We have remote site office with private link directly into corporate world. This is the primary circuit.

However, now looking to introduce dmvpn to act as back-up only. Although dmvpn is ipsec, the router still has public ip. As such the corporate would be potentially opened behind this router with no fw.

Which design and features would need to be introduced to protect the business to the same level it would normally?, i.e. dual-skinned fw architecture and vpn dmz's

thanks in advance

Ajaz