I am in the process of separating our current Web/DB server to two servers, both running Windows Server 2008 Core. We have two Cisco ASA firewalls (one 5505, one 5510) to help with this task. My current plan for the network design went something like this:
Internet
|
|
ASA5505
|
5 port Switch — Web Server (attached to switch)
|
|
ASA5510 (external interface attached to above switch) —- DMZ (with DB Server)
|
LAN (internal workstations)
From this point, I would have a pinhole that allows access from the web server to the DB inside the 5510’s DMZ, and a pinhole that would allow port 80,443 through the first ASA (5505) to get to the Web Server. All internal traffic would travel out through both firewalls as well.
The web server runs Apache/PHP on Windows Server Core 2008, and the DB Server runs MySQL on Windows Server Core 2008 (which is just a command line version of windows server).
Another option would be to have a switch connected to the internet, and just have both routers coming from that. Then the ASA5510 could house the Web(on DMZ) and DB on internal port. Then the ASA5505 would be a separate network, and would house the LAN alone.
Which of these options seems like the best solution keeping in mind that our LAN uses the website on the DMZ a lot?
Thank you for any input.