IOS firewall or Reflexive ACL?

[Bojan Zivancevic]

What is the main benefit of using IOS firewall (CBAC) over reflexive ACLs? Speed? Both are opening holes as they are needed and closing them afterwards.

Is it CBAC's application layer awareness?

Thx

[mhoda]

Hi,

CBAC has the DOS protection unlike Reflexive ACL. Inrecept feature is built into CBAC.

I hope this helps.

Regards,

Mynul

[r-lemaster]

Yes, CBAC has application awareness/inspection and reflexive ACLs don't. CBAC also has more features like traffic filtering, java blocking, alerts, audit trails, & intrusion detection. I believe IDS and stuff requires a 2600 or better. Use CBAC.