How to determine ACE associated with a connection?

[AlexFer]

I can see a connection using "show local-host" and "show conn", however, I cannot trace it back to the (Identity firewall) ACE that was used to allow that connection. Is there a way?

Each ACE (shown using "show access-list") owns a unique hash code, so, I was expecting "show local-host" and "show conn" to reference such, but it doesn't seem to.

On ASA 9.6(1).

[Karsten Iwen]

The hash is used to find the corresponding entries in the syslog. You can trace the ACE with packet-tracer:

packet-tracer input inside tcp user THE-USER 1234 1.2.3.4 443

This gives you the ASA-processing including ACE for the user to the server 1.2.3.4/443.

[AlexFer]

Thanks, but an (active) user can be associated with multiple addresses (as shown by "show user-identity ip-of-user")... How will packet-tracer know which IP to use?

[Karsten Iwen]

it doesn't know that. Packet-tracer always uses the last mapping. I assume in that case packet-tracer will not of much help.