I have a question regarding order of operations during firewall inspection. As I saw in few posts, when packet arrives at interface, it's first matched against access policy, then destination NAT is considered, then routing, source NAT, and off it goes.
Anyway, if we have rule like this:
Web Server is a network object with private IP address and static NAT with public IP address checked under objects NAT properties. So automatic NAT rule is created, and bidirectional NAT is also checked under firewall global properties.
My question is - how then this works? And it does. If firewall policy is checked first then when a packet arrives at outside interface, there is no rule which allows from outside to web server's public address, only this one, and in logs, this rule matches.
I would appreciate if someone could clarify this.
Thanks in advanced.