Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am wondering how many of you who work for LARGE companies have a network architecture that enforces the use of three-separate firewalls to get at the data. In other words:

  • Separation of external (internet) parties and a presentation tier by a firewall
  • Separation of presentation and application tier by a firewall
  • Separation of application and data tier by a firewall

In short: Public->Presentation->Application->Data (where each arrow is a firewall)

Here is my problem: I work for a very large US company (75K+ employees) where each environment seems to have a different number of segmentation firewalls. We wanted to standardize our firewall architecture, but:

  1. We can't find any real material to justify the need for three firewalls (as opposed to, say, just a single perimeter firewall)
  2. We can't qualify the value-add of three layers of firewalls.
  3. We can't sort out if this should be an architecture for just internet facing apps, or for ALL applications/appliances/gear.

Any advice?

share|improve this question

It depends on what sort of services you're offering outside of your network as well as how much security you need in front of key services. If you've got an e-commerce site that ties into a database backend and handles credit cards, I could easily see three levels of firewalls being required (to meet PCI requirements if nothing else). However, if you're offering simple static content via locked down web servers, it could be as simple as a single set of firewalls that have an outside, inside, and dmz interface.

Perhaps some more details on your setup? has some excellent documents explaining defense-in-depth.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.