Best Hub-and-Spoke design using PIX ****

[bbravo]

Can someone advise me on what would be the better solution for the following:

A Hub and spoke network, new sites are going to be joining the main hub with PPP T1's, I still have to keep my network (main hub) protected and everyone else behind the PIX, should I place a PIX on every remote site?

[jsivulka]

I guess a firewall on each site is a better idea. I am assuming that each site would have direct internet connectivity of some sort atleat and that would make a firewall necessary.

[smartin]

I have a frame network with 52 remote offices. The remotes connect to a frame router here at the corp. office. The frame router than connects to a Cisco 2950 switch, then connects to a PIX firewall interface which connects them to internal servers. I have a Cisco IDS system that "scans" all information from the remotes when going into the switch.

This configuration has saved me several times from viruse's, DOS attachs.