Companies with this configuration rely on firewalls to protect their servers but never account for the fact that the servers must be able to protect themselves from attack. This month I'll outline some of the feature sets that should be a part of each component you select. ACLs are rulesets that, when applied to a network interface, control the type of traffic that can pass beyond the router to machines on the other side. For instance, email typically is sent on network port 25. ACLs for the router that protects the external mail gateway will admit network port 25 traffic from all external machines, so that machines on the Internet can connect to your external mail gateway.
Vendors often provide firewall features with routers.
Once traffic gets on the internal network segment, switches and computers must offer increasing levels of protection. The first stage, provided by the switching infrastructure, helps confine attacks to a few servers. This is because switches limit traffic to groups of servers as I discussed in last month's column. If you were using hubs for your design instead of switches, all machines would receive the sudden rush of traffic. As the last line of defense, the server must be configured to protect itself.