Depends on a few things but assuming -
default gateway of PC is the router, PC is sending a packet to a remote IP subnet, PC already has the IP address of remote device and has worked out the remote device is not on the same IP subnet -
1) PC sends packet to it's default gateway ie. the router
src mac = PC
dst mac = default gateway
src IP = PC
dst IP = remote device
2) switch receives packet on access port in PC vlan. Looks at the dst mac address and checks it's mac address table. Assuming the mac address is reachable via either -
an access port in the same vlan
or
a trunk link
it forwards it to the router.
3) router receives packet, checks the dst mac address and sees it is for it's own interface then looks at the dst IP and checks its routing table. See the next hop is the firewall so forwards the packet to the firewall -
src mac = router's outgoing interface to firewall
dst mac = firewall
src IP = PC
dst IP = remote device
4) firewall receives packet and does the same as router in terms of checking dst mac address etc.
Because it is a firewall though it may well do other things eg acl checking and/or NAT on the source IP.
The packet is then forwarded to next hop IP.
Note the above is simplified somewhat ie. routers use CEF normally so it's not actually the routing table that is checked.
Note also that if your firewall is stateful when a packet is sent back from the remote device it will be allowed back in to the PC.
The key thing to note is that at each L3 hop the mac addresses changes whereas the IPs do not change unless the firewall does NAT on the IPs.
Jon
