An engineer traces a flow that users say is blocked, and the FTD packet tracer returns five phases: capture allow, access-list allow, un-nat allow, route-lookup allow, then an access-list phase listing an access policy rule-id with result drop. The summary line reads Action: drop, Drop-reason: (acl-drop) Flow is denied by configured rule, and no snort phase appears. Which packet tracer phase accounts for the drop, and which component can be ruled out?
Select an answer to reveal the explanation.
Short Explanation
You can read the trace from the top down: the access-list phase returns drop, and the summary confirms the configured rule denied the flow. That makes the access control policy the place to fix it, while the missing Snort phase rules Snort out for this trace. It’s like a line of checkpoints: the guard who says no ends the journey.
Full Explanation
The decisive evidence is the access-list phase, which names an access policy rule-id and returns drop. The summary confirms that the flow was denied by a configured rule, so the access control policy (ACP) is the enforcement point to investigate and correct. Snort is ruled out for this trace because no Snort phase appears; the packet tracer identifies the ACP rule as the source of the denial. The proposal to correct the ACP rule but keep Snort under investigation gets the denying phase and remedy right, but conflicts with the trace, which contains no Snort phase. The proposal to rule out route lookup instead correctly locates the drop in the access-list phase, but names the wrong component to exclude: the route-lookup phase allowed processing, while the absent Snort phase rules Snort out. The proposal to treat route lookup as decisive also fails: that phase says allow, and the later access-list drop and acl-drop summary identify the denial point. Exam caveat: phase names and ordering can vary by FTD version and trace context, so distinguish a phase that permits processing from the phase that returns the drop. Practical check: correlate the reported rule-id with the deployed ACP rule, confirm its match conditions and action, then rerun packet tracer after any change.