You are cabling a single Secure Firewall Threat Defense appliance whose two 1 GbE data ports uplink to one Nexus switch that has LACP enabled on those ports. Both links must carry inside traffic today, cutting either cable must not interrupt the inside VLANs, and the existing access-control policy must stay untouched. Which port-channel design should you configure on the FTD interfaces?
Select an answer to reveal the explanation.
Short Explanation
Bundle your FTD ports into an LACP port channel so both links carry traffic and a cable cut won’t interrupt your inside VLANs. It’s like a two-lane bridge: if one lane closes, traffic can still flow on the other. LACP also checks that both ends agree on the bundle.
Full Explanation
An LACP port channel is the appropriate design because it presents the two physical FTD links as one logical interface while allowing both members to forward traffic. If one cable fails, LACP removes that member and the remaining link continues carrying inside traffic. The existing access-control policy can remain untouched when the logical interface is configured to preserve the relevant interface identity and policy associations. A static EtherChannel is a recognized bundling method, but it does not negotiate LACP; the Nexus ports are configured for LACP, so the static bundle would not form consistently with the switch. A two-link minimum is sometimes used where full aggregate bandwidth is required, but it intentionally takes the channel down when either member fails, violating the stated cable-cut availability requirement. Migrating policy references to a newly introduced logical interface can be a valid port-channel deployment method, but it changes the existing policy and therefore fails the no-policy-change constraint. Exam caveat: a port channel provides link-member resilience, not protection against failure of the single FTD appliance or the Nexus switch. Practical check: confirm that the FTD and Nexus agree on LACP mode, member speed, VLAN or trunk settings, and that the channel remains up with one member disconnected.