Checkpoint vs. cisco extended access-list???

[jacob200]

Two questions:
1) I know that firewalls do packet inspection and an extended access-list , of course will not but what exactly does packet inspection buy you? What are some examples of the kinds of packets a true firewall os would catch that an extended access-list would not?

2)Generally speaking, would an extended access-list on a router used in conjunction with other ios security enhancments (no ip http redirects, etc.) be secure enough in comparison to using a true firewall? We also would have an ISS scanner in place to help catch problems.

Thanks,

 

[hicham]

Hi Jacob,
As you have said ACL are limited, I advise you to check on the Internet about:
Stateful inspection, Anti spoofing wich does not exist on routers.

http://www.enteract.com/~lspitz/fwtable.html

Hicham Tfaily