5/16/2023 Update to keep this current and hopefully assist.
Balaji had a good question about packet tracer. This data is from Cisco Modeling Labs (CML) 2.5 with the ASA v9.18(2) (System image file is "boot:/asa9182-smp-k8.bin"). The order below shows it depends if you are going from high security-level to low or if it's low to high as might be expected. Access lists are required low to high, but the traffic send high to low is permitted without them, so no check is made below.
Attached is a summary after which the full details (standard not detailed) are shown for further analysis for reviewers. These are for allowed traffic. It looks like the diagram above is good. A few more details are shown in the data, but nice work Balaji!
OUTSIDE to INSIDE: packet-tracer input outside icmp 150.1.35.5 8 0 150.1.55.8
Phase:
1 ROUTE-LOOKUP
2 ACCESS-LIST
3 NAT
4 IP-OPTIONS
5 QOS
6 INSPECT
7 FLOW-CREATION
8 ACCESS-LIST
9 NAT
10 IP-OPTIONS
11 INPUT-ROUTE-LOOKUP-FROM-OUTPUT-ROUTE-LOOKUP
12 ADJACENCY-LOOKUP
Result:
Action: allow
INSIDE TO OUTSIDE: packet-tracer input inside icmp 150.1.55.8 8 0 150.1.35.5
Phase:
1 ROUTE-LOOKUP
2 NAT
3 IP-OPTIONS
4 QOS
5 INSPECT
6 FLOW-CREATION
7 NAT
8 IP-OPTIONS
9 INPUT-ROUTE-LOOKUP-FROM-OUTPUT-ROUTE-LOOKUP
10 ADJACENCY-LOOKUP
Result:
Action: allow
