Based on network design model proposed by Cisco, the firewall is for traffic to/from internet and there is no dedicated firewall for traffic to/from intranet. Is firewall on distribution switch is great enough e.g. Cisco catalyst 3560 switch?
Based on figure below. Assume that the in-switch firewall of 3560 is not enough. Let's say there is no VLAN and there are 2 departments, finance and marketing, separated by their access switch on the same distribution switch. Both departments contain sensitive information both in user computers and servers. However, users from both department have to communicate with each other.
Allowing users to communicate with each other in different department has opened attacking opportunity. For example, users in finance department can send malicious program to users in marketing department and vice versa if they communicate with each other by using chat program, for example Skype.
Where should a dedicated firewall to be placed if traffic between these two departments has to be inspected?
Update 1: Added picture and details.