Alright, I lied. Here's the deal: Packet Tracer is not really conducive to operating in this capacity. I cannot configure the ASA at all, and the AIR-2504/3504 doesn't configure well either.
So, I'll walk you through the "real-world" solution at the end of this, just so you can have an answer to your question.
DMZ Requirement:
I'm going to assume this is a budget-constrained implementation, or at least a low-level implementation, because believe me there is a MUCH deeper dive we can go into with APC, APIC, ISE, DNS, FirePower, ESA, WSA, CSA, and blah, blah, blah. We'll go old-school, 4-tuple firewall without intent-based networking (though, I suppose you could use faux implements of Class-of-Service on the ISR and Zone-based Firewalling, but this is ....meh, in comparison).
With the outline I gave you, you'd have 2 ASA5506. These are routed firewalls, and would require some networking. We'll change that to one ASA5506 (you'd go bigger if this was a larger implementation) and one FP2110 (NGFW). Reason being is this: passthrough connections that filter threats and malware should be placed close to your internal network, and this should filter out anything but database calls to the appropriate servers from the appropriate servers. Simple enough to do with a FP2110, expensive (both monetarily and CPU) with a ASA.
On the ASA you would create another VLAN on a subinterface and route through to the aggregation switch. I would recommend a IGRP on the Aggregation router with authentication, but static works just as well. Create another subinterface on another interface for the wireless controller (next section) and give it a different VLAN. Make sure that routes to the Aggregation switch as well. Secure these in this manner:
Internal networks should communicate with the application server ONLY.
Application servers (the DMZ servers) should communicate back ONLY on web ports.
Application servers should only communicate unsolicited to database or data repositories. I prefer not profiling this, and explicitly defining the rules (severe downside to this is human error... i make a lot of them).
Wireless Controller B (in the DMZ) should only communicate to Wireless Controller A (in Data Center) over UDP ports 16666 and 16667. That is all that is required to anchor (I think... now that one has been a while... double-check that).
Wireless Guest Access Requirement:
Alright, all access points will be manged by Wireless Controller A. You'll need to create a DHCP pool for Wireless management interfaces for the Managed Access Points (don't call them "WAPs"... this means at least 3 other things in networking...). This pool will require a DHCP option that points to the wireless controller's management IP address for association. This is a bit advanced in concept; just know it has to be done and done so in a manner that utilizes Hex formatting of addressing. Then, Wireless Controller B will be configured with a management IP address (should be another network) and that address will be allowed through the firewalls and routed in a way that it can see Wireless Controller A and vice versa. Then the bridge will be configured. This encapsulates all wireless traffic in the anchored bridge to go straight to that device and not anywhere else (secure).
That's all you need!
As a quick note, I totally messed up the DMZ in the diagrams. The internal ASA should not be connected to the switch; only the switch should hook up to the ASA closest to the router only. This will force all traffic going inside to hope through both firewalls, where the perimeter firewall will be "less strict" than the one closest to the internal network. That was just a bad, bad connection I did.
Hope this helps. I'm stepping away for a bit, as I just got a notification that one of my sites is seeing some serious noise that appears to be an attack and I am now "essential" and must travel.... Yay. Good luck with Networking!
