Questions about deploying serverfarm FW

Reply
Highlighted
L2 Linker

Questions about deploying serverfarm FW

Hello,

Currently, every server is behind trust zone, so I can't control traffic from trust user or server to server by FW.

 

I have two options

 1 attach server farm switch to edge firewall

 2 deploy new FW in front of server farm switch

 

Which is more common way and is there any better reason to chose 2nd option than 1st?

 

 


Accepted Solutions
Highlighted
Cyber Elite

Hi @yhlee1 

Both of these ways are common solutions. In short: Option 2 is more secure but also more expensive while (obviously) option one is the opposite.

This does not mean option 1 is bad, but in case of an attack from external and also in situations where the firewall may be too slow to handle every internal connection everything would be affected from an outage. So with option 2 you mainly distribute the load with reduces some risks about service continuity. Obviously buying a second firewall(cluster) with subscriptions and operating this one is more expensive than having only one firewall(cluster). The configuration itself you can have as secure as with two firewall(clusters). So mainly you have to decide for your company/your situation if the additional costs are worth reducing some risks or if you are ok with the disadvantages as long as you separate clients and servers.

View solution in original post


All Replies
Highlighted
Cyber Elite

Hi @yhlee1 

Both of these ways are common solutions. In short: Option 2 is more secure but also more expensive while (obviously) option one is the opposite.

This does not mean option 1 is bad, but in case of an attack from external and also in situations where the firewall may be too slow to handle every internal connection everything would be affected from an outage. So with option 2 you mainly distribute the load with reduces some risks about service continuity. Obviously buying a second firewall(cluster) with subscriptions and operating this one is more expensive than having only one firewall(cluster). The configuration itself you can have as secure as with two firewall(clusters). So mainly you have to decide for your company/your situation if the additional costs are worth reducing some risks or if you are ok with the disadvantages as long as you separate clients and servers.

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!