There's recently been some discussion (to be generous) about the pros and cons of having a firewall deployed in front of servers. The con mainly being that it's a point of failure in case of a DDoS. Microsoft has been talking about doing away with the standalone firewall and instead basing security on PKI and IPsec, meaning you can't talk to the server if you don't have an appropriate certificate (no source for this, it was a talk I attended).
So, given a simplistic scenario where you have, say, a web server, a mailserver and a database server backing the webserver, what's the current best practices firewall/network design, according to you? I'm well aware most deployments aren't this straight forward, but I think the example works well enough to base a discussion on.
I'm also aware that the traditional, theoretical best practices would be to add as many layers of defense as possible -- but is this the design that results in the maximum availability, all things considered?
(Assume that the servers are appropriately hardened and don't expose any services they shouldn't be running, that the switches don't add anything to the security equation, and that management is either out-of-band or from the cloud part of the drawing. Which ever you prefer, since it adds it's own complications either way...)
Scenario #1, simple routed
A clear, routed, non-firewalled design. The edge router may apply an ACL, some rate limiting. The DB server might be on private addresses that aren't routable from the internet. The hosts would each be running a firewall, such as Windows built-in or
iptables etc. The admin running the hosts should consider the environment around the hosts hostile.
Scenario #2, traditional firewalled
The router may or may not provide any functionality above simply forwarding packets. The firewall implements the complete policy and segmentation. The hosts may, optionally, have some kind of firewalling, but probably wont. The admin running the hosts will probably consider the environment safe-ish.
Scenario #3, we really like firewalls
As #2, but more segmented.
I've traditionally been building either #2 or #1, and I'm more and more leaning towards #1. I'm probably lured by the "simplicity" of the design and the "purity" of wanting the hosts to be able to survive in a hostile environment. I'm aware this is in contrast to defense in depth. :)