Secure Firewall Access Control, NAT, and Prefilter Policy
This domain tests the three policies that decide whether a packet is allowed, translated, or bypassed: prefilter, access control, and NAT. Exam questions usually hinge on evaluation order and first-match behaviour.
Order of evaluation
Prefilter policy is evaluated first, then Security Intelligence and SSL policy, then access control rules top-down with first match winning, then the default action. NAT is configured in its own policy and applied per connection.
Access control policy
- Rules match zones, networks, ports, applications (App ID via Snort), URLs, and users (identity from ISE/AD/pxGrid).
- Actions: Allow (with intrusion, file, malware inspection), Trust (allow with no further inspection), Block, Block with reset, Interactive Block (block page).
- Default action options: Block all, Trust all, Network Discovery only, Intrusion Prevention. A monitor-only rollout typically uses permissive rules with alert-only intrusion policy.
Prefilter
Tunnel and prefilter rules match GRE, IP-in-IP and similar tunnel traffic or traffic you want outside the ACP. Actions: Analyze (hand to ACP), Block, Fastpath (skip the ACP entirely). The default action is Analyze with ACP or Fastpath - a Fastpath default is the classic reason an ACP rule never matches.
NAT
- NAT is a separate policy applied to the device and edited independently of the ACP.
- Network object NAT (auto) is created inline with the object; manual NAT rules allow policy NAT, conditional translation and explicit ordering. Rules are first match, top-down, so overlapping subnets must be ordered deliberately.
- Write access control rules against the real, pre-translation address, then verify translation separately; FMC's packet tracer shows the ACP stage and the NAT stage independently.
Worked example
Publish 203.0.113.10:443 to internal 10.1.1.10. Create one manual static NAT rule (original 203.0.113.10:443 → translated 10.1.1.10:443). Create an ACP rule: outside zone → inside zone, destination object for 10.1.1.10, port 443, application HTTP/HTTPS, intrusion policy attached, action Allow. Run packet tracer: if the ACP stage matches but the flow still fails, inspect the NAT stage and the egress route.
Traps
- Prefilter Fastpath bypassing the ACP while you troubleshoot the wrong rule.
- Choosing Trust when inspection was required - Trust skips IPS and file/malware.
- Leaving overlapping NAT rules in the wrong order so a later rule is shadowed.
- Testing with ping and concluding the policy is broken when ICMP is simply not permitted.