One of my clients asked me to check his network. In his server rack I found a Fortinet FortiGate 60 and a Zyxel Zywall 70. Both of them are - in my opinion - complete firewall solutions for SOHOs (which he is with 1 server and about 10 clients).

Since I'm not a network expert, I don't know if this setup can be useful or if it is just redundant.


With an single external connection such a configuration would be highly unusual.

Reasons I can think that why a second firewall could be used for a small group.

  1. For access into an intranet or extranet
  2. For business unit separation - i.e. finance cannot access auditing, possibly for legal reasons
  3. If there is remote access (VPN or dial-up modem) that is configured on the non-front facing firewall device. - Not sure this is necessary for such an environment, but possible
  4. External contractors boosting profit from overselling network appliances.
  5. The second firewall is used for offering extranet access to business partners. I doubt this small a setup is offering extranet access.

Good luck

  • Reason 4 is the most plausible, I think. All the other setups like remote access etc. can be handled by one firewall. – dwo Feb 10 '10 at 18:31

Two firewalls filtering the same LAN would sound wrong if they were back to back with no other network.

You need to check these firewalls and make a map of the network in order to be able to decide. Only this will give you the information you're looking for.


Only useful if they're run by different groups.

The only situation you'd run into such a setting is if you're at a big organization such as a large financial or government organization.

  • Just a quick note. With the virtual domains on the Fortigate there's no need for multiple firewalls even in the case of being run by different groups. But there may be other driving factors that require more than one unit. – 3dinfluence Feb 10 '10 at 15:42
  • They're different groups that don't trust each-other, not that have different administrative duties... – chris Feb 10 '10 at 16:37
  • Yes I understood that and Fortigate's support this. Controlling the administrative duties between admins/users within each virtual domain is also possible but is a different layer of access control. – 3dinfluence Feb 10 '10 at 21:47

Could it be that they are running as an Inner and Outer firewall... and then there could be a LAN switch inbetween running a DMZ.

Not how I'd design it nowadays, but some customers insist of two layers of firewalls from different vendors on the Inside/Outside of DMZ.


It's possible that multiple firewall devices could have their LAN sides facing together (i.e. inwards), to provide high isolation for a secure inner LAN core. With one of them providing conventional WAN protection via NAT, the other(s) secure outbound access from LAN-side systems, on a per-port, per-device, or ad-hoc "VLAN" basis.

Because each inside device now sees the 'hard' side of a firewall, this can help prevent the likely and instantaneous cross-contamination of the whole LAN in the case where a LAN connected device is/becomes compromised.

When implemented with inexpensive commodity routers, this arrangement is essentially a cost-effective way to deploy a version of the port security feature only found in high end (i.e. Cisco) routers bearing 5-figure price tags. At one router per port though, costs add up quickly, so this only makes sense for small SOHO or high-end home networks.

Outbound firewall protection is increasingly important these days due to BYOD scenarios as well as a rise in router-targetting malware attacks. Router configuration attacks especially can be radically reduced in the setup described above, by setting the router configuration interfaces to be inaccessible from "outside" their respective firewalls--i.e. not available to the port-connected device.

Without going too far afield, even beyond BYOD, outbound port control is ever more crucial as trust in device-bound software firewalling erodes. Misconfiguration, UPnP port-opening, obfuscating complexity in the firewall UI, "default-allow" outbound policies, silent reconfiguration by installer software, and end-user meddling are long-standing concerns. But now these are compounded, in the latest versions of some operating systems, by hidden ipv6 auto-tunnels (used for telemetry, advertising and marketing functions that sometimes can't be disabled) and/or flagrant OS-privileged firewall bypass modes. Of course software firewalls, being commingled with the device they are supposed to protect, offer dubious security at best, but these new considerations seem to now suggest they're fully pointless. Facing each LAN device to an outwards-facing hardware firewall renders device-bound firewalls and their myriad problems moot.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.