The position of both public and private interfaces is debatable. I have implimented a number for different customers and installed both with the outside interface directly on the outside of the firewall and in a DMZ, also with the inside interface on the inside of the network or in a dmz. This has mainly been dependent on the customers attitude to security and a number of other things such as possible loading on the firewall or large number of rule changes needed.
As the concentrator outside interface is hardened there is not a problem placing it on the outside of the firewall. Like wise as you can control policy to a degree on the concentrator, placing the inside interface directly on the inside of the network shouldnt be a problem either (unless you possibly want to restrict access based on differing IP pools.
So in short there is no right or wrong way, I wasnt sure from your initial question if it was your inside or outside interface of the concentrator that you was placing in the firewall dmz.
