This question already has an answer here:
My gut instinct is that best practice would be to ensure that all internal servers communicate over HTTPS and that all servers are authenticated to each other.
That would indeed be dream case scenario.
However, I'm trying to consider if it is ever acceptable for an internal server to communicate, via HTTP, to another internal server without needing to authenticate to that server.
The risk is surely that someone malicious in the network could reek havoc by not only being able to read all traffic between those servers but by replacing the receiving server with one that is under their control.
Any comment on this would be greatly appreciated.