I'm studying CCNA and i've just learnt about Reflexive ACL's. Just wondering how secure or insecure it would be to use an ACL in place of a firewall.

This was a LAB router that I would like to set up as my home internet gateway.


Yes, you can use a reflexive ACL but it couldn't possibly be as secure as a stateful inspection firewall. Since you are studying for the CCNA, you should build the lab network like real customers do. IOS has a real stateful inspection fw; I would use that.

  • Thank you, I didn't realise that was in all IOS images. – Jake Nelson Jun 26 '13 at 12:13
  • which version and feature set are you using? – This Jun 26 '13 at 12:21
  • 3
    @Mokilok it isnt in every IOS images - you need to use the feature navigator to check as Mike is referencing to. – knotseh Jun 26 '13 at 13:52
  • My image is c1841-ipbase-mz.124-3i.bin I'm guessing that since it's ipbase I don't have access to the firewall. – Jake Nelson Jun 28 '13 at 10:05
  • Correct, in most cases you will require AdvIPservices IOS to utilise the IP Inspect features. It is very powerful, don't forget by default it hates Java - cisco.com/en/US/docs/ios-xml/ios/sec_data_cbac_fw/configuration/… – BrianK Jul 1 '13 at 0:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.