3

I've recently begun working with firewalls (Different brands) and what really confuses me is the order the different firewalls check the ACL and NAT rules.

For instance, allow HTTP traffic from the internet to a webserver on a LAN:

  • Public IP: 1.1.2.2
  • Privat IP: 192.168.1.2
  • Destination port: 80
  • NAT the public IP-address 1.1.2.2 to 192.168.1.2

On some firewalls the ACL allows traffic from the internet to the webserver defining the LAN IP-address as the destination:

  • ACL: outside-in
  • Allow
  • Interface: Outside
  • Source: any
  • Destination: 192.168.1.2
  • Port: 80

But I sometimes see the public IP-address instead:

  • ACL: outside-in
  • Allow
  • Interface: Outside
  • Source: any
  • Destination: 1.1.2.2
  • Port: 80

In what order does the different brands of firewalls check NAT rules and the ACL's? Is there a difference between versions on the same type of firewall?

4

I can't speak to other platforms with authority but the Cisco ASA platform does it both ways depending on the version of code.

Pre-8.3, NAT was done after the ACL (so you would use the global or outside IP address in the ACL). 8.3 or later NAT is done before the ACL (so you will use the actual configured or inside IP in the ACL).

The way NAT is configured also changed in this version. You can check this Cisco Support Community post or other resources for details.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.