Terence
Is the campus the one with with the 6500s ?
If so not sure what you mean by there is no distribution layer ie. your 6500s are your distribution layer whatever you call them.
In terms of will there be a performance impact then yes because firewalls have to inspect the packet headers in terms of IPs, port numbers and for some protocols they may have to further into the packet itself.
But that doesn't mean the performance impact will degrade the network, merely that it will add some latency to the packets between the campus and the DC.
If it was me I would be asking the security admin why he wants to do this. Not saying he is wrong but what is he trying to protect ie. I have used firewalls in DCs but not everything in the DC necessarily needs firewalling so I have never firewalled the entire DC from the rest of the corporate network.
Some things like database servers definitely require firewalling as these servers are usually very important to the company but that doesn't mean every server is the same. So I would expect the security admin to want to firewall at least some things in the DC from the corporate users but whether that means firewalling everything is up for debate.
Bear in mind also what applications are running in the DC ie. if you place the firewalls between the campus and DC you may end up having to open so many ports the firewalls in effect becomes almost like routers.
There may be a very good reason why he wants to do this but I have also come across security people who simply want to firewall everything believing it automatically makes everything more secure and this is not always the case.
Perhaps you could clarify exactly what his reasoning is behind this ?
Again, not saying it is wrong but a lot depends on exactly what you need to protect.
Jon
