Am I on the right track?

themagicone

I am going to install a rack in my new office (long story after reading my last post in job forum). I'll be getting to build the network from the ground up. I don't need nothing special. For servers it's only going to be my exchange/dc and then a storage server. I'm going to get a Cisco router for firewall/router. I want to keep as much security I as I can without increasing the complexity.

Here is my current train of thought:
Internet ---> Router ----> VLAN1 ---> Switch ----> Users
---> Port 1 DC/Exchange
---> Storage Server
----> VLAN2(DMZ) ----> Port 2 DC/Exchange

I would get 2 public IP's, 1 for DMZ exchange server and the other for general web access. No access/routing between VLAN1 and 2. The only thing on Port 2 would be the RAS and the like. VLAN1 would be set up with a firewall and access rules. My only security threat would be someone hacking the exchange server and going through the DC to our private network. I looked into separating the two servers but that is overkill I think.

Any thoughts?