Question

A network administrator is deploying a Cisco Secure Firewall Threat Defense (FTD) firewall to segment three internal departments (Finance, HR, and Engineering) so that no department can initiate connections to another unless explicitly permitted. Each department resides on its own VLAN and connects to a separate FTD data interface. The administrator wants the most scalable and maintainable way to enforce this segmentation in the access control policy. Which approach should the administrator take?

Accepted Answer

Assign each department's interface to its own security zone and write access control rules that reference the source and destination security zones.

Answer

Place all three interfaces in a single security zone and rely on the default action to block inter-VLAN traffic.

Answer

Configure static NAT exemptions between each VLAN and permit all traffic, relying on NAT boundaries for isolation.

Answer

Create prefilter fastpath rules for each VLAN so traffic bypasses the access control policy for performance.