isr without an access list

[mialbert]

I have an 1800 isr that is running with port forwarding only.  It is running a series of ip nat inside source static address port address port commands.  It does not have an access list bound to the outside interface.  This is working fine, but i am wondering if this is a security concern

[paolo bevilacqua]

No, it is not.

Once you have NAT, no packets from outside can enter, unless a flow  is initiated from inside or static nat, in which case you want them to enter.

However some people don't trust that, and still want to use an ACL,