I am confused with the access-list requirement for IPS.

IPS device will create dynamically generated ACL to the router in the event that a signature is triggered. It requires an existing access-list defined as Pre-block access list and an existing access-list defined as post-block access list.

Does this mean that I need to set up at least 3 access-list on my router, one for normal use that is applied to the interface, another one to be defined as pre-block access-list on IPS device and a third one to be defined as post-block access-list on the IPS device?

Thanks