Firewall Fundamentals and Architecture
Domain 1 establishes the vocabulary and data-plane model you need for every later configuration task. The exam tests whether you can explain what enforces policy, what manages it, and where a packet is inspected.
Core architecture
- Cisco Secure Firewall (formerly Firepower) separates management from enforcement. The Firepower Management Center (FMC) is the centralized manager; the on-box Firepower Device Manager (FDM) is the local manager; the Firepower Threat Defense (FTD) device is the enforcing sensor. An FTD is managed by exactly one manager at a time.
- FTD runs a unified image. Its data plane includes the Snort engine (Snort 3 in current releases) and the Lina policy engine. Lina handles forwarding, routing, NAT, and VPN; Snort handles discovery, intrusion, file, and malware inspection.
- Deployment modes are routed, transparent (bridge groups), inline IPS, passive/tap IDS, and inline tap. Interfaces can be physical, subinterfaces, EtherChannels, or VLANs.
- Security zones group interfaces by trust level. Access control rules reference zones rather than individual interfaces.
- Stateful inspection maintains a flow table, so return traffic for established flows is permitted. Asymmetric routing can break stateful inspection.
Policy pipeline
A packet is evaluated by prefilter first, then access control, then SSL, intrusion, file, and malware stages. Each stage can pass, log, or terminate traffic.
Worked example
A client at 10.1.1.10:52344 connects to 203.0.113.20:443. The packet enters the inside zone and matches an access control rule that allows HTTPS with an intrusion policy attached. FTD creates a flow, applies NAT if configured, and passes the payload to Snort. Snort reassembles the stream and evaluates signatures. If a signature fires, an intrusion event is generated; the connection continues or is dropped according to the rule action. The return packet is allowed by the stateful flow without re-evaluating the full policy.
Traps that cost marks
- Assuming the FMC forwards traffic. It is management-only.
- Confusing Trust with Allow: Trust bypasses Snort inspection entirely.
- Forgetting that prefilter is evaluated before access control.
- Assuming a passive interface can block traffic.