Order of operations

[Ivan_Kusturic]

Hi everybody,

I have a question regarding order of operations during firewall inspection. As I saw in few posts, when packet arrives at interface, it's first matched against access policy, then destination NAT is considered, then routing, source NAT, and off it goes.

Anyway, if we have rule like this:

Web Server is a network object with private IP address and static NAT with public IP address checked under objects NAT properties. So automatic NAT rule is created, and bidirectional NAT is also checked under firewall global properties.

My question is - how then this works? And it does. If firewall policy is checked first then when a packet arrives at outside interface, there is no rule which allows from outside to web server's public address, only this one, and in logs, this rule matches.

I would appreciate if someone could clarify this.

Thanks in advanced.

[Timothy_Hall · Accepted solution]

Since you used the automatic NAT setup technique on the object "Web Server", when that object is placed into a rule it can match both IP addresses (the "real" address and the NAT address) since they both exist within the configuration of that object. 

This would most definitely not apply if the manual NAT setup technique was used, as two host objects would need to be created.  One object represents the "real" address and the other object represents the NAT address.  Because the network policy layer ("firewall policy") is referenced prior to the NAT policy, the latter host object representing this NAT address should be used in your firewall policy rule.

[Ivan_Kusturic]

Thank you very much Timothy. Would you be so kind to take a look at another topic I opened a week ago? Your answer would be most appreciated. Here is the link:

https://community.checkpoint.com/t5/Access-Control-Products/Site-to-Site-VPN-configuration-suggestio...