Cisco FTD Access Control Miss: system support firewall-engine-debug

Cisco FTD · Techclick CLI troubleshooting lab

ACP looks like allow. Traffic dies. FMC hit counts do not increment on your rule.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Cisco FTD for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

firewall-engine-debug on the FTD names the rule that actually matched, including default action and identity.

Why this ticket shows up

FTD evaluates ACP plus identity plus SSL policy. The rule you love may never see the flow.

Symptoms operators actually see

• Hit count 0

• Default action block

• SSL policy undecryptable action

• Wrong security zone

CLI first — copy this block

Run these on the Cisco FTD device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

system support firewall-engine-debug
# filter by IP when prompted
show conn address 10.14.14.14
show asp drop
expert
tail /var/log/messages

How to read that output

The debug prints the rule name and reason. If it is default action, your allow never matched zone/app/user.

Triage order

1. Start engine-debug with an IP filter

2. Send one flow

3. Read the matched rule

4. Fix zone or application

5. Stop debug

Classic traps

What you see	Real cause	Fix
Add another allow at the bottom	Default already wins at the top miss	Fix match conditions
Blame routing	asp drop shows ACL	It is policy
Leave engine-debug on	CPU spike	Stop it

Proof the ticket is closed

• Debug matches your allow

• Hit count increments

• Conn is built

Say this in an interview

On FTD I trust firewall-engine-debug over the picture of the rule I intended.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/