Block access between SharePoint Web Front and Servers and Database only allow WFE to Application Server access

Question

I am a developer with limited knowledge of SharePoint Administration. We have a SharePoint 2019 multi-tier farm.

• 1 App with Central Admin
• 1 App with Search
• 1 F5 Firewall between App and Web Servers
• 2 Web Front End Servers (WFE)

Everything was good until we have deployed a new Publishing Portal with Anonymous Access enabled. As we are going public our infra and infosec team raises concern over the Web Front End Servers' access to DB while the public-facing WFE server should have only access to the Application server and the application server should only have the right to communicate with DB, which I think is correct.

However, there is Microsoft documentation that suggests the required architecture but is only applicable to SharePoint 2013 farm. The below image shows that WFE servers have only App Server Access and no direct DB Access to WFE servers.

The image shows that WFE servers have only App Server Access and no direct DB Access to WFE servers.

This link suggested the above image architecture.

Simplifying the issue I have SharePoint 2019 Farm for which I want to block the WFE Server's access to the DB Servers, I want Web Front End Server can only access the SharePoint Application Server and not the DB Serevr. DB Serevr can only be access by Application serevr as suggested in the Image.

how to configure web front end server if we block the Db access, as you can see in below image we have to provide the Database details to configure the Web Front end Servers.

Answer 1

All SharePoint Servers require access to the SQL Servers. All SharePoint Servers communicate directly with the SQL Servers.

The architecture from 2013 applies to 2016, 2019, and SharePoint Subscription Edition.

It is recommended to not place FEs in a DMZ but rather host the entire farm internally, using a reverse proxy in the DMZ to terminate end user traffic. This limits the number of ports (Active Directory, SQL ports, ports between SharePoint Servers) that need to be opened in the back channel firewall.