Hello Just want to see some thoughts and ideas.  So our network consists on  MX84, 3 MS120-48LP switches and 6 MR36 AP's.   Management prefers to have a daisy-chain type topology where it goes from MX->MS1->MS2->MS3 and of course each switch is connected to a certain amount of nodes each.  His way of thinking is that the MX is not a true router but a firewall so he doesnt want all of the switches connected directly to the MX to route everything including internally.   What I prefer is for each MS to be connected to the MX directly through the front ports.  This way even if the data is only staying internal from node to node, it is being router by the MX where the data can also be protected by AMP and get rids of a single point of failure in a switch.  I am sure the MX84 has enough power to effectively do all the routing for the switches and AP's.  The AP's would be connected to any switch in both scenarios.   It is my understanding that AMP does not work in between switches so if one pc//node got infected with malware or ransomware so if each switch was directly connected to the MX, it can hopefully be stopped at the MX and not spread to the other switches and other network devices.   It is correct that AMP does not work between switches right?  only through the MX right?   There are about a total of 300 PC's, printers and IP phones in this location. If the switches were daisy-chained, you would be wasting the 9 or so MX front ports.   What do you all think so I can try to get him to switch to my way, if it secures the whole network better by AMP.   Thanks @AMP   @Security  @NetDesign    ... View more