Shulou(Shulou.com)06/01 Report--

Firewall packet processing flow chart

The order of ACL and NAT is not fixed, and the data flow of each manufacturer varies from ACL to NAT.

To quote "A brief Analysis of the execution order of ACL and NAT"-the conclusions of Zhang Shaofang are as follows:

H3C

Outbound: match outbound ACL first, then perform address translation

Inbound: perform address translation first, and then match the inbound ACL

CISCO

Outbound: address translation is performed first, then outbound ACL is matched

Inbound: first match the inbound ACL, and then perform address translation (that is, the order of the data flow shown above)

Conclusion

H3C devices and CISCO devices are completely opposite in the sequential processing of ACL and NAT. As there may be devices from different manufacturers in the actual network, it is necessary to understand the execution sequence of specific devices to ACL and NAT before the specific application of ACL policy, so as to ensure the effectiveness of ACL.

Pay special attention to

When using the actual equipment, it is found that CISCO ASA5545 Version 8.6 (1) 2, the inbound ACL configuration uses the translated address, that is to say, the address is translated first, and then the ACL is matched. After searching on the Internet, it is found that after the 8.4 version of ASA, the order of NAT and ACL has been adjusted.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.