Cisco IOS Order of Operation — Updated, Again

I am often search­ing inform­a­tion on the order of oper­a­tion of the dif­fer­ent fea­tures on an inter­face and the packet tra­verses the IOS soft­ware. All I can find on the Cisco​.com is this not-​​suitable-​​for-​​every-​​case table.

• If IPSec then check input access list
• decryp­tion — for CET (Cisco Encryption Technology) or IPSec
• check input access list
• check input rate limits
• input account­ing
• policy rout­ing
• rout­ing
• redir­ect to web cache
• NAT inside to out­side (local to global translation)
• crypto (check map and mark for encryption)
• check out­put access list
• inspect (Context-​​based Access Control (CBAC))
• TCP inter­cept
• encryp­tion
• Queueing

• If IPSec then check input access list
• decryp­tion — for CET or IPSec
• check input access list
• check input rate limits
• input account­ing
• NAT out­side to inside (global to local translation)
• policy rout­ing
• rout­ing
• redir­ect to web cache
• crypto (check map and mark for encryption)
• check out­put access list
• inspect CBAC
• TCP inter­cept
• encryp­tion
• Queueing

However, this list is the only that I can find and there are sev­eral things miss­ing but it’s its the only “offi­cial ver­sion” I’ve seen. That is, there are oth­ers around (see below) but don’t have the Cisco name the bottom.

Networkers doc­u­ment­a­tion

When I found this in my Networkers doc­u­ment­a­tion I think this is pretty com­plete and so post it here for other to use. If you know of another loc­a­tion on the Cisco web site, please leave a com­ment so that I can ref­er­ence it here.

Click the fol­low­ing for a lar­ger diagram.

Update — Thanks to Pierky

“There is another table too, on 6200net​works​.com by Joe Har ris: http://​6200net​works​.com/​2​0​0​8​/​0​9​/​3​0​/​i​o​s​-​o​r​d​e​r​-​o​f​-operation.”

I hope Joe doesn’t mind but I would like to put a copy here for my own ref­er­ence. I would like to have some sort of con­firm­a­tion from Cisco that this is more or less cor­rect, but it cer­tainly looks credible.

The author of this list (Craig Weinhold) said:

Thanks for post­ing the ASA order-​​of-​​operation — it’ll come in handy. You refer to the old IOS order-​​of-​​operation doc­u­ment — use­ful but very dated. David Smith and Greg Schudel have an updated ver­sion in their CiscoPress book “Router Security Strategies: Securing IP Network Traffic Planes”, but it neg­lected to touch on NVI’s, crypto clear-​​text ACLs, vir­tual reas­sembly, and other eso­teric details. I worked with them last sum­mer to come up with a more author­it­at­ive IOS order-​​of-​​operation for 12.4/12.4T. It’s neces­sar­ily incom­plete, but it sheds light on many eso­teric fea­ture inter­ac­tions. It’s attached below:

Big caveat: Some vari­ations in fea­ture order­ing may occur in spe­cific router plat­forms, IOS soft­ware releases, and switch­ing paths (i.e.,CEF versus process-​​switched).

* A note about virtual-​​reassembly

Virtual-​​reassembly causes the router to intern­ally reas­semble frag­men­ted pack­ets. It is enabled when an inter­face is con­figured with NAT, CBAC, or “ip vir­tual reas­sembly”. Operations above marked with a * will pro­cess the reas­sembled ver­sion of a packet. All other oper­a­tions pro­cess the indi­vidual frag­ments. After vir­tual reas­sembly is com­plete, the router for­wards the ori­ginal frag­ments, albeit in proper order. This beha­vior is very dif­fer­ent from PIX/​ASA/​FWSM and ACE which for­ward the reas­sembled packet.

Thus, even if virtual-​​reassembly is turned on, ACLs used for input access-​​groups and QoS still need to be aware of how ACLs inter­act with frag­ments (http://​www​.cisco​.com/​e​n​/​U​S​/​t​e​c​h​/​t​k​8​2​7​/​t​k​3​6​9​/​t​e​c​h​n​o​l​o​g​i​e​s​_​w​h​i​t​e​_​p​a​p​e​r​0​9​1​8​6​a​0​0​8​0​0​9​49b8.shtml).

Routing Features

1. Routing table lookup (if packet isn’t marked with a PBR next-​​hop) 2. tcp adjust-​​mss

And Another Update — PERFECTION

Craig Weinhold (author of the above list) has emailed an updated dia­gram. Which is totally out­stand­ing. I shall con­sider this be com­pre­hens­ive. Craig says:

Here is an updated OOO dia­gram using the same format and style as the
one from the net­work­ers present­a­tion (which was pro­duced by David Smith
and Greg Schudel for their book). I did col­lab­or­ate with them to fill
in some of the blanks.

Click for a full size image.

Please rate this post:

(5 votes, average: 10.00 out of 10)

 Loading ...