In the old days of Cisco ASA transparent firewalls, there was an option to allow BPDU frames in access list. Therefore, bpdu frames were passing through the firewall even some rule later could override it. ASA ACL looked something like this. access-list acl-bpdu ethertype permit bpduaccess-group acl-bpdu in interface inside In the FTD there is no way to allow this using Access control policies. By default, BPDUs are forwarded for