ある組織では、ブリッジグループを使用して内部インターフェースから外部インターフェースへのトラフィックを通過させるCisco FTDを使用しています。しかし、隣接するCiscoデバイスに関する情報を収集したり、環境内でマルチキャストを使用したりすることができません。この問題を解決するにはどうすればよいでしょうか?
正解:C
" In routed firewall mode, broadcast and multicast traffic is blocked even if you allow it in an access rule... " " The bridge group does not pass CDP packets packets... " https://www.cisco.com/c/en/us/td/docs/security/asa
/asa913/configuration/general/asa-913-general-config/intro-fw.html
Passing Traffic Not Allowed in Routed Mode
In routed mode, some types of traffic cannot pass through the ASA even if you allow it in an access rule. The bridge group, however, can allow almost any traffic through using either an access rule (for IP traffic) or an EtherType rule (for non-IP traffic):
IP traffic-In routed firewall mode, broadcast and " multicast traffic is blocked even if you allow it in an access rule, " including unsupported dynamic routing protocols and DHCP (unless you configure DHCP relay). Within a bridge group, you can allow this traffic with an access rule (using an extended ACL).
Non-IP traffic-AppleTalk, IPX, BPDUs, and MPLS, for example, can be configured to go through using an EtherType rule.
Note
" The bridge group does not pass CDP packets packets, or any packets that do not have a valid EtherType greater than or equal to 0x600. An exception is made for BPDUs and IS-IS, which are supported. "