5

I have found many answers to this question, none of which satisfy me due to lack of detail. Can someone please explain in detail what is a firewall and what is its purpose, and what is an ACL and what is its purpose, and why are these two not the same? What are the differences in terms of functionality, goal, deployment, administration and anything else?

Improve this question
2
  • There a multiple types of firewalls, and multiple type of ACLs. You really need to be more specific. You could fake a firewall with reflexive ACLs, but it could be more work than it is worth. You should learn about stateful (typical firewall), vs. stateless (standard or extended ACL).
    – Ron Maupin ♦
    May 23, 2022 at 12:36
  • I know that there are multiple types of each and many answers on the internet are not comprehensive at all. I hope that someone would be able to help and do a really detailed comparison of the different types of firewalls with the different types of ACLs
    – GalSuchetzky
    May 23, 2022 at 12:40

3 Answers 3

Reset to default
10

ACLs are packet filters. They pass or block packets based on packet data, such as addresses, ports, or other data. They are also stateless. That means the decision to pass or block a packet is based solely on the values in the packet, without regard to any previous packets.

Firewalls* are stateful devices. They also pass or block packets based on data, but they "understand" the semantics of the data and can enforce protocol semantics based on data that was in previous packets. For example, a firewall can inspect a TCP exchange, ensuring that acknowledgements match the data sent, or that flags are set correctly.

Many firewalls can look deeper into the packet and enforce higher level semantics, such as HTTP or other application-level protocols.

*Generally speaking. Specific features vary by manufacturer.

Improve this answer
9
  • good answer, may you please elaborate on the different types of firewalls and ACLs and the characteristics of each?
    – GalSuchetzky
    May 23, 2022 at 12:55
  • The answer generally applies to all ACLs and firewalls. Is there some specific feature you have questions about?
    – Ron Trunk
    May 23, 2022 at 13:08
  • nothing specific, but I could not find anything specific anyway so having a better detailed comparison might be very beneficial for the community
    – GalSuchetzky
    May 23, 2022 at 13:31
  • I think you're making a distinction where none exists, or is dependent on a particular manufacturer's features.
    – Ron Trunk
    May 23, 2022 at 13:48
  • 1
    Well put - I'd just like to add that "firewall" is a security function in a network, while ACLs are a feature for stateless packet filtering - both terms are from different cruising altitudes. You can build a firewall using ACLs, but most often you'd want stateful filtering,.
    – Zac67 ♦
    May 23, 2022 at 14:12
4

Stateful inspection is the easy answer to what is the difference between a firewall and access control list.

Access lists (ACLs) define interesting traffic. An ACL specifies network addresses and optionally port numbers, or destinations. The interesting traffic is then acted on by processes such as QoS, routing, interface filtering, etc.

The term firewall is not really a technical term as much as it is a marketing or conceptual term. A firewall assumes an unprotected outside network and protected inside network. Early firewalls recorded transport protocol messages in temporary tables (in memory) enabling them to monitor the state of connections. Later firewalls performed deep packet inspection meaning the firewall was aware of the expected behavior of various applications traffic. Then next generation firewalls added application awareness and control, integrated intrusion prevention, and cloud-delivered threat intelligence¹.

¹What Is a Next-Generation Firewall?

Improve this answer
4
  • 1
    If you applied an ACL to an interface, would you still use the term interesting traffic?
    – Ron Trunk
    May 23, 2022 at 16:03
  • @RonTrunk an access list applied to a specific network interface is called an access group. The term interesting traffic refers to the traffic specified in the configured access list.
    – Ronnie Royston
    May 23, 2022 at 17:12
  • 2
    An Access Control List is a generic term. Access group is term specific to Cisco.
    – Ron Trunk
    May 23, 2022 at 18:39
  • @RonTrunk thank you for that clarification. Very helpful.
    – Ronnie Royston
    May 23, 2022 at 19:43
2

These are different levels of abstraction.

A firewall is a device or software component whose purpose is to protect a network or computer from unwanted traffic. There are many different types of firewalls, such as: simple packet filters, stateful packet inspection, transparent proxies, bastion hosts. Some firewalls support multiple technologies like these.

An Access Control List (in this context) is a component of a firewall configuration that's used to specify what type of traffic is allowed.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.