open the intrusion event and confirm the action is Drop/Block, and that the interface is an inline pair. An alert in passive mode means the packet was delivered — verify the action, not just the detection.
You are running a no-risk proof of concept and only need to SEE what FTD would catch. Which mode fits?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why can FTD 'see' a malicious packet and still not block it? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Firewall mode
- A device-wide setting: routed (L3 gateway doing routing, NAT and VPN) or transparent (L2 bridge using a BVI).
- Routed mode
- The default firewall mode — FTD is a routed L3 hop; each interface has an IP and the device routes, NATs and terminates VPN.
- Transparent mode
- An L2 bump-in-the-wire that bridges between interfaces using a BVI, letting you insert FTD without re-IP-ing the network.
- BVI (Bridge Virtual Interface)
- A logical interface that gives a transparent bridge group an IP for management and represents the bridged segment.
- Inline pair
- Two interfaces placed directly in the traffic path so packets pass through FTD and Snort can drop a malicious packet — active IPS.
- Inline tap
- Inspects a copy of in-path traffic while forwarding the original; it can alert on what would be blocked but cannot drop the original.
- Passive / SPAN
- An interface that receives a mirrored copy from a switch SPAN port; monitor-only — it alerts but is not in the path and cannot drop.
- ERSPAN
- Encapsulated Remote SPAN — passive monitoring where mirrored traffic is GRE-encapsulated and delivered to FTD across a routed network.
- Security zone
- A logical grouping of one or more interfaces so access control and IPS policy can be written per zone instead of per physical port.
📚 Sources
- Cisco — Secure Firewall Management Center device config guide: routed and transparent firewall mode. cisco.com/go/secure-firewall
- Cisco — FTD interface modes: inline sets, inline tap, passive and ERSPAN. cisco.com
- Cisco — Transparent firewall mode and Bridge Virtual Interfaces (BVI). cisco.com
- Cisco — Security zones and interface groups in Secure Firewall Threat Defense. cisco.com
- Cisco — Choosing a deployment mode for Cisco Secure Firewall Threat Defense. cisco.com
- Cisco — Intrusion prevention with Snort 3 across inline and passive interfaces. cisco.com
What's next?
Got the modes straight? A natural next step is the access control policy itself — how prefilter, Security Intelligence and access control rules combine with these interface modes to allow, inspect or drop traffic on each zone.