Great explanation of an important topic. One reason I've been moving from ACL to zone based firewall is that it's usually easier on the router to drop the packet than block it. This plus making reconnaissance more difficult.