Hi you can do the captures on the firewall to see what traffic is being dropped. However this should be used only for the troubleshooting purposes in short burst. If you leave it running the pcap exceeds certain limit a new pcap file will be generated. But again this is CPU intensive and should be used only for troubleshooting. In captures there are 4 different stages recieve, transmit, Drop and firewall. The drop pcap should show you what is being dropped by the firewall. Here are some additional tips as well. 1. Need to setup the filters for the traffic we are interested in. To do this, execute the following steps: Navigate to Monitor--Packet Capture Click 'Manage Filters' Set Filter ID 1 to be the source IP and destination IP of traffic you feel is affected ( leave all other fields blank ) Set Filter ID 2 to be the exact inverse of what you did in step 3 (destination IP in source field, Source IP in destination field) 2. Setup up the captures Create and name the file stage for a packet capture on all the stages (receive, transmit, firewall and drop) 3. Enable filters and captures debug dataplane packet-diag set filter on debug dataplane packet-diag set capture on 4. open 2 CLI windows on 1 run the following command to look at the counter ( make sure it run this command once before running the traffic) show counter global filter packet-filter yes delta yes on the 2nd window run the following command to look at he sessions show session all filter source <ip address> destination <ip address> After your test has been done stop all the captures and filters and see if global counter show you anything why it is dropping the traffic or if you have getting pcap with drop stage. This will help you narrow down the issue. Let us know if this helps you resolve the issue. Thanks Numan
... View more