Are NAT rules not subjected to firewall / policy group rules on an ASA?

Question

Have an existing ASA that has a config I inherited. Looking at the firewall I do not see a rule that allows traffic of a certain pattern to traverse the firewall. I do see the pattern applied for NAT'ing reasons and I'm curious, if you have a NAT policy defined, is that traffic able to bypass the firewall?

For example, I have one access list defined as:

access-list policy-nat extended permit udp object-group MY_OBJ any eq snmp

and another as

access-list firewall-list extended permit udp host 1.2.3.4 host 6.7.8.9 eq snmp

Both ACL's are applied to the same interface as such:

nat (my-int) 22 access-list policy-nat access-group firewall-list in interface my-int

Will any traffic patterns that conform to the NAT rules bypass the access-group entries?

Answer 1

nope, traffic that matches a NAT rule will not bypass the firewall rules.

Rules are applied in the following order:

• Incoming ACL on the incoming interface
• NAT rules
• Outgoing ACL on the outbound interface

You may find a graphic representation of the process here: http://www.tunnelsup.com/cisco-asa-order-of-operation

Hope that helps!