I assume you're asking to compare Cisco Access Control Lists (ACL) and Cisco Flexible Packet Matching (FPM).
Packets contain a number of fields, such as:
- IP source address
- IP destination address
- TCP Source Port
- TCP Destination Port
- UDP Source Port
- UDP Destination Port
ACLs
Traditional ACLs can only permit or deny based on a limited number of fields (some of most commonly used fields are listed above); these fields are well-known throughout the internet. However, traditional ACLs cannot filter inside the payload of an IP packet, for instance if someone wanted to block certain kinds of Tibco RV UDP Multicast payloads, it's impossible to do so with traditional ACLs. Traditional ACLs look like this...
! Note: this ACL is only granular to a TCP port
access-list 102 permit tcp any any eq 80
access-list 102 permit tcp any any eq 443
access-list 102 permit tcp any any eq 23
access-list 102 permit tcp any any eq 25
access-list 102 permit tcp any any eq 110
access-list 102 deny ip any any log
!
interface FastEthernet0/0
ip access-group 102 in
FPM
However, FPM can block / allow on any bit inside a single packet header or payload1, as long as there is a valid PHDL file loaded for the field that needs to be blocked or allowed. FPM can define a hierarchy of classes and policies to implement very granular control over the packets that are allowed or denied.
This is an example policy, taken from the FPM docs, which matches a UDP packets sent by the Slammer Worm. It would be impossible to block the hosts infected with the Slammer Worm using ACLs unless you block both good and bad SQL traffic by individual IP source addresses.
load protocol disk2:ip.phdf
load protocol disk2:udp.phdf
!
class-map type stack match-all ip-udp
description "match UDP over IP packets"
match field ip protocol eq 0x11 next udp
!
class-map type access-control match-all slammer
description "match on slammer packets"
match field udp dest-port eq 0x59A
match field ip length eq 0x194
match start l3-start offset 224 size 4 eq 0x4011010
!
policy-map type access-control fpm-udp-policy
description "policy for UDP based attacks"
class slammer
drop
!
policy-map type access-control fpm-policy
description "drop worms and malicious attacks"
class ip-udp
service-policy fpm-udp-policy
!
interface GigabitEthernet0/1
service-policy type access-control input fpm-policy
End Notes:
1 FPM's limitation of inspecting a single IP packet is non-trivial, since that means it's possible to circumvent FPM if an attack manages to split the attack signatures across multiple IP fragments, or TCP packets (since the TCP stream is reassembled at the receiver). That said, it's a still very powerful tool as long as you understand the limitations of the technology.
Consumer grade routers generally have this distinction, although some enterprise SOHO routers also have this distinction. WAN stands for Wide Area Network and this is the network that connects your router to your service provider. The WAN port usually connects to a DSL modem, cable modem or fibre media converter. LAN stands for Local Area Network and this is the network that connects the devices within your home/business to the router. The LAN port or ports usually connect to PCs, printers etc. LAN ports can also connect to wireless APs to allow laptops, smartphones, tablets etc to connect to the LAN. The router then routes between the LAN and WAN network, applying NAT and firewall policy in the process.
Best Answer
I would use ESW card in router if I had small office that needs to have 5 users connected. Then I would have router and switch in same device instead of buying a separate 2960 or such.
The only benefit I see with using EHWIC card would be if you need to use LAN features like port security, private VLAN, DHCP snooping etc. However in the first case you mentioned you would use the router as pure router and leave switching features for a real switch.
So it boils down to if you want to have routing/switching in one device or multiple. The only real use case I see for it is small office that doesn't need 24-p switch. You would only need to manage one device as well.