An engineer is investigating connectivity problems on Cisco Firepower that is using service group tags. Specific devices are not being tagged correctly, which is preventing clients from using the…

The correct answer is C. Use a packet capture with match criteria. On Cisco Firepower/FMC, packet captures with match criteria (source IP, destination IP, protocol, port, etc.) are the primary built-in tool for troubleshooting traffic-path and policy-match issues, including SGT (Security Group Tag) tagging problems. You can capture packets at…

Management and Troubleshooting

Question

An engineer is investigating connectivity problems on Cisco Firepower that is using service group tags. Specific devices are not being tagged correctly, which is preventing clients from using the proper policies when going through the firewall How is this issue resolved?

Options

AUse traceroute with advanced options.
BUse Wireshark with an IP subnet filter.
CUse a packet capture with match criteria.
DUse a packet sniffer with correct filtering

How the community answered

(29 responses)

A
17% (5)
B
3% (1)
C
72% (21)
D
7% (2)

Explanation

On Cisco Firepower/FMC, packet captures with match criteria (source IP, destination IP, protocol, port, etc.) are the primary built-in tool for troubleshooting traffic-path and policy-match issues, including SGT (Security Group Tag) tagging problems. You can capture packets at the FTD interface level to verify which SGT values are present in the TrustSec header and whether policy lookup is using the correct tag. Traceroute (A) and Wireshark (B) are external or network-layer tools that cannot inspect SGT headers inline on FTD. A generic packet sniffer without the FMC match-criteria capability (D) provides less precision in isolating the relevant flows.

Topics

#Firepower troubleshooting#Packet capture#Policy enforcement#Service group tags

Community Discussion

No community discussion yet for this question.

Full 300-710 Practice