Stateful firewall vs reflexive ACL

[rj]

Is there a substantial security difference between using reflexive ACLs for IP session filtering in IOS and the stateful firewall technology of the PIX?

Thanks,

RJ

[jsivulka]

Yes, From what I've read (in bits and pieces), Reflexive ACL's suffer from a number of performance issues. While routers with ACL's (or even better,a router with the firewall feature set) will protect your network to a great degree, I feel a firewall is a must if you are thinking about a strong, long-term security solution.

[rj]

Thanks for the post. While I know reflexive ACL's will be slower, I still think they are better protection than just regular ACLs. An example is that they will not allow connections started from the outside.

Thanks,

RJ