The Practice of Network Security: Deployment Strategies for Production Environments

11.2. Multiple DMZ Design

The multiple firewall design can be extended even further, creating multiple DMZs to protect corporate data. A multiple DMZ design allows administrators to further isolate public servers by placing each server inside a separate DMZ. Many security experts argue that a multiple DMZ design provides very few benefits, ^[1] and the added capital expenditure combined with the increased network complexity negate any benefits that are gained.

^[1] Except to firewall manufacturers

There are two types of multiple DMZ designs that are generally implemented:

1. One which adds more layers to the current design.

2. One which isolates each of the public servers into their own DMZ.

The first, an extension of Figure 11.4, simply adds more layers ...