Understanding the Order/Sequence of check - in a Firewall ( nat / routing / firewall polices)

[SJ K]

Hi all,

Been trying to twist my head on this,  cant find any proper sequence of the events that will be perform when a packet enter a firewall (ciso firewall in general)..

q1) is it

• NAT -> Routing ->  Firewall policy check  or
• NAT -> Firewall policy check -> Routing ?

q2) If it is NAT is the one being done 1st,  assuming that my source IP is being NAT (change to another IP) before it when out of the firewall, in the firewall policy, the source IP  that is to be specified/checked/filter against the firewall policies (is the original source or the source after NAT ?)

Regards,
Noob

[Marvin Rhoads]

Please see below for ASA Order of Operations. Routing comes after ACL, stateful inspection and NAT.

The original source address is checked against the policies.