Best way confirm which ACL or Policies allow certain traffic on FTD

[CiscoBrownBelt]

When doing packet tracer or captures, ACL part may say the 2 different outputs below. I am basically trying to confirm which rules allow certain traffic and there are many rules and many do not make sense or show hits.

Phase: 2

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

MAC Access list

or reference 

Phase: 5
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip any any rule-id 268441600
access-list CSM_FW_ACL_ remark rule-id 268441600: ACCESS POLICY: XXXX-FTD2140-Local-Sensor_ACP - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268441600: L7 RULE: testRule
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

[MHM Cisco World]

can you more elaborate 
thanks 
MHM

[CiscoBrownBelt]

 I am trying to determine what is not needed as many show ZERO hits but I am having trouble confirming exactly how traffic is being allowed in. I don't have any tunneled traffic.

FTD2140 managed by FMC.

[tvotna]

The first one shown by the packet-tracer is a default Lina L2 ACL (MAC ACL). Ignore it if you're using routed mode. The second one is a Lina ACL rule. This information may be of some relevance if connection hits a fastpath prefilter rule. Otherwise, it may not point to an actual rule which allows or drops traffic in Snort. In other to identify ACP rule which match your connection you need to either use "capture /trace" and then find a packet with Snort verdict or "system support firewall-engine-debug" or "system support trace".

For Snort ACP rules you can also use

system access-control clear-rule-counts

and

show rule hits

[CiscoBrownBelt]

Great info I will look into these commands. These debugs pretty intensive (running on prod so..)?

I you referencing Snort in the packet-tracer? This is what I get when trying to check one subnet how it enters?

Phase: 14
Type: SNORT
Subtype:
Result: ALLOW
Config:
Additional Information:
Snort Trace:
Packet: TCP, SYN, seq 769230991
Session: new snort session
AppID: service unknown (0), application unknown (0)
Firewall: starting AC rule matching, zone 4 -> 4, geo 0 -> 0, vlan 0, sgt 0, src sgt type 0, dest_sgt_tag 0, dest sgt type 0, user 9999997, icmpType 0, icmpCode 0
Firewall: pending rule-matching, id 268441600, pending URL
Snort id 10, NAP id 1, IPS id 0, Verdict PASS
Snort Verdict: (pass-packet) allow this packet

[marsooqa1]

You may find the rule id from SNORT phase output and check for show access-list | include 268441600