Examining Common Deployment Topologies

Before choosing a specific topology, it is beneficial to understand several deployment topologies commonly used for extranet solutions. A topology provides a detailed view of all the servers, devices, links, and ports in your network, both physical and logical. Understanding and planning an appropriate deployment topology will help you avoid inconsistencies or misconfigurations in your physical and logical network and extranet solution.

Edge Firewall Topology

This topology, illustrated in Figure 13.1, uses an edge firewall solution such as Microsoft Forefront UAG or Forefront TMG or third-party firewall as a gateway between intranet and Internet. This configuration uses the firewall as a reverse proxy server that intercepts requests from the Internet and forwards the request to the appropriate web server located and intranet. Using a set of configurable rules, the proxy server verifies that requested URL and translates it into the internal URL. This topology has the following advantages and disadvantages:

Advantages

• Most economical and simplest solution that requires the least amount of hardware and configuration.

• The entire SharePoint farm resides within the corporate network.

• Simplified server management.

Figure 13.1. Edge firewall topology.

Disadvantages

• A single firewall separates the corporate network from the Internet.

• The corporate network is vulnerable if an external user is compromised.

Back-to-Back Firewall Topology

The back-to-back extranet topology, represented in Figure 13.2, is the recommended network topology for most organizations. In this topology, all the hardware and data resides in the perimeter network. Optionally, the server farm roles and network infrastructure servers such as Active Directory and Exchange Server can be separated across multiple layers with additional routers or firewalls. This is a flexible topology that allows for additional network layers for greater security. External users access the perimeter network through the external proxy server or firewall, and internal users access the perimeter network through an internal proxy server or firewall. This topology has the following advantages and disadvantages:

Advantages

• The corporate network is more secure. If an external user is compromised, only the perimeter network is vulnerable.

• The entire SharePoint farm resides within the perimeter network.

• External user access is isolated to the perimeter network.

• Management of external user accounts is simplified and isolated from the internal identity management system.

Figure 13.2. Back-to-back firewall topology.

Disadvantages

• Additional hardware and resources are required for this configuration.

• The content databases are vulnerable if the perimeter network is compromised.

• Additional overhead is required for managing additional identity management systems.

Split Back-to-Back Firewall Topology

The split back-to-back network topology, shown in Figure 13.3, is similar to the back-to-back topology and further splits the SharePoint farm between the perimeter and corporate networks. The SharePoint web front ends, some application servers, and some infrastructure servers, such as the external identity management system and other resources, reside within the perimeter network. The remaining SharePoint servers and resources, such as the SQL Server databases and other infrastructure servers, reside within the corporate network. This topology has the following advantages and disadvantages:

Advantages

• The corporate network is even more secure. If an external user is compromised, only to perimeter network is vulnerable and fewer resources are vulnerable.

• The content databases are protected even if the perimeter network is compromised.

• External user access is isolated to the perimeter network.

• Management of external user accounts is simplified and isolated from the internal identity management system.

Figure 13.3. Split back-to-back firewall topology.

Disadvantages

• The complexity of the solution is greatly increased.

• Additional hardware and resources are required for this configuration.

• The form is vulnerable if the perimeter network is compromised and the intruders gain access to the farm accounts.

• SharePoint interfarm communication is split between two domains.