Firewall-Blades Order of Operation

[ahmedaburaihan]

Hallo Mates

What is the order of operation of Firewall-Blades in a normal environment? 

Let suppose a packet from Internet enters an OUT Interface of a Firewall, How does the Firewall deal with it?

- Does the Policy/Rule is checked against.

- Does the Threat Prevention Module works first?

... and so on. 

I would be grateful for a detailed answer in this regard. 

Thank you, 

A. 

[_Val_]

This pic should answer your quesiton

[ahmedaburaihan]

Yes, thank you for the pic. Could you please also put some light on this? 

[_Val_]

It depends. You asked about the order of different blade enforcement.

When the packet comes to your GW, it is being inspected before forwarding. The first action is anti-spoofing. Then, and even before it is filtered through the security policy, TLS inspection policy is applied, if the feature is enabled on your GW.

The next step is your Security policy in combination with Application Control, URL filtering, and Content Inspection if they are used. If the result is Accept action, the next step is Threat Prevention: AV, IPS, and anything else you have in your Threat Prevention Policy.

The whole logic is linear, without loops.

[Bob_Zimmerman]

Two noteworthy items are missing from that diagram: VPN decisions (like flagging a packet for encryption to a given VPN peer) and NAT.

My memory is VPN decisions are made between antispoofing and HTTPS inspection. This is before any address translation can happen, and it affects which addresses you need to include in a firewall's encryption domain.

NAT rule matching is done with the firewall policy matching, but decisions aren't actually applied until later (after the Threat Emulation/Extraction part of this diagram). All rules should be written based on how the traffic will look when it arrives at the firewall.