After a switch upgrade, the FMC reports the FTD as unreachable even though both devices sit on the same management VLAN and business traffic still forwards normally. That VLAN also carries backup jobs from other servers, so the capture must stay narrow. Which packet capture should you start to see whether the FTD receives and answers its own management packets?
Select an answer to reveal the explanation.
Short Explanation
Start a capture on the FTD’s management interface, filtered to packets between the FTD and FMC management IPs. It’s like tuning a radio to one conversation: filtering keeps unrelated backup traffic out while showing whether the FTD receives and answers its management packets.
Full Explanation
The FTD management interface is the right observation point because the question is whether the appliance itself receives and answers management traffic; normal forwarding on a data interface does not establish management-plane reachability. Filtering that interface to the two management IP addresses keeps the capture focused on the relevant endpoints and avoids recording unrelated backup traffic on the shared VLAN. A capture limited to TCP port 443 is a familiar way to troubleshoot a web-based management exchange, but it assumes the relevant management packets use that port. The scenario does not establish that protocol or port, so the filter could omit the packets needed to diagnose the failure. Capturing at the FMC can show what the controller transmits and whether replies return to it, but it does not directly establish what reaches or leaves the FTD management interface; loss or filtering between the observation point and the appliance can remain hidden. Filtering on the FMC management subnet at the FTD is also a common broad troubleshooting filter, but it can include other hosts on the shared VLAN, contrary to the requirement to keep this capture narrow. Exam caveat: do not assume that successful data-plane forwarding proves the separate management path is healthy. Practical check: verify the interface, endpoint addresses, direction, and capture counters, then confirm whether matching requests arrive and whether corresponding replies leave.