Cisco IDS, PIX, VPN Concentrator, RADUIS, CSA locations

[zillah2004]

The current design for my work design is that VPN concentrator (we have got only one) is behind PIX firewall (we have got 2 one is for failover), and IDS within DMZ zone (we have got one).

Radius Server on my local network , and Cisce security Agent on my local network as well.

I have been asked to rebuild the security system as best practice.

Any insight about the above design ?

[tsteger1]

We have CSA (and AV) in the DMZ so mobile clients can communicate all the time.

[zillah2004]

Thanks for this input.