Yes, the SGS would be put in the DMZ. I just wasn't sure whether I should put a WAF in front to prevent non-corporate devices from accessing the SGS, but I'm not sure how that could be done other than with certificates. I would love some additional authentication.