topic ZBF and NAT in Network Security

ZBF and NAT

ipagliani — Mon, 11 Mar 2019 21:56:03 GMT

Hello.

as I studied, Interface ACLs and Zone based Firewall should not be applied at the same time. This it means that every packet is processed by the router (I'm thinking NAT).

For example, an unwanted traffic is processed by NAT before is it drop by ZBF. Do you think is it optimal ?

ZBF and NAT

josecalv — Mon, 28 Nov 2011 16:43:39 GMT

Hi,

It is not something to be optimal or not. Packets processed by Zone-Based are either fast switched or processed switched so that's probably why NAT is processed before the Zone-based Firewall.

On the other hand inbound ACLs (if no further processing is necessary for other features) are processed by CEF so the packets don't go to the router's CPU and are processed before NAT.

I hope it makes sense.

Re: ZBF and NAT

ipagliani — Mon, 28 Nov 2011 17:44:44 GMT

Hi,

what you said is logical and correct point of view for packet processing; but what do you think about firewall processing ?

I don't understand why an unwanted packet have to be processed by Nat before drop it

ASA behavior is a little bit different, it use real ip address but interface ACL is still used for block packet before other process.

Regard,

Sent from Cisco Technical Support iPad App