Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like some advice about a network layout for a medium company hosting a website/web service.

Currently I have the following Layout in place...Network Layout

I would like the private area (Green) for databases, and the public area (Blue) for webservers. The IIS servers have two NICS; I would like one to be public another to be local and access the databases when they need information. The Firewall in the Private area is needed for VPN / remote access. Any suggestions would be greatly appreciated.

The Switches are Dell Powerconnect 5424 (Private), and Dell Powerconnect 2848 (Public), and the Firewall outside the network is a Juniper. Firewall inside the network for VPN is Watchdog.

share|improve this question

closed as not constructive by mailq, Ward, John Gardeniers, Shane Madden, Scott Pack Sep 24 '11 at 17:38

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 1 down vote accepted

If the webservers are on the same LAN as the database servers, then you don't have much of a private and public separation. It would be more common to have a firewall between the two and to only allow database ports and remote access ports through the firewall (and whatever you need to keep your domain working).

The point would be if someone compromises your webservers, they have little access to your database servers. With your diagram, if someone compromises a webserver, they have full access to the database servers through the second NIC.

I would look at having the Juniper firewall between the two networks using VLANs, or move the Watchdog to sit between the two networks, if it's up to the task.

share|improve this answer
I would say some kind of firewall with DMZ setup. It does not depend on the type of firewall. – Squidly Sep 24 '11 at 5:29
I say the above, but really I'm not so sure a DMZ does all that much for security. A bigger problem is people attacking the webserver with, e.g. SQL Injection, and getting the webserver to legitimately read too much information from the database. You may as well put them all in the same LAN for something of this scale if it makes it easier to patch the servers, and focus most of your effort on securing the website code and putting monitoring / alerting software in place. – TessellatingHeckler Sep 24 '11 at 14:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.