A data-center engineer sees replication traffic dropped by the FTD while packet-tracer on the same addresses returns allow, so the simulation hides the live verdict. They need the actual access control rule and drop reason applied to these production packets, and the box carries peak-hour traffic until the 02:00 change window. Which diagnostic approach should they use to observe the live rule evaluation?

A host-filtered system support firewall-engine-debug during the 02:00 change window is the suitable approach because it observes the live firewall engine’s rule evaluation for the two relevant hosts while avoiding extra diagnostic load during peak traffic. Stop the debug as soon as the needed evaluation appears rather than leaving it running. Running the same filtered debug during peak-hour traffic uses the right diagnostic, but conflicts with the requirement to keep the box carrying production load until the change window; limiting the filter does not remove that timing concern. Capturing filtered dataplane traffic at 02:00 and correlating it with ASP counters can help investigate live drops, but identifies packet disposition or a drop reason rather than necessarily revealing the access control rule that evaluated the packets. Reviewing Management Center connection events at 02:00 can provide rule and disposition details for logged flows, but those records are not direct observation of the live rule evaluation, and their usefulness depends on relevant events being generated and available. Exam caveat: packet-tracer predicts a simulated flow, so its result can differ from the verdict on packets traversing the production dataplane. Practical check: confirm the debug filter matches both hosts and that the output shows the expected live flow and rule before stopping it.