1. Cisco Firepower Threat Defense 6 2: Advanced Troubleshooting (Packet Tracer)
Using the packet tracer, you can test your policy configuration by modeling a packet based on source and destination addressing, and protocol characteristics. The trace does a policy lookup to test access rules, NAT, routing, access policies and rate liming policies, to check if the packet would be permitted or denied. The packet flow is simulated based on interfaces, source address, destination address, ports and protocols. By testing packets this way, you can see the results of your policies and test whether the types of traffic you want to allow or deny are handled as desired. Besides verifying your configuration, you can use the tracer to debug unexpected behavior, such as packets being denied when they should be allowed. To simulate the packet fully, packet tracer traces the data path; slow-path and fast-path modules. Processing is transacted based on per-session and per-packet basis. Tracing packets and capture with trace logs the tracing data on per packet basis when the Next-Generation Firewall (NGFW) processes packet per-session or per-packet basis.
http://www.cisco.com/c/en/us/td/docs/...