newbie - inline firewall versus router

[Mit1019]

We want to transition our internet server to n-tier architecture something like this:

internet
|
isp router
|
firewall
|
web server in the dmz
|
ROUTER or FIREWALL?
|
db server

The question is what to put between the eb server and the db server where I show ROUTER or FIREWALL?

I believe a router would be more efficient and that an entry-level cisco router would be appropriate. Others on my staff say it should be a firewall. My goal is simply to place the db server on a network segment separate from the web server. As long as we assign the ACLs correctly on the router, I don't see why we need another firewall.

In which case, I have to figure out what cisco router is appropriate, most of the product info appears targeted to implementing routers connected to the internet, all I want is simply to connect 2 network segments.

Any recommendations or observations on this topology?

 

[jimmyzz]

Mit1019,
A Firewall and router can function as the same thing. Afterall, your firewall still needs to route packets, and a router can be configured for security (Access-list or IOS FW). The argument is where to put a purpose-built FW (such as a PIX, Checkpoint etc..) and a pure router for network efficency.

It really should come back to your network design. A basic network design should include a perimeter router/FW which connects to your ISP and a central FW (your purpose-built FW) to protect your internal LAN from the internet and DMZ. Here is a revised topology from you diagram

internet
|
[perimiter router/FW]
|
[centeral firewall] - (DMZ web server)
|
Internal network
(db server)

Your permiter router/FW is your connection to the ISP and can run basic security such as access-list or more advanced security features such as the cisco IOS FW and IDS.

Your centeral FW (purpose-built FW) should have a least three interfaces, 1.Internet, 2.DMZ, 3.Internal LAN.

JimmyZ

 

[Mit1019]

Okay, thanks, I realize now that the web server in the DMZ is already on a separate segment from the internal network/db server, so this accomplishes my primary goal.