https://community.cisco.com/t5/network-security/need-alternative-to-packet-tracer-for-firepower-4110-with-l7/m-p/4412145#M1081245 <P>It's not exactly the same, but if you have live traffic to check with you can get more reliable output using <STRONG>system support firewall-engine-debug</STRONG> and <STRONG>system-support-trace</STRONG> output.</P> <P><A href="https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/214577-firepower-data-path-troubleshooting-phas.html" target="_blank">https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/214577-firepower-data-path-troubleshooting-phas.html</A></P> Wed, 02 Jun 2021 18:14:14 GMT Marvin Rhoads 2021-06-02T18:14:14Z https://community.cisco.com/t5/network-security/need-alternative-to-packet-tracer-for-firepower-4110-with-l7/m-p/4412137#M1081244 <P>Packet-tracer doesn't work reliably when you have upper layer rules on an FMC. Rules often show traffic is passed, when the FMC will actually block it. I know there is a similar method, and I heard that Cisco will eventually fix packet-tracer to work with the higher layer rules. Can someone send over directions? I've not been able to find this in the Firepower documentation. Thanks</P> Wed, 02 Jun 2021 17:56:03 GMT https://community.cisco.com/t5/network-security/need-alternative-to-packet-tracer-for-firepower-4110-with-l7/m-p/4412137#M1081244 ABaker94985 2021-06-02T17:56:03Z https://community.cisco.com/t5/network-security/need-alternative-to-packet-tracer-for-firepower-4110-with-l7/m-p/4412145#M1081245 <P>It's not exactly the same, but if you have live traffic to check with you can get more reliable output using <STRONG>system support firewall-engine-debug</STRONG> and <STRONG>system-support-trace</STRONG> output.</P> <P><A href="https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/214577-firepower-data-path-troubleshooting-phas.html" target="_blank">https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/214577-firepower-data-path-troubleshooting-phas.html</A></P> Wed, 02 Jun 2021 18:14:14 GMT https://community.cisco.com/t5/network-security/need-alternative-to-packet-tracer-for-firepower-4110-with-l7/m-p/4412145#M1081245 Marvin Rhoads 2021-06-02T18:14:14Z https://community.cisco.com/t5/network-security/need-alternative-to-packet-tracer-for-firepower-4110-with-l7/m-p/4412149#M1081246 <P>That's exactly what I was looking for. Thank you!</P> Wed, 02 Jun 2021 18:20:42 GMT https://community.cisco.com/t5/network-security/need-alternative-to-packet-tracer-for-firepower-4110-with-l7/m-p/4412149#M1081246 ABaker94985 2021-06-02T18:20:42Z