Cisco Secure Firewall Architecture and Deployment on FTD and FMC
This domain tests how Secure Firewall Threat Defense is built, which manager owns it, and which deployment mode matches a given insertion point.
Architecture
- FTD is a single image combining the Lina data plane (ASA-derived) with Snort inspection and a shared management layer. On 4100/9300 appliances, FXOS sits underneath as chassis manager.
- Managers: FMC (appliance, FMCv, or cloud-delivered), FDM (on-box, small deployments), and CDO. A device is managed by one manager at a time; switching managers means re-registration.
- The ASA image on the same hardware is managed with ASDM/CSM and cannot be managed by FMC; FTD's Snort-based features do not exist there.
Deployment modes
Routed (addressed interfaces, dynamic routing, gateway functions), Transparent (bridge virtual interface, no addressing, static routing), Inline (IPS-only inline set, no addressing, pass or drop), TAP (passive mirrored input, cannot block). Routed fits segmentation gateways; inline or TAP fits pure IPS insertion.
Registration and HA
- On the FTD CLI: configure manager add . In FMC, add the device with the same key and the matching NAT id when NAT separates them.
- FTD HA is a device pair with failover; each unit still has its own FMC registration. FMC HA is a separate active/standby management pair.
- Licensing is Smart Licensing (Essentials/Advantage/IPS tiers); if neither CSSM nor an on-premises Smart Software Manager is reachable, features degrade after the evaluation period.
Worked example
A data-centre segment must be inspected, but routers keep all gateway functions and the team refuses addressing changes. Transparent mode (BVI) or an inline set satisfies that. If the requirement is blocking rather than alerting, TAP is disqualified because it is passive only.
Traps
- Assuming FMC can absorb an FDM-managed device without re-registration.
- Omitting the NAT id when FMC and FTD are separated by NAT.
- Treating a TAP deployment as an enforcement point.
- Assuming the ASA configuration migration tool covers every ASA feature.