I'm not sure if this is you're after, see below, it is allowed There is an option in FTD packet tracer called - Treat the simulated packet as an IPsec/SSL VPN decrypted packet. Shall I use it?
Packet Tracer TCP
Interface: Ethernet1/11.216
VLAN ID:
Protocol: TCP
Source Type: IPv4
Source IP value: 10.10.216.5
Source Port: ssh
Source SPI:
Destination Type: IPv4
Destination IP value: 10.11.20.51
Destination port: ssh
Inline Tag:
Treat simulated packet as IPsec/SSL VPN decrypt: false
Bypass all security checks for simulated packet: false
Allow simulated packet to transmit from device: false
Select Device: IC-FTD02
Run trace on all cluster members: false
Device details
Name: IC-FTD02
ID: 5322b646-feb8-11ed-b585-fec3381dfb76
Type: Device
Phase 1
ID: 1
Type: SUBOPTIMAL-LOOKUP
Subtype: suboptimal next-hop
Result: ALLOW
Config:
Additional Information: Input route lookup returned ifc outside-melita1 is not same as existing ifc outside-goplc1Doing adjacency lookup on existing ifc outside-goplc1
Elapsed Time: 52736 ns
Phase 2
ID: 2
Type: ECMP load balancing
Result: ALLOW
Config:
Additional Information: ECMP load balancingFound next-hop 10.11.255.6 using egress ifc outside-goplc1(vrfid:0)
Elapsed Time: 3072 ns
Phase 3
ID: 3
Type: PBR-LOOKUP
Subtype: policy-route
Result: ALLOW
Config: route-map FMC_GENERATED_PBR_1699202772888 permit 5 match ip address ic-dmz-vps-outbound set interface outside-goplc1 outside-melita1
Additional Information: Matched route-map FMC_GENERATED_PBR_1699202772888, sequence 5, permit Found next-hop 10.11.255.6 using egress ifc outside-goplc1
Elapsed Time: 512 ns
Phase 4
ID: 4
Type: UN-NAT
Subtype: static
Result: ALLOW
Config: nat (ic-dmz-vps,outside-goplc1) source static ic-dmz-vps-subnet ic-dmz-vps-subnet destination static ic-gaming-subnet ic-gaming-subnet no-proxy-arp route-lookup
Additional Information: NAT divert to egress interface outside-goplc1(vrfid:0)Untranslate 10.11.20.51/22 to 10.11.20.51/22
Elapsed Time: 3072 ns
Phase 5
ID: 5
Type: OBJECT_GROUP_SEARCH
Result: ALLOW
Config:
Additional Information: Source Object Group Match Count: 4 Destination Object Group Match Count: 3 Object Group Search: 12
Elapsed Time: 0 ns
Phase 6
ID: 6
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config: access-group CSM_FW_ACL_ globalaccess-list CSM_FW_ACL_ advanced permit ip any any rule-id 268435456 access-list CSM_FW_ACL_ remark rule-id 268435456: ACCESS POLICY: IC-Security-Policy - Mandatoryaccess-list CSM_FW_ACL_ remark rule-id 268435456: L7 RULE: [WAN] Block Bad URLs
Additional Information: This packet will be sent to snort for additional processing where a verdict will be reached Forward Flow based lookup yields rule: in id=0x1519782cdcb0, priority=12, domain=permit, deny=false hits=16177306, user_data=0x15195f9bbe40, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, ifc=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, ifc=any,, dscp=0x0, nsg_id=none input_ifc=any, output_ifc=any
Elapsed Time: 307 ns
Phase 7
ID: 7
Type: CONN-SETTINGS
Result: ALLOW
Config: class-map class-default match anypolicy-map global_policy class class-default set connection advanced-options UM_STATIC_TCP_MAPservice-policy global_policy global
Additional Information: Forward Flow based lookup yields rule: in id=0x15197c398330, priority=7, domain=conn-set, deny=false hits=2998329, user_data=0x15197adacf40, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, nsg_id=none input_ifc=ic-dmz-vps(vrfid:0), output_ifc=any
Elapsed Time: 307 ns
Phase 8
ID: 8
Type: NAT
Result: ALLOW
Config: nat (ic-dmz-vps,outside-goplc1) source static ic-dmz-vps-subnet ic-dmz-vps-subnet destination static ic-gaming-subnet ic-gaming-subnet no-proxy-arp route-lookup
Additional Information: Static translate 10.10.216.5/22 to 10.10.216.5/22 Forward Flow based lookup yields rule: in id=0x15197a80fef0, priority=6, domain=nat, deny=false hits=5100, user_data=0x15197d6aa880, cs_id=0x0, flags=0x0, protocol=0 src ip/id=10.10.216.0, mask=255.255.255.240, port=0, tag=any dst ip/id=10.11.20.0, mask=255.255.255.0, port=0, tag=any, dscp=0x0, nsg_id=none input_ifc=ic-dmz-vps(vrfid:0), output_ifc=outside-goplc1(vrfid:0)
Elapsed Time: 307 ns
Phase 9
ID: 9
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information: Forward Flow based lookup yields rule: in id=0x151974e57be0, priority=0, domain=nat-per-session, deny=false hits=79536255, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, nsg_id=none input_ifc=any, output_ifc=any
Elapsed Time: 307 ns
Phase 10
ID: 10
Type: IP-OPTIONS
Result: ALLOW
Config:
Additional Information: Forward Flow based lookup yields rule: in id=0x15197d712dc0, priority=0, domain=inspect-ip-options, deny=true hits=4525844, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, nsg_id=none input_ifc=ic-dmz-vps(vrfid:0), output_ifc=any
Elapsed Time: 307 ns
Phase 11
ID: 11
Type: FOVER
Subtype: standby-update
Result: ALLOW
Config:
Additional Information: Forward Flow based lookup yields rule: in id=0x151979ad18b0, priority=20, domain=lu, deny=false hits=164962, user_data=0x0, cs_id=0x0, flags=0x0, protocol=6 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, nsg_id=none input_ifc=ic-dmz-vps(vrfid:0), output_ifc=any
Elapsed Time: 24064 ns
Phase 12
ID: 12
Type: VPN
Subtype: encrypt
Result: ALLOW
Config:
Additional Information: Forward Flow based lookup yields rule: out id=0x1519782db330, priority=70, domain=encrypt, deny=false hits=913, user_data=0xb9e8944, cs_id=0x15197e3dd7f0, reverse, flags=0x0, protocol=0 src ip/id=10.10.216.0, mask=255.255.255.240, port=0, tag=any dst ip/id=10.11.20.0, mask=255.255.255.0, port=0, tag=any, dscp=0x0, nsg_id=none input_ifc=any(vrfid:65535), output_ifc=outside-goplc1
Elapsed Time: 11264 ns
Phase 13
ID: 13
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config: nat (ic-dmz-vps,outside-goplc1) source static ic-dmz-vps-subnet ic-dmz-vps-subnet destination static ic-gaming-subnet ic-gaming-subnet no-proxy-arp route-lookup
Additional Information: Forward Flow based lookup yields rule: out id=0x15197fa4e2f0, priority=6, domain=nat-reverse, deny=false hits=5101, user_data=0x15197ceb6ee0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id=10.10.216.0, mask=255.255.255.240, port=0, tag=any dst ip/id=10.11.20.0, mask=255.255.255.0, port=0, tag=any, dscp=0x0, nsg_id=none input_ifc=ic-dmz-vps(vrfid:0), output_ifc=outside-goplc1(vrfid:0)
Elapsed Time: 2560 ns
Phase 14
ID: 14
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information: Reverse Flow based lookup yields rule: in id=0x151978399960, priority=70, domain=ipsec-tunnel-flow, deny=false hits=912, user_data=0xb9eaadc, cs_id=0x15197e3dd7f0, reverse, flags=0x0, protocol=0 src ip/id=10.11.20.0, mask=255.255.255.0, port=0, tag=any dst ip/id=10.10.216.0, mask=255.255.255.240, port=0, tag=any, dscp=0x0, nsg_id=none input_ifc=outside-goplc1(vrfid:0), output_ifc=any
Elapsed Time: 33280 ns
Phase 15
ID: 15
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information: Reverse Flow based lookup yields rule: in id=0x151974e57be0, priority=0, domain=nat-per-session, deny=false hits=79536257, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, nsg_id=none input_ifc=any, output_ifc=any
Elapsed Time: 2048 ns
Phase 16
ID: 16
Type: IP-OPTIONS
Result: ALLOW
Config:
Additional Information: Reverse Flow based lookup yields rule: in id=0x151976c8c5f0, priority=0, domain=inspect-ip-options, deny=true hits=11711493, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, nsg_id=none input_ifc=outside-goplc1(vrfid:0), output_ifc=any
Elapsed Time: 512 ns
Phase 17
ID: 17
Type: FLOW-CREATION
Result: ALLOW
Config:
Additional Information: New flow created with id 200408611, packet dispatched to next moduleModule information for forward flow ...snp_fp_inspect_ip_optionssnp_fp_tcp_normalizersnp_fp_snortsnp_fp_translatesnp_fp_tcp_normalizersnp_fp_adjacencysnp_fp_encryptsnp_fp_fragmentsnp_fp_tracer_dropsnp_ifc_statModule information for reverse flow ...snp_fp_inspect_ip_optionssnp_fp_ipsec_tunnel_flowsnp_fp_tcp_normalizersnp_fp_translatesnp_fp_snortsnp_fp_tcp_normalizersnp_fp_adjacencysnp_fp_fragmentsnp_fp_tracer_dropsnp_ifc_stat
Elapsed Time: 18432 ns
Phase 18
ID: 18
Type: EXTERNAL-INSPECT
Result: ALLOW
Config:
Additional Information: Application: 'SNORT Inspect'
Elapsed Time: 45056 ns
Phase 19
ID: 19
Type: SNORT
Subtype: appid
Result: ALLOW
Config:
Additional Information: service: (0), client: (0), payload: (0), misc: (0)
Elapsed Time: 14700 ns
Phase 20
ID: 20
Type: SNORT
Subtype: firewall
Result: ALLOW
Config: Network 0, Inspection 0, Detection 2, Rule ID 268435623
Additional Information: Starting rule matching, zone 1 -> 5, geo 0 -> 0, vlan 0, src sgt: 0, src sgt type: unknown, dst sgt: 0, dst sgt type: unknown, user 9999999, no url or host, no xffMatched rule ids 268435623 - Allow
Elapsed Time: 239154 ns
Result
Input Interface: ic-dmz-vps(vrfid:0)
Input Status: up
Input Line Status: up
Output Interface: outside-goplc1(vrfid:0)
Output Status: up
Output Line Status: up
Action: allow
Time Taken: 451997 ns
