A firewall can be described as being either Stateful, or Stateless.

STATELESS

Stateless firewalls watch network traffic, and restrict or block packets based on source
and destination addresses or other static values. They are not ‘aware’ of traffic patterns
or data flows.

A stateless firewall uses simple rule-sets that do not account for the possibility that a packet
might be received by the firewall ‘pretending’ to be something you asked for.

STATEFUL

Stateful firewalls can watch traffic streams from end to end. They are are aware of communication
paths and can implement various IP Security (IPsec) functions such as tunnels and encryption.
In technical terms, this means that stateful firewalls can tell what stage a TCP connection is in
(open, open sent, synchronized, synchronization acknowledge or established), it can tell if the
MTU has changed, whether packets have fragmented etc.

Neither is really superior and there are good arguments for both types of firewalls.
Stateless firewalls are typically faster and perform better under heavier traffic loads.
Stateful firewalls are better at identifying unauthorized and forged communications.

CBAC

When your router is running IOS image with FW feature, you can implement CBAC as a
Stateful Firewall IOS-based. With such inspection, the router can inspect inbound traffic from
outside such as The Internet to inside the network. The router can also inspect outbound traffic
from inside the network to outside.