Which command is used in Cisco ASA Firewall to display the whole packet flow on the firewall? This same command allows you to see if traffic is allowed, NATed, or going through a VPN tunnel?


1 Answer 1


The packet-tracer command.

For example:

packet-tracer input inside tcp 1234 443 would show you each phase/stage of the flow process including which NAT (if any), which ACL (if any), which route statement (if any), and which interfaces are involved in either allowing or denying the flow, along with whether the traffic was a part of a tunnel. There is a caveat with tunneled traffic, however. If you already know the traffic is a part of a tunnel but the tunnel is not already established, you will need to use the packet-tracer command at least 2 times in rapid succession before it will show the flow properly as going through a tunnel. The first time will initiate the tunnel (provided your config is correct) and the second will show the flow through the now-established tunnel.

  • 1
    @AlicAntunezCruz No problem. I assume that’s what you were looking for.
    – Jesse P.
    Aug 17, 2021 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.