Placing of the monitoring interface can be either inside your firewall or outside your firewall.
If inside your firewall you will only be monitoring packets that the firewall is allowing through.
If outside your firewall you will be monitoring the packets that the firewall is allowing through as well as the packets that the Firewall is blokcing.
In many cases users are inundated with alarms when the sensor is monitoring outside the Firewall. Many users are constantly beiong scanned and attacked, and the IDS is constantly firing off alarms. By placing it inside their Firewall they find out that the Firewall is doing it's job and blocking most of it, so then they only concentrate on the alarms for traffic that is actually being passed through the Firewall.
SO placement of the monitoring interface is really up to the user. In some cases users have one sensor on the inside that they use on a daily basis, then have a second on the outside, When they notice an attack on the inside then they check the outside to find out what else the attacker may have been doing that the Firewall was able to block.
The command and control interface of the sensor, on the other hand, should always be behind the Firewall. You should configure your Firewall to let the internal sensor ip address connect to the outside router for changing of the router's configuration.
