In designing a campus network how would you distribute your firewalls
I have designed a university network with 2 campuses. They use a leased line to link the two campuses. There is a firewall on the internet edge as well as a firewall on each of the WAN edges. Each of the network edges have redundant switches and thus redundant firewalls. There are several firewalls protecting our sensitive data. Most questionably there is a firewall in every building.
I thought that this might be excessive. Is it important to have a firewall in each building as someone could gain network access from within a building?
As I understand it, the firewall in each building will not prevent someone from messing with another computer in the same building. But it would however prevent them send spurious traffic into our network core.
I don't think there is any argument around the need for firewalls on the internet edge or our sensitive data, but do I need one in each building and on the WAN edges?