How to tcpdump traffic between APM Http Auth AAA object and a layered virtual server

Trying to debug APM http auth traffic to a layered virtual server. I have an APM http auth AAA object which sends custom http post to a layered VS, which in turn converts http to https and forwards the request to an external authentication server. I'm getting 400 Bad request from the external server. CUrl'ing the same content goes ok.

I might be missing something, but haven't been able to tcpdump the traffic between the http auth and the layered VS. Any advice?