We have an ASP.NET Web API server that serves up a SQL Server data driven website. The API uses JSON to transfer data from SQL Server to the front end.
We need to move it to an internal production environment (nothing will be exposed on the public Internet) and we’re having problems - or just not understanding what needs to be done.
There are two domains:
- The corporate domain - where all users login normally.
- The process domain - contains the database the Web API needs to access.
The IT staff wants to put a DMZ between the two domains to house the IIS app and shield the users on the corporate domain from having access into the process domain directly.
The ideal configuration is:
corp domain (end users) <–> firewall (open port 80) <–> DMZ (web server running IIS) <–> firewall (open port 80 or 1433????) <–> process domain (IIS for Web API and SQL Server)
We don’t really understand how to deploy our browser/Web API application in this scenario.
- Do we need to break up our application so that all the client code is on the IIS server in the DMZ, while the Web API gets installed on the server in the process domain?
- Does the entire app (client code and Web API) stay together on the IIS server in the DMZ, which then somehow accesses the SQL Server instance to get data?
- From the IIS server and app in the DMZ, would you simply access the Web API on the server in the process domain by going to
- In the second firewall between the DMZ and the process domain, would you have to open port 1433 or just port 80 since the Web API is a HTTP endpoint?
NB: The servers are Win2k8 R2, SQL Server 2k8 R2, and IIS 7.5.