Here's a network diagram to go along with my post to sguil-users. The facts of the diagram are true, only the IP addresses have been removed to protect the innocent. Click the thumbnail for a larger version.