This post will cover the order of operation that takes place in a Cisco ASA. Specifically the packet flow and each step that is conducted.
Consider the following image that displays the packet flow.
Packet is received from the wire
Packet hits the ingress interface. Input counters are incremented.
Inbound Packet Capture: Packet is processed by any packet captures that exists on that interface
Does this packet have an existing connection?
If yes. Move ahead to step 6.
If no. If packet is TCP-SYN or UDP packet, proceed to ACL check. Else drop packet.
Packet is processed by inbound access-list. Notes about ACL checks:
First packet in flow is checked. All others are considered existing connections.
The first matching rule in the ACL is all that will be checked
ACL hitcnt will increment with matching rule
NAT rules process packet. Notes regarding NAT rules:
In post 8.3 nat control is turned off on the ASA and cannot be turned on. Pre 8.3 if nat control was on and a packet did not match an XLATE it was dropped.
A route lookup is conducted only to determine egress interface to match NAT rules
After translation takes place, the connection is created
Packet is processed by any inspect rules.
CSC Module: Packet is processed by CSC module if firewall has it
CX Module: Packet is processed by CX module if firewall has it
Packet gets the IP address translated in the header. The port is also translated if the translation is a PAT. New checksums are created for packet.
IPSM: If IPS module is installed the packet is then passed to the module.
Packet is virtually forwarded to egress interface. Egress interface is determined first by translation rules if known.
L3 route check. Once on the egress interface a route check is performed. Only routes pointing to the egress interface will be forwarded. If you receive a syslog that looks like this
ASA-6-110001: No route to 126.96.36.199 from 10.0.5.5the NAT and route have conflicting interfaces.
L2 address lookup. An ARP lookup is conducted at this stage.
Outbound Packet Capture: Packet is processed by any packet captures that exists on that interface
Packet is transmitted and put on wire. Interface counters go up.
Source: Cisco Live Presentation in 2011, updated in 2012. I have confirmed with a Cisco Technical Solutions Architect who got confirmation from a Cisco developer that this packet processing flow is valid for both pre 8.3 and post 8.3.
Here’s another way to look at it which shows which plane the packet is on during which time.