Nominated Discussion: Precedence of Routing\NAT\Policy

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Community Team Member
Did you find this article helpful? Yes No
No ratings

This article is based on a discussion, "Precedence of Routing\NAT\Policy". Read on to see Cyber Elite @TomYoung's response!

 

Dear All,

 

I want to know what is correct precedence among Routing\NAT\Security Policy

 

So If a packet hits on the outside zone of the Firewall then whether below process is correct?

1. Whether FW has route for the destination\5.5.5.5 ( If YES)

2. Whether there is any NAT policy  (If YES) ( Assume -> After NAT, 5.5.5.5 translated to 6.6.6.6)

3. Then security policy should allow original destination IP(5.5.5.5)  or Translated  destination IP (6.6.6.6)

Solution:

 

Hi @ManinderNegi,

 

Great question! A good general rule is "Pre-NAT IP, post-NAT everything else." For example, in this document -> NAT Configuration Examples the IP in the security policy is pre-NAT, while the destination zone is post-NAT.  Scroll down to the bottom to see the NAT and security policy rules.

 

With regard to precedence, a good diagram is this one taken from the PCNSE study guide on Beacon.

 

TomYoung_0-1672709765443.png

 

Of the order you mentioned, the route lookup is done 1st (Forwarding Lookup).  Then the NAT policy lookup is 2nd (DNAT check).  However, NAT is not applied to the packets until the egress interface (Forward Traffic).  The forwarding/NAT lookup is necessary to determine the destination zone.  Then the security policy is checked last.  That is why the IP address in the security policy is pre-NAT.

 

Thanks,

 

Tom

Rate this article:
Register or Sign-in
Labels
Article Dashboard
Version history
Last update:
‎01-10-2023 10:02 AM
Updated by: