Cisco Support Community
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Transparent mode and failover.

Does an ASA in both transparent mode and standby state pass any type of traffic?

Paulo Roque

Network Engineer


Re: Transparent mode and failover.

Transparent firewall mode allows only two interfaces to pass through traffic; however, on the ASA adaptive security appliance, you can use the dedicated management interface (either the physical interface or a subinterface) as a third interface for management traffic. The mode is not configurable in this case and must always be management-only

Community Member

Re: Transparent mode and failover.

In transparent mode, all allowed traffic is passed, but only IP-traffic can be inspected. Normally BPDUs are blocked, but you want them through if using STP.

In transparent failover mode, you definitely want STP, to eliminate problems when both FWs become active (should never happen, but...).

In standby mode, the FW does not pass any traffic.

There is a failover link between active and standby FW, to carry FW status info. If you do stateful failover, the state-info is transferred too (on it's own VLAN). This is management traffic, no user data!

I don't know about ASA, but an FWSM allows up to 8 BVI-groups per context. An inside VLAN is connected to an outside VLAN by the transparent FW (this is called a BVI-group). Each BVI-group is completely isolated from each other. You need a router to get traffic between the BVI groups.

Thr management interface is just for that. It also can carry traffic for AAA (eg. a connection to the radius server).



CreatePlease to create content