1

Have an existing ASA that has a config I inherited. Looking at the firewall I do not see a rule that allows traffic of a certain pattern to traverse the firewall. I do see the pattern applied for NAT'ing reasons and I'm curious, if you have a NAT policy defined, is that traffic able to bypass the firewall?

For example, I have one access list defined as:

access-list policy-nat extended permit udp object-group MY_OBJ any eq snmp

and another as

access-list firewall-list extended permit udp host 1.2.3.4 host 6.7.8.9 eq snmp

Both ACL's are applied to the same interface as such:

nat (my-int) 22 access-list policy-nat access-group firewall-list in interface my-int

Will any traffic patterns that conform to the NAT rules bypass the access-group entries?

2

nope, traffic that matches a NAT rule will not bypass the firewall rules.

Rules are applied in the following order:

  • Incoming ACL on the incoming interface
  • NAT rules
  • Outgoing ACL on the outbound interface

You may find a graphic representation of the process here: http://www.tunnelsup.com/cisco-asa-order-of-operation

Hope that helps!

1
  • 1
    FYI. This changes in 8.3+. NAT is processed before ACLs. – Eddie Mar 18 '15 at 7:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.