NAT and ACL order - Cisco ASA, Palo Alto, Checkpoint

Question

I've recently begun working with firewalls (Different brands) and what really confuses me is the order the different firewalls check the ACL and NAT rules.

For instance, allow HTTP traffic from the internet to a webserver on a LAN:

• Public IP: 1.1.2.2
• Privat IP: 192.168.1.2
• Destination port: 80
• NAT the public IP-address 1.1.2.2 to 192.168.1.2

On some firewalls the ACL allows traffic from the internet to the webserver defining the LAN IP-address as the destination:

• ACL: outside-in
• Allow
• Interface: Outside
• Source: any
• Destination: 192.168.1.2
• Port: 80

But I sometimes see the public IP-address instead:

• ACL: outside-in
• Allow
• Interface: Outside
• Source: any
• Destination: 1.1.2.2
• Port: 80

In what order does the different brands of firewalls check NAT rules and the ACL's? Is there a difference between versions on the same type of firewall?

Answer 1

I can't speak to other platforms with authority but the Cisco ASA platform does it both ways depending on the version of code.

Pre-8.3, NAT was done after the ACL (so you would use the global or outside IP address in the ACL). 8.3 or later NAT is done before the ACL (so you will use the actual configured or inside IP in the ACL).

The way NAT is configured also changed in this version. You can check this Cisco Support Community post or other resources for details.

Answer 2

ASA pre-8.3 : Access rule has Destination: 1.1.2.2

ASA post-8.3: Access rule has Destination: 192.168.1.2

Checkpoint: If object based static NAT is done i.e object for 192.168.1.2 is configured for static NAT to 1.1.2.2 inside the object itself, then access rule can use this object in the rule. Even if it uses another object of IP-1.1.2.2 in the rule, the NAT and access will work as long as object NAT exists (Also manual NAT can be used for destination translation and in that case we need to use object of IP-1.1.2.2)

Palo Alto: Must use object of IP-1.1.2.2 as destination in access rule. Then create a manual NAT rule to translate destination 1.1.2.2 to 192.168.1.2. Access rule should contain post-NAT destination zone and NAT rule should contain pre-NAT zones.