I have a client that is insisting on using a single device (2811) to connect to the Internet as well as their local Lan. I would like to use the firewall feature set to minimize the internal network risks having the Internet terminated on the same device. I am not familiar with what is required to do this properly. A point to some documentation and/or sample configs would be appreciated.