This message was deleted.

I always advocate strongly for the most secure option, such as using DMZs or isolation such as micro-segmentation. That said it is ultimately the customer decision but I will advise them of the ramifications of their choices and the documentation reflects that decision and recommendation.

In all my years of doing ADC, i have never done a gateway implementation that wasn't in the DMZ.

A gateway should always be placed in DMZ, that’s the idea of a gateway imho

Absolutely DMZ!!! Never done anything else!

Agreed. And generally two-armed deployment with both interfaces in DMZ? Single-arm?

I never ever "bypass" the firewall if it's my choice, so almost always in single-arm mode, even if i know how to do 2-armed (or 3-armed with mgmt in mgmt vlan proper) I've seen to many implementations where some cowboy consultant did an implementation where they bypasses by firewall, because they had zero clue on how route/traffic flows in the ADC. Now there are cases where a company might now be able to afford 2 HA pairs (one for external and one for internal) and their firewall can't handle the load if it has to traverse the firewall twice. p.s if you place mgmt in a mgmt vlan, make sure that it's not able to reach anything not needed (And no, it doesn't need internet access)

I hate 2 arm.. i'm a 1-arm DMZ person, myself... It's all about your environment though. I'm also in control of the firewalls, so I'm able to make all the changes I need. Some environments that's a different team, and working with that team could be difficult. But, IMO, DMZ using firewall is the most secure for sure. 2 arm, both in dmz, i might be able to be convinced. 🙂

Sounds like a couple of one-armed banditos in the DMZ are the way forward. My team and I look after the FWs too so we won't have to contend with those politics 🙂 Thanks guys.

DMZ in one armed

one arm in the DMZ. let the firewall do its job. If you're pushing enough traffic for multi-arm to make sense then generally you're in the middle of a firewall sandwich anyway.

Or those things mentioned above going via a Proxy

Same Dmz

I was told that we can’t do a one arm since some servers require a direct server return. Not sure how accurate that is

Thanks everyone. Gonna start testing :)