Why do you use ACLs instead of a stateful firewall?
Stateful inspection is most useful for protecting outbound traffic, but with hosting, the servers tend to receive traffic instead of initiate it. Also, because we are dealing with an unknown amount of traffic, the ability to scale is very important. Stateful inspection is a resource-expensive task for a device to perform and therefore subject to strict capacity limitations (we’re talking sub Gigabit for most firewalls). On the other hand, Cisco routers perform ACL packet filtering at line rate with absolutely no performance hit. So, while stateful inspection is appropriate for small, stable amounts of outbound traffic or for protecting niche pieces of the network, (like e-commerce databases), ACLs are more scalable and efficient for protecting inbound traffic to servers. If a customer still desires a stateful firewall, we can add it for a fee.
