Recently, I've received a request to change SharePoint architecture to be Three-Tier architecture, as SharePoint by default requires database connection on Front-End server which leads to 2-tier architecture.

Let's assume I have 2 web front end servers, 1 application server, and 1 DB server, and I intend to do the following:

1- Move the SharePoint Configuration DB to another DB server, let's assume the name is DB-Server-A

2- The content DB of the web application will be on a DB server named DB-Server-B

3- The connection between the web front end servers and DB-Server-B will not be opened through any ports due to security policies, instead the connection will be opened between WFEs and DB-Server-A where the configuration DB is located.

My question: If a web application has a content DB on DB-Server-B and there's no connection opened through any ports between the front end and DB-Server-B, will the site keep working without issues? as per my understanding "the web front end server directs any request to the application server, which returns the results to the front-end web server"


Thank you.

1 Answer 1


You cannot restrict ports like that. All SharePoint servers must have access to all SQL Servers that are members of the farm.

  • Thank you Mr. Tervor for your answer, well noted and I'm already aware of the impact once the connection is revoked from any SharePoint server to the DB server, but the organization I'm working for currently want to implement SharePoint to be published only internally and then they will create WCF services or custom APIs to retrieve the data from the internally published site and expose it to the internet. Commented Jul 28, 2019 at 17:47
  • We have two options either we keep the site on the same network without publishing the site externally, and then we will develop a custom WCF service or API to retrieve the data and expose it to the internet (it is a DMS solution basically), or they will publish the front end servers to the internet without opening any ports to connect to DB however the front end servers are already in DMZ?! I know this is crazy, but the organization I'm in is very obsessive with security issues. If you could provide me with any hints I would be very thankful. Commented Jul 28, 2019 at 17:56
  • SharePoint Servers must have a connection to all database servers in use as well as Active Directory domain controller(s). This is non-optional. I generally recommend forgoing placing SharePoint in a DMZ due to the number of ports that have to be opened and instead terminate Internet-based connections at a [pre-authenticating] reverse proxy present in the DMZ. This is generally more secure.
    – user6024
    Commented Jul 28, 2019 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.