Need alternative to packet-tracer for Firepower 4110 with L7 rules on FMC

[ABaker94985]

Packet-tracer doesn't work reliably when you have upper layer rules on an FMC. Rules often show traffic is passed, when the FMC will actually block it. I know there is a similar method, and I heard that Cisco will eventually fix packet-tracer to work with the higher layer rules. Can someone send over directions? I've not been able to find this in the Firepower documentation. Thanks

[Marvin Rhoads · Accepted solution]

It's not exactly the same, but if you have live traffic to check with you can get more reliable output using system support firewall-engine-debug and system-support-trace output.

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/214577-firepower-data-path-troubleshooting-phas.html

[ABaker94985]

That's exactly what I was looking for. Thank you!