Back-to-Back Firewalls

The ideal approach to any perimeter network or DMZ is to utilize two different security devices such that one provides a layer of defense from the Internet to the perimeter network and the other provides another layer of defense by filtering traffic between the perimeter network and the internal network. The Lync Server Edge Servers are situated between the two firewalls in the perimeter network. This approach is illustrated in Figure 31.3.

Figure 31.3. Back-to-back firewalls.

This configuration is generally considered the most secure because even if an attack compromises the external firewall, the internal firewall still isolates traffic from the attacker. Organizations might even use different firewall vendors for the two firewalls. This ensures that if a security exploit exists for one firewall, it is unlikely the same exploit can be used against the secondary firewall, keeping malicious attacks contained to the perimeter network.

In this configuration, the Edge Server has the external-facing adapter connected to the more external perimeter network and the internal adapter residing in the internal or more trusted perimeter network.