Design Question Pix, Web and SQL back end

[bbcornwall]

I am looking at the design for a web site.

Currently I am looking at a pair of perimeter routers, connecting through a pair of 2950's to a Failover pair of Pix's. These connect via a pair of 2950's on the internal network to a tollerant CSS11506 content switch. The Web servers are Multi Honed into the CSS11506.

I then need to connect a back end SQL cluster that handles the content into the network.

Am I better connecting this through it's own firewall or through a DMZ on the Internet PIX. If it goes through it's own firewall I will use a failover pair of Pix 525.

Any assistance will be appreciated.

[mhussein]

Many designs out there recommend connecting sql backends through a seperate dmz. Here is an excellent document from Cisco: "SAFE: A Security Blueprint for Enterprise Networks"

http://www.cisco.com/en/US/netsol/ns110/ns129/ns131/ns128/networking_solutions_implementation_white_paper09186a008009c8b6.shtml

hth,

regards,

Mustafa