Setting up SonicWALL TZ400 DMZ and how to split up network into segments?
I've attached a diagram showing what I want to accomplish and I'm looking for suggestions. I currently have a network that I've been put in charge of. Currently everything in the facility other than the guest network runs off the same subnet and passes through the firewall. The problem is I have 1 switch, 4 computers, and some proprietary hardware that are for use in a radio system. The computers within that realm do not have antivirus on them and according to the vendor the antivirus software needs to stay off of them so I need to segment those devices away from everything else.
I've got my main corporate network with around 20 workstations all with antivirus protection.
The guest network which has Wi-Fi devices, employee cell phones, misc., nothing protected.
A secure network that houses system with PPI and governmental data.
I also have a CCTV network that is completely offline because the servers are running legacy software.
My issue is, I have copiers and printers that need to be accessible by everyone. I also have an access control system that needs to be accessible to everyone except people on the guest network. The diagram attached shows that my main connection from my ISP comes into my SonicWALL. From there I assume I need to split off into a DMZ, and guest network, and my corporate network. The devices at the top that are connected to a ASA Gateway will pass information to another agency and those devices need to be able to printer to the DMZ, but I don't want any other network traffic to comingle with the ASA Traffic. The radio Network needs to access the access control system, but nothing else.
I guess my question is, what would be the best approach to segment these devices? Do they all need to be setup on their own subnet or VLAN? If I setup subnets for all the different areas i.e.,
Corporate Net 192.168.1.1
Guest Network 192.168.2.1
Radio Network 192.168.3.1
how would they connect to the DMZ? Does the DMZ have to have it's own router on a different subnet or can it have a switch on the same subnet, or what?