Shared Services Block Design

[techno.it]

Hello Team,

When it comes to shared services blocks like WLC, ISE, DNAC, and DHCP, do you typically deploy them behind the data center firewall in the data center block for an extra layer of security, or do you prefer to place them on the core side of the network for ease of access and scalability, for instance, pair of stack switches directly connected to the Core switch?

Regarding the WLC, let's consider a scenario where it's set up in Flex Connect mode for all SSID traffic, including the guest network. However, please note that the guest network is isolated within an L2 VLAN on the Core Switch, with the firewall serving as the gateway.

Appreciate any tips and suggestions.

[Flavio Miranda]

@techno.it 

This Is so specific. I believe each company will have some different approach. 

 And it will depend on the size.  Some data center may have dozen of firewalls.

 Some companies put firewall between data center and Corp sites but some will not filter this traffic. Usually Banks put firewall everywhere.