08-11-2020 02:01 AM
Hello,
Currently, every server is behind trust zone, so I can't control traffic from trust user or server to server by FW.
I have two options
1 attach server farm switch to edge firewall
2 deploy new FW in front of server farm switch
Which is more common way and is there any better reason to chose 2nd option than 1st?
08-11-2020 11:16 AM
Hi @yhlee1
Both of these ways are common solutions. In short: Option 2 is more secure but also more expensive while (obviously) option one is the opposite.
This does not mean option 1 is bad, but in case of an attack from external and also in situations where the firewall may be too slow to handle every internal connection everything would be affected from an outage. So with option 2 you mainly distribute the load with reduces some risks about service continuity. Obviously buying a second firewall(cluster) with subscriptions and operating this one is more expensive than having only one firewall(cluster). The configuration itself you can have as secure as with two firewall(clusters). So mainly you have to decide for your company/your situation if the additional costs are worth reducing some risks or if you are ok with the disadvantages as long as you separate clients and servers.
08-11-2020 11:16 AM
Hi @yhlee1
Both of these ways are common solutions. In short: Option 2 is more secure but also more expensive while (obviously) option one is the opposite.
This does not mean option 1 is bad, but in case of an attack from external and also in situations where the firewall may be too slow to handle every internal connection everything would be affected from an outage. So with option 2 you mainly distribute the load with reduces some risks about service continuity. Obviously buying a second firewall(cluster) with subscriptions and operating this one is more expensive than having only one firewall(cluster). The configuration itself you can have as secure as with two firewall(clusters). So mainly you have to decide for your company/your situation if the additional costs are worth reducing some risks or if you are ok with the disadvantages as long as you separate clients and servers.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
