I inherited the management of a 2811 router which in addition to other things (it's our core router and VPN endpoint...I hate that it's all one box but can't break it up right now) firewalls between us and the internet using IOS Firewall. I'm familiar with firewall concepts and management but don't have much experience with any kind of Cisco firewalls, so I've been reading stuff on the web and comparing it to the 2811's configs to get a feel for it. Recently, I found this article:
Which is pretty straightforward, except for the fact that on our 2811 we have ACLs on the internet interface which permit the traffic we want to permit with IOS Firewall. It's set up this way for incoming and outgoing traffic (one ACL in, one ACL out). We have "ip inspect" statements just like in the article, but our related ACLs seems to be set up the opposite of what the article says.
It does work, though...so why does the article say to deny instead of permit?