When the umbrella roaming client detects a VA on the LAN with it by default it will switch itself off and let the VA discover identity. Umbrella support said we can change this option.
https://support.umbrella.com/hc/en-us/articles/230901168#VirtualAppliance
Good capture option here for ASA
You can do a show trace on it and it goes though it like a packet tracer
capture capout2 type raw-data trace detail interface OUTSIDE include-decrypted match ip host 192.168.10.50 host 8.8.4.4
show capture capout2 trace detail packet-number 1
