We have a tire III data center to let users to access resources through private network MPLS. we applied security solution in each layer. But I am not quite sure to use internal SSL for applications or devices that can be accessed via http(web) within the private network perimeter(not to access via internet out side the network). if not How can I ensure communication between two hosts is secured or encrypted? how can I protect internal intruder(hacker) apart from applying polices in our private network?
Generally yes, you want to encrypt/secure the connection of your internal machines. They are not reachable from the internet, but insider threats are real.
Assume one machine of yours has been taken over. An vulnerable webservice, for example. This machine is no longer trustworthy, but can still see and access your internal machines. Here is your insider threat without somebody physically breaking into your data centre or plugging their laptop in your server.
Which kind of security should be applied depends on your use case and what exactly you are trying to protect. To prevent MitM, TLS/SSL is generally a good point to start.