An engineer defines a new rule while configuring an Access Control Policy. After deploying the policy, the rule is not working as expected and the hit counters associated with the rule are showing…

If logging is not enabled, hit counters would still increment, but no log events would be generated; the issue states hit counters are zero, implying no match.

A rule that is not enabled would not even be considered for traffic matching, and typically rules are enabled upon creation or before deployment.

The source interface for Snort is a broader policy setting, not a per-rule configuration that would cause a single rule's hit counter to remain at zero due to an incorrect application match.

An incorrect application signature means the Cisco FTD's deep packet inspection engine cannot correctly identify the intended application traffic. Consequently, no traffic will match the rule's criteria, resulting in zero hit counters and the rule not being applied.