Traffic processing in Cisco Firewall

I see many people confused about this mainly when does the SSM module’s analysis engine sees the traffic.

; FYI here is complete flow starting with Receive Packets till the Transmit Packets as per my knowledge goes...



1. Receive Packet

2. Ingress Interface (ASA)

3. Existing Conn? (if yes, skip to #6, else go to #4)

4. ACL Permit (if no, drop, else if yes go to #5)

5. Match Xlate (if no, drop, else if yes, go to #6)

6. Inspections and Protocol Checks

7. NAT IP Header

8. IPS SSM Module

9. Egress Interface (ASA)

10. L3 Route (if no route, drop, else go to #11)

11. L2 Addr (if no address, drop, else go to #12)

12. Transmit Packet

Best Regards,
Deepak Arora