[Freeipa-users] where to place the freeipa server in a segmented network

Hello, I have network consisting out a LAN,WLAN,DMZ and a PRODUCTION network, separated by a firewall that performs the routing and connections to the outside world. I want to introduce Identity management using a FreeIPA server for my network. Most client machines will be on the LAN network, but not all. Most servers reside on the PRODUCTION network I am trying to figure out where to place the FeeIPA server in this network. I want to be able to authenticate all servers,client machines and also be able to authenticate client machines that are connected via a VPN connection that is hosted on the firewall. Sorry for having to ask this. I have been looking around on the net and this list but found little help on this topic. Any advice would be welcome. Kind regards, Rob.