Physical Security
The devices are highlighted in red and placed in a green box represent the DMZ which is needed to establish secure email and web ingress traffic. The green box around the red devices represents the physical security of the devices in the DMZ. The devices that are highlighted blue and placed in the yellow box represents the devices on the network that controls egress traffic. The yellow box represent the physical security for those devices.
Filtering Schema
The Ingress traffic will flow through the router where its filter through the firewall then Proxy Server. After its filter by the Proxy Server it will flow to the Web and Email Servers where it makes contact with the switch-first network device. Anti-virus, malware, and intrusion detection software will be implemented to discover any harmful traffic that may have been missed by the firewall or was a product of an end-user inadvertently downloading malicious malware onto the network. It’s critical to close all unused ports on the network to reduce the risk of attack. There will be a policy in place that updates patches for all VPN and remote-access end-users to ensure that the devices security corresponds with the rest of the network. A layered approach would be to also implement account threshold, attempts, and reset authentication policies.

The Diagram below is an example of what devices would be in a DMZ and the position that the Ingress traffic would flow to in order to maintain security