What threats can a firewall between an application server and a database server mitigate that would not otherwise be mitigated when both the database server and application server are behind the same firewall?
closed as too broad by tylerl, Xander, Steve, TildalWave, Adi Feb 28 '14 at 2:08
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
The risk is simple: an attacker that gets control over one of those servers would likely be able to compromise the second server. From database to application or the other way around.
If you setup a firewall device between those two, there are two possibilities:
Network (standard) firewall: you won't be able to do much from that kind of device, apart of limiting connections from application server to the database server (i.e. deny connections from DB to application server).
Web Application Firewall (WAF) or any other layer 7 technology: you would be able to prevent and/or detect attacks from one server to another and to restrict trafic as with the previous solution.
So basically the answer is really that you should be using some firewalling / filtering technology between your application and your database servers. A host-based solution can be considered too, in addition to a network device or as the main solution.