Hi there. I have installed a lot of concentrators for customers in the past, and by way of a surprise, there is no 'standard' way to deploy the device. What is comes down to really is your own security policy.
However, the majority of customers have the external interface of the 3000 on a DMZ of a firewall and then have the internal interface directly on the internal LAN. This is quite a good balance of setup time vs security. If the company tends more toward the paranoid end of the security scale, then they will have both interfaces each on their own DMZ's.
The extra work necessary on the firewall for this deployment can be prohibitive, but also can be essential especially if you are giving access to third parties that require strict access control.
Those companies that tend more toward the 'easy life' end of the security scale have the 3000 deployed in paralell to the firewall, i.e. the external interface has a direct connection on the internet, and the inside is directly on the inside. This sounds a bit insecure to some, but is perfectly valid if the external interface is secured correctly. Also, this deployment still allows access into the network in the event of the firewall dying.
Hope this helps.
