I don't consider it difficult, but it's really an untaught specialty. Becomes more of a network and firewall job every day. Keeping your stuff on a security subnet while setting up access from the outside world or a general subnet is seriously tedious. You have to play nice and be firm with IT entities which would prefer your kinds of issues didn't exist.