Microsoft SQL Server: Web Security

[laredo512]

I posted this question in another thread, and I was suggested to post it as a separate thread to get more of an opinion on this:

 

If I were to host a database server for external users in this example:

 

1 - The users use an application that connects to MS SQL for the DB operations the app requires to perform.

2 - The MS SQL server is off site at another office where it also doubles up as a web server.

 

I was thinking of getting a Cisco Firewall unit and hard code their fixed IP to let them through... unless there's a way to have them use a secure channel ?

 

What would be your opinion(s) on this?

 

Nerseus :"I'd mention quickly that Microsoft highly recommends that the SQL Server and Web servers stay separate - and I'd take that advice. SQL takes up a lot of memory, disk and CPU. Webservers are cheap, comparatively, and easier to scale out if needed. You normally only want one SQL Server box - but a big one."

Thanks for any views on the matter