Cisco IOS Order of Operations

Inside-to-Outside

Outside-to-Inside

If IPSec then check input access list decryption - for CET or IPSec check input access list Input MQC QoS Classification check input rate limits (Policing) input accounting redirect to web cache policy routing routing NAT inside to outside (local to global translation) crypto (check map and mark for encryption) check output access list inspect (Context-based Access Control (CBAC)) TCP intercept encryption QoS Queueing

If IPSec then check input access list decryption - for CET or IPSec check input access list Input MQC QoS Classification  check input rate limits (Policing) input accounting redirect to web cache NAT outside to inside (global to local translation) policy routing routing crypto (check map and mark for encryption) check output access list inspect CBAC TCP intercept encryption QoS Queueing

Source: here, here, and here (QoS)

Sources one and two contradict each other, so YMMV. The table reproduced above is from the second source with the addition of the QoS order of operations from source three. It still does not sounds right to me but leave me a comment if you think otherwise.

In the above table, the only difference between packets flowing from the inside -> outside or outside -> inside is NAT and routing.

When a packet is going outside you will route first. This allows the router to find out which exit interface is going to be used. At this point both the inbound and outbound interfaces are known then you also know if you need to apply NAT

When a packet is going outside to inside, you check the NAT translation table first according to the table above. I think you should check routing first as then you will know your inbound and outbound interface. This would then tell you if you need to check the NAT translation table for an existing entry.

For example: If a packet arrive at the outside interface and is destined for the DMZ which isn't NATed then you slow things by checking the NAT translation table before the routing table. However if you checked the routing table to determine you exit interface then you know there will be no NAT translations in place and you can skip this check.



More generally you could say the packet flow through a Cisco router is:

1. Input Decryption
2. Input ACLs
3. QoS classification
4. QoS policing
5. IP Accounting
6. WCCP
7. Routing
8. NAT
9. Crypto Check
10. Output ACLs
11. Encryption
12. QoS Queueing