Wireless Access

I'm sure this is an easy question, but how do you see firewall rule hits and traffic being dropped by the firewall in the controller?

Thank you,

You can see traffic being denied by running:

show datapath session table | include D

Or for a specific IP:
show datapath session table 1.2.3.4 | include D

At a higher level, you can also see what Rule and Role hits are being hit from the WebUI.  It won't give you granular details, but can help to see what protocol...in what policy....in what role is being denied.  

 

Monitoring --> Firewall Hits (under Controller on left)

 

 

show acl hits

 is another useful one to use in conjunction with the others suggested.