Policy processing order

jwill2 — Mon, 28 Jul 2025 18:45:50 GMT

I have a question about how policies are processed; specifically NAT vs Security Policy.

We have a NAT policy that performs destination NAT to translate all traffic to port 53 to be translated to our corporate DNS servers.

We have a security policy for DNS that permits outbound access to only our corporate DNS servers. All other DNS destinations are blocked.

When looking at the security logs, I see entries showing DNS destinations to other DNS servers (like Google's DNS) getting blocked (which is expected).

I have tested using nslookup on an internal host name using the Google DNS as the server and the response times out and I see it blocked at the firewall.

When does the NAT translation take place?

What should my Security policy look like?

Re: Policy processing order

CosminM — Tue, 29 Jul 2025 07:16:04 GMT

Hi @jwill2

You can look into a packet flow diagram to find your answer:

Detailed Packet Flow Diagram

topic Re: Policy processing order in General Topics

Policy processing order

Re: Policy processing order