Hi,
Since "beer" is in your name I'll answer your question. 
OK, joking aside if you were a bank and you had money to protect, do you want two ways for the thieves to get into the vault or one? Is it easier to worry about protecting one entry point or two?
That is the same with your network. You want a single edge firewall and then eveything sits behind it. Sometimes people put an intermediate area behind the firewall which does not have Active Directory integration and so is somewhat safer to expose to the outside world. This is commonly referred to as a DMZ but other names have emerged for the same thing. With this special zone you then have a secondary firewall which creates the interior edge boundary and you would sit your web server there. In your scenario while you might want this you haven't described this. Furthermore depending on what exactly you are publishing you might feel adequately safe solely behind the ISA 2004 sitting on your SBS 2003 Premium box. If either case you don't need two NIC's on the newly added web server role box.
|