Agree with Jeff Ferland, database servers should be on their own: you should have a clean network for replication & backup.
Pardon my ASCII art, a quick overview of a reasonable ideal:
[lan]--/ \-- [database-zone]
- Run a reverse-proxy, Apache+mod_security/varnish/nginx/WAF/whatever, in the proxy zone. Add load-balancing/failover here if needed too. Also proxy/relay server for outbound connections (DNS, SMTP, HTTP proxy), if required.
- When application logic runs on a web server (Java/PHP/ASP), I prefer to call it an application server.
- When you need to scale you can scale horizontally, load balancers make this easier. You may also consider replicating static unauthenticated content to the front-end proxies.
- you might want to add one or more of zones: IDS, management, backup, remote access, outbound proxy
You're trying mitigate, so:
- inter-zone communication must be limited to the minimum required for service and monitoring purposes.
- reverse-proxy accepts untrusted connections from the internet, can only connect to services on application servers. If you want to classify your zones by traffic you need to consider carefully termination of HTTPs, and if you want to create new HTTPs connections to the app servers.
- application zone accepts semi-trusted connections from proxies, can connect only to databases. You can trust your application servers a little bit more when you know they're not talking directly to the internet.
- database servers accepts connections only from application servers, the database zone should be your "cleanest" network
- consider using different firewalls (vendor/product) for the outer- and inner-firewalls
- for required outbound services (DNS, SMTP or patching/updates) these should go via a distinct server (e.g. on the proxy-zone, or outbound-proxy-zone).
- same goes any outbound CC validation HTTPS connections. (If you're unlucky enough to have some vendor-provided black box for validation, that ought go on a dedicated zone too, IMHO.)
- use public IP addressing only in the proxy zone, private addressing elsewhere. No server outside proxy zone need have a public IP, NAT, or a default route to the internet.
Separate zones makes your IDS's job easier, and logging more effective.
If you have the resources, add a management-zone, separate management NICs for each server (protected ports if you can).
In reality you may end up compacting the "ideal network" to a single firewall and VLANs, but if you consider your options now with the above in mind it should be easier to migrate in future, i.e. shortly after the next visit from your friendly neighborhood PCI-DSS auditor ;-)