design help

[simsim]

Hi all ,

I have the above topology , Now the question where should iI keep the dmz zone 

on edge firewall or dc firewall 

Thanks 

[reaper]

ideally on a separate switch environment connected to the edge

if that's not possible, on it's own VLAN on the core, connected via trunk on a subinterface on the edge

those would be my preferences 🙂