By defualt, to perform IPS deny actions, the ACL is applied when using IOS-IPS, to the ingress interface of the offending packet.