I'm trying to figure out why a particular connection is getting blocked by Firepower. When I look at the ASA logs I see lots of SFR requested to drop packet from the IP. If I look in FMC I can't find any reference to the IP anywhere even though it is a recent event, like within the hour. I can't see anything about the connection that would cause it to be blocked by my current rules. Anyone got any tips on figuring out why a connection is getting blocked? It is https browser traffic.
