Two levels of firewalls

Hello all:

I need your advice about a firewall configuration with two levels of them.

In our organization we have a first level of FWs, fortigate 800,  that
mainly are working such IPS (it is configurated is stealth mode, like a
bridge).
In the second one, there is a FW1 separating the differents DMZ zones. There
are 3 DMZ behind the FW1 which manage the traffic between them and with the
outside (Internet). Also the FW1 does NAT.

There is one DMZ zone with a very high (1) level of security, and other one
with a medium level (2) of security and the third is a public DMZ with all
the public services like WEB servers.

                       OUTSIDE
                             |
                         fortigate     (IPS in stealth mode)
                             |
PUBLIC DMZ  ..... FW1-----DMZ (2)
                             |
                              ..DMZ(1)


I would like to know if it is a good configuration to move the DMZ Public to
a fortigate Interface,  and to make the NAT in the first FW fortigate for
the hosts in public DMZ. So the configuration will be:


OUTSIDE
    |
    fortigat -----Public DMZ
    |
    FW1-----DMZ (2)
    |
    ...DMZ(1)


Which topology will you do with two levels of firewalls?


Thanks in advance.






--
Angel Alonso Párrizas
parrizas@gmail.com

CCNA, SSP-MPA

___________________________________
"La libertad no es algo negociable"