Cisco IOS Order of Operations

Inside-to-Outside Outside-to-Inside
  • If IPSec then check input access list
  • decryption – for CET or IPSec
  • check input access list
  • Input MQC QoS Classification
  • check input rate limits (Policing)
  • input accounting
  • redirect to web cache
  • policy routing
  • routing
  • NAT inside to outside (local to global translation)
  • crypto (check map and mark for encryption)
  • check output access list
  • inspect (Context-based Access Control (CBAC))
  • TCP intercept
  • encryption
  • QoS Queueing
  • If IPSec then check input access list
  • decryption – for CET or IPSec
  • check input access list
  • Input MQC QoS Classification 
  • check input rate limits (Policing)
  • input accounting
  • redirect to web cache
  • NAT outside to inside (global to local translation)
  • policy routing
  • routing
  • crypto (check map and mark for encryption)
  • check output access list
  • inspect CBAC
  • TCP intercept
  • encryption
  • QoS Queueing

Source: here, here, and here (QoS)
Sources one and two contradict each other, so YMMV. The table reproduced above is from the second source with the addition of the QoS order of operations from source three. It still does not sounds right to me but leave me a comment if you think otherwise.

In the above table, the only difference between packets flowing from the inside -> outside or outside -> inside is NAT and routing.

When a packet is going outside you will route first. This allows the router to find out which exit interface is going to be used. At this point both the inbound and outbound interfaces are known then you also know if you need to apply NAT

When a packet is going outside to inside, you check the NAT translation table first according to the table above. I think you should check routing first as then you will know your inbound and outbound interface. This would then tell you if you need to check the NAT translation table for an existing entry.

For example: If a packet arrive at the outside interface and is destined for the DMZ which isn’t NATed then you slow things by checking the NAT translation table before the routing table. However if you checked the routing table to determine you exit interface then you know there will be no NAT translations in place and you can skip this check.

More generally you could say the packet flow through a Cisco router is:

  1. Input Decryption
  2. Input ACLs
  3. QoS classification
  4. QoS policing
  5. IP Accounting
  6. WCCP
  7. Routing
  8. NAT
  9. Crypto Check
  10. Output ACLs
  11. Encryption
  12. QoS Queueing
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s