Network Warrior

Alternate Designs

The Internet is not always the outside interface of a firewall. Many companies have links to other companies (parent companies, sister companies, partner companies, etc.). In each case, even if the companies are related, separating the main company from the others with a firewall is an excellent best practice to adopt.

Figure 25-4 shows a simplified layout where Your Company's Network is connected to three other external entities. Firewall A is protecting Your Company from the Internet, Firewall B is protecting Your Company from the parent company, and Firewall C is protecting Your Company from the sister company.

Figure 25-4. Multiple firewall example

Each of the firewalls has an inside and an outside interface. While each of the firewalls' inside interfaces are connected to the same network, the outside interfaces are all connected to different networks.

Firewalls are also often used in multitiered architectures like those found in e-commerce web sites. A common practice is to have firewalls not only at the point where the web site connects to the Internet, but between the layers as well. Figure 25-5 shows such a network.

Figure 25-5. E-commerce web site

In a layered design like this, one firewall's inside network is the next firewall's outside network. There are ...