I'm a bit confused as to where to apply the IDS rules. Originally, I thought it was a no brainer, on the untrusted interface's inbound direction, but it seemed the more I read, the less clear it started to become. I've got a 2811 that has an inside trusted interface that is the LAN, another trusted interface that leads to the WAN, and an interface that leads to the Internet. Is there any rule of thumb here?
thank you,
Bill
