3 tier architecture, multiple software stacks which should also have some segregation from each other. Data protection is important. In light of the above, what firewall approach would one take?