Firewalls and PCI

["Josh Haft" <pacmansyu () gmail com>]

Hello all,

Please consider the following scenario with respect to a) PCI
compliance, b) best practice, and c) your own personal
experiences/implementations.

Have been requested by a client to implement separate, physical
firewalls between our various networks. Currently, we have one
physical firewall with interfaces to a public network (after a quick
pass through a router), a LAN, a DMZ, and another network which houses
our database servers. These are all on separate networks, and run
through separate physical switches.

The client wants another physical firewall between each subnet. The
new configuration as I see it would have the 'main' firewall NAT'ing
and passing traffic from the public network to the DMZ, and to two
additional firewalls. Behind those firewalls would be a LAN and the
separate 'database network', respectively.

In our ever-ending quest to bend over for every client, cost (within
reason) is not an issue, so disregard that aspect. Comments,
questions, and concerns as they relate to this issue would be greatly
appreciated.

Thanks!
Josh