[kerbros]

I've got a network segment that that needs to be firewalled off from the rest of the network. What’s the best way to complete this task?
I'd like to do it using these requirements:
-Use an edge [edge W series, unlimited]
-without NAT [I can be swayed on this if necessary]
-Keep the same IP scheme [class C private IP space]

For extra bonus points would this setup be served by being centrally managed or stand-alone?

I'm looking at either segmenting off the network via the DMZ functionality or doing something in regard to the built-in Vlan capability on the edge.

Thoughts?