Good day. I am the IT Manager at work and we are looking to enhance the security of our infrastructure given the sensitive nature of the data we house.

We have a small environment consisting of a few host servers running VMWARE, a dedicated physical backup server, and an enterprise HP SAN, all sitting at a Datacenter.

The consultant we hired as our software developer has been insisting that we need multiple physical firewalls for separation of our environment (proxy accessible to the public, Web app layer, data layer, and development layer (restricted to the other 3 layers)).

I am no network architect but I find it hard to believe that in an era of virtulization we still need physical separation.

As an organization, we need to meet FIPS 140-2 and NIST compliance on our entire architecture and have a small team/budget to make all this happen.

My question is, are 4 physical firewalls needed to provide the security or can this be done virtually in our environment?

One more thing, Cloud services are not an option for us for contractual reasons.

  • vague question; "needed", "the security", etc. there's many topologies and strategies with unique ups and downs. if you're unsure, you'll have to trust the people you choose to do it for you. 4 firewalls are not a huge investment, so long as they don't slow down operations. both virtual hosts and physical boxes have been exploited, but physical is probably more trusted by many, including your dev. if he knows how to make it safe that way, it's probably going to be safer than having him setup something unfamiliar.
    – dandavis
    Jan 3, 2017 at 7:23

1 Answer 1


You do indeed need physical separation but in a small network that doesn't necessarily mean 4 separate firewalls. However, if you don't do that, you will be adding to the risk.

It is up to you and your organisation and maybe whatever external auditors you use to agree what level of risk is acceptable.

There are many firewall devices that have more than 2 network interfaces and any decent make will allow you to configure different security settings between different pairs of interface.

For example, even the router I use at home - a Ubuquiti EdgeRouter Lite - has 3 interfaces and a firewall configuration tool that lets me have different settings between either of the two internal and 1 external interfaces.

The risk, however, is that a compromise either of the firewall (at OS or firewall application layers) or a compromise of a user account on the firewall would allow reconfiguration of all interfaces with no further protection.

As you can probably see, a 4 device solution would only actually be much more secure if:

  1. They all use different admin accounts
  2. They are multiple device types - because if they are all the same, they are also likely to have the same software level and therefore the same vulnerabilities.

You can further mitigate the risks of either solution type by ensuring that logs are actively passed through to a SIEM which alerts on any changes and if data stops coming through. That could be as simple as a centralised syslog server - though that requires some expert eyes to be regularly reviewing the logs. Better is a proper SIEM solution that presents a single dashboard for all threats.

The bottom line is that what is key here is not so much the physical architecture but rather the concept of data/system segregation. Also points removed from your consultant if they didn't recommend centralised reporting and audit.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .