2 cissp ® Official Study Guide Eighth Edition

Firewall Deployment Architectures 
There are three commonly recognized fi rewall deployment architectures: single tier, two 
tier, and three tier (also known as multitier). 
As you can see in Figure 11.8 , a single-tier deployment places the private network 
behind a fi rewall, which is then connected through a router to the internet (or some other 
untrusted network). Single-tier deployments are useful against generic attacks only. This 
architecture offers only minimal protection. 
A two-tier deployment architecture may be one of two different designs. One uses a 
fi rewall with three or more interfaces. The other uses two fi rewalls in a series. This allows 
for a DMZ or a publicly accessible extranet. In the fi rst design, the DMZ is located off one 
of the interfaces of the primary fi rewall, while in the second design the DMZ is located 
between the two serial fi rewalls. The DMZ is used to host information server systems to 
which external users should have access. The fi rewall routes traffi c to the DMZ or the 
trusted network according to its strict fi ltering rules. This architecture introduces a moder-
ate level of routing and fi ltering complexity. 

---

Secure Network Components 
491
F I g u r e 11. 8
Single-, two-, and three-tier firewall deployment architectures
Internet
Router
Firewall
Router
Firewall
Private Network
Single-tier
Internet
Private Network
Two-tier I
DMZ
Router
Firewall
Firewall
Internet
Private Network
Three-tier II
DMZ
Router
Firewall
Firewall
Internet
Two-tier II
DMZ
Private
Network
Router
Firewall
Firewall
Firewall
Internet
Three-tier I
DMZ
Transaction
Subnet
Transaction
Subnet
Private
Network
A three-tier deployment architecture is the deployment of multiple subnets between the 
private network and the internet separated by firewalls. Each subsequent firewall has more 
stringent filtering rules to restrict traffic to only trusted sources. The outermost subnet is 
usually a DMZ. A middle subnet can serve as a transaction subnet where systems needed to 
support complex web applications in the DMZ reside. The third, or back-end, subnet can 
support the private network. This architecture is the most secure of these options; however, 
it is also the most complex to design, implement, and manage.