I am a relatively new IT specialist for a small company (about 30 employees, 100 more seasonal.) Most of our systems have been outsourced to an IT company long ago, that handles licensing, VDI, PBX, security, routing, etc. I handle hardware, some networking, inventory control and imaging.

I discovered on the phone with them that all our physical machine traffic is going out of a Cisco router that has been EOL for three years. In addition, there isn't any serious firewall capability. Our virtual CIO told me that it had an access control list, which is a sufficient firewall for us. I'm not very knowledgeable in internet security, but that just didn't seem right to me. We're dealing with sensitive census data, PHI and payroll systems on that network, and must be HIPPA compliant (which they are supposedly taking care of.) Email is cloud-based.

Is an ACL "good enough" or should we be using a real firewall appliance? Thanks!


No, no and no.

ACL's block traffic from specific IP's, subnets or ports/services (depending on whether you're using standard or extended), but they perform no real firewall functions as you stated before. Security is best in layers, and ACL's are meant to be one layer in a much larger security plan. There is no intrusion detection or intrusion protection, and no serious threat mitigation with them. Also, EOL for 3+ years is very dangerous as there are new exploits developed daily, and Cisco has had a lot of CVE's lately...

In addition to ACL's, you need at least one security appliance. For a company your size, Sonicwall would be a great fit. Barracuda is also an option, although they do not provide identical services.

I was an admin in a similar sized company many years ago, and we had nothing but Clam AV when I started. I'll spare you the details but we were routinely targeted with little protection and had a difficult time responding to threats. It took a very costly malware incident to finally convince the owner to cough up the money for a Sonicwall. Ours didn't cost the industry average of $7.91 million referenced just above, but it sure as (insert preferred profane word here) was more expensive than buying several appliances.

  • 1
    Thank you for your answer, that's really what I suspected. It's hard to make a case as a recent college grad to a senior CIO that he's doing things wrong.. Looks like it definitely has to be done. – user182982 Jul 26 '18 at 14:38
  • You are correct, it needs to happen. If this was helpful, please mark it as the answer :) – SomeGuy Jul 26 '18 at 14:56


You absolutely need more security devices and mechanisms put in than just an ACL, this is not sufficient at all, security is best done in a layered approach an ACL on a router is simply one layer you should have many, many more.

Based on what you've said, your security is pretty poor and for what kind of data you're handling there is no excuse.

Access-Control Lists where originally built to be a security function, they provide a nice base level of security, however, they are nowhere near the level of what a firewall can do for you. ACLs tend to be used nicely for segregating at layers 2 & 3 (Yes you can put ACLs on switches on things like the VTY lines, etc).

Standard ACLs

Standard ACLs provide a very limited feature, they can only permit or deny traffic based on the source address this can be useful however as I said very limited and don't tend to be used as much as an extended ACL.

Extended ACLs

Extended ACLs do provide a few extra features compared to a standard ACL, it's still not a firewall however extended ACLs can permit or deny traffic based on source address, destination address and port numbers.

Another thing you can be done at layer 2 is port-security, port-security on your switches is always a good idea if your cab is somewhat accessible and you know that the devices that go in certain switch ports will stay there and there is no reason for someone to need to unplug it and plug another device in. Without going too complex port-security allows things such as MAC address filtering whereby only a specific MAC address is allowed to communicate on that port and if the rule is violated an action takes place such as the interface being err-disabled so no further traffic can pass-through.


You may now be wondering what the benefits of a firewall are and one of the best things about them (especially top-end firewalls) is how granular you can be with rules. A few features to think about, granular access-rules, deep packet inspection & filtering, etc. Most firewalls will do the same sort of thing, however, the really high-end ones will have more features it just depends what you go with, recently I've seen a lot more implementations with virtual firewalls on customers networks which is interesting to manage.


It's common to see an IPS/IDS built into a firewall today especially on Next-Generation Firewalls, however, I'll talk about these separately.

An IPS is like a firewall in the sense that it does access-control however it does it the other way round to a firewall. A firewall allows access via permit statements and has an implicit deny if it's not matched whereas an IPS will have deny rules if a packet doesn't hit any of those deny rules it will permit.

An IDS is slightly different from an IPS, in that it analyses the security of a network, IDS can be incredibly powerful in helping engineers figure out where issues are sourcing from. Below is a list of things an IDS will typically do.

  • Security policy violations
  • Infection scanning
  • Information leakage
  • Configuration errors
  • Unauthorised clients


The ability to access this information at the click of a few buttons is incredibly powerful and something you absolutely won't get from an access-list. As mentioned, security is best done in a layered approach - access-lists are very good for segregation but if you want a true insight into what's going on, on your network and where the issues lie you need more than just access-lists and even more than a firewall.

Some firewalls come with a built-in IPS/IDS which is great because it solves the need of having three physical devices (if you're not using any virtualization) which not that ago, this was not an option.

When handling data such as the data you're handling you should be protecting the network at all points not at one point. Ideally, you want to take advantage of access-lists, port-security, firewalls, IPS, IDS and more.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.