Protecting Exposed Applications

I would assume today that everyone who manages networks uses a firewall of somesort to protect web, mail and other servers that are exposed to the Internet – the DMZ model.

The discussion here is for multi-tier services or applications that utilize web, application, and database servers.

I am looking for your thoughts on securing all of theses layers with a firewall, requiring speciffic permit rules for each layer to communicate to the other.

web server –> firewall –> app server –> firewall –> db server

Looking forward to the discussion.