Which is best recommended approach for SharePoint 2013 Extranet setup, the reverse proxy option or using separate DMZ?

Question

We are planning to set up a SharePoint 2013 extranet. I have gone through many helpful blogs on extranet setup and found that there are 2 options to achieve this in secure way.

1) Use Reverse proxy

2) Place servers in Separate DMZ servers

Can someone help me to understand which is best recommended approach for SharePoint 2013 Extranet setup, the reverse proxy option or using separate DMZ?

Answer 1

The most common approach I've seen is the reverse proxy one. It has the following advantages over the "SharePoint servers in a DMZ":

• Internal users can access the portal from inside the organization, leveraging Windows SSO for authentication.
• You don't have to create a dedicated Active Directory where you'd need to duplicate users accounts. With the DMZ approach, you'd have to, or you'd have to allow SP servers to communicate with the internal AD server.
• You only have one end point (the reverse proxy) to secure, and you can use it for load-balancing as well.
• Most of the time, a reverse-proxy is already in use in the organization.
• The reverse-proxy can handle the SSL part of the communication, and transfer requests to SharePoint as HTTP: this removes the need to install/maintain the certificate on all SP servers + removes load from the SP server.
• Additional configuration can be made at the reverse-proxy level, such as IP/time/... restrictions.
• Some reverse-proxy servers (such as TMG) can handle the authentication in a Form-based way, and transfer credentials to SP as NTLM. This removes the need to configure a FBA mode at the SharePoint level (this can be a bit tricky).