The "established" keyword in Cisco is a form of state-checking on TCP streams. It allows return traffic to a TCP session initiated from inside by allowing TCP if ACK or RST bits are set.
Adtran accomplishes this differently, its firewall is stateful by default.
Your Cisco ACL is applied to the outside interface and allows the following:
* Return traffic to TCP sessions established from the inside (allows inside hosts to surf the web, retrieve email, etc.)
* Initial traffic from anyone on the outside to a secure web server on 63.XXX.XXX.XXX port 443 (HTTPS).
In the Adtran, you would accomplish this with two policies.
On the inside, create a policy "Private" that has a permit ip any any ACL to the destination "Public". If NAT is involved, it would go in this policy. This permits inside hosts to initiate anything to outside and by default allows the return TCP traffic from the outside "Public" interface implicitly. Adding the "stateless" keyword strips some inspection of the return stream, so don't do that. Apply this policy to the inside interface. For BCP38 and spoof-blocking you could optionally limit the source IP range to the subnet assigned to the inside (recommended).
On the outside, create a policy "Public" that has an extended ACL permitting TCP traffic from any to host 63.XXX.XXX.XXX port 443 and allow that to destination Private. For BCP38 and spoof-blocking you could optionally deny sources matching your inside subnet, this line goes first. Apply this policy to the outside interface.
Short version: With Adtran, you don't need the "established" ACL on the outside to allow inside users to initiate TCP sessions and have the return traffic permitted.
