Can you verify that I did this connection correctly on our new S170?  I greatly appreciate it in advance!

On the switch I created monitor session 1 with the following command:

monitor session 1 source interface Fa6/0/38,Fa2/0/48

monitor session 1 destination interface Gi1/0/40

We have two 50 mbps internet connections, thus the firewalls are only on 100meg (fa) ports as gig-e ports are at a premium and I do not want to waste PoE ports (which are gig e).

Fa6/0/38 is our primary firewall lan side connection to the internet.  All traffic from our lan to the outside world must pass through here.

Fa2/0/48 is a failover asa firewall, if for whatever reason the primary is down, the traffic to the outside world would traverse this port through the secondary firewall.

Gi1/0/40 is a gig port that is patched through to the T1 port on the S170 WSA.

The WSA Network > Interfaces screen has L4 Traffic Monitor Wiring set to Duplex TAP: T1 (In/Out)

The Security Services > L4 Traffic Monitor has L4 Traffic Enabled, and traffic is monitored on All ports except web ports (HTTP/HTTPS).  Rules are successfully updated and licensing is enabled for this feature.

So is this setup correctly?  Is there any way to test?  Should I change the L4 Traffic monitor to monitor ALL ports, or do you generally just have the WCCP ports 80 / 443 from the firewall handle all of that filtering and use L4 for "everything else"?

When I go to L4 Traffic Monitor reports, there are no data found.  Now likely because there's no suspicious activity or malware, but how can I be sure this is working?