After moving two campus lab switches behind an FTD appliance in transparent mode, an engineer confirms that the unicast access rules show steady hits. The ARP tables still fill on both sides, yet no rule matches ARP traffic. Which statement best explains how the bridge group handles ARP frames?
Select an answer to reveal the explanation.
Short Explanation
Your bridge group forwards ARP frames by default, so they don’t need to match an access rule. It’s like a hallway that lets ARP pass through without checking it at a doorway; optional ARP inspection can filter those frames, but it isn’t required for forwarding.
Full Explanation
In transparent mode, a bridge group forwards ARP frames by default without matching them against access rules. ARP requests and replies can therefore cross the appliance and populate the hosts’ ARP tables even though no access-rule counter records ARP traffic; the steady unicast-rule hits reflect separate IP traffic. The explicit-per-interface-allow approach is incorrect because ordinary ARP forwarding does not require a separate access-rule permit on each member interface. The BVI-proxy approach is also incorrect: a BVI supplies an IP address for the bridge group, but does not answer ARP on behalf of hosts or consume their ARP frames. The inspection-prerequisite approach confuses forwarding with filtering: ARP inspection is optional and can filter ARP traffic, but enabling it is not what permits default forwarding. Exam caveat: do not generalize this behavior to all broadcast or multicast traffic; access rules can control IP broadcast and multicast traffic, and ARP is handled specially. Practical check: capture traffic on both bridge-group member interfaces and confirm that ARP requests and replies appear on ingress and egress while the access-rule counters remain unchanged.