# Network architecture and gateway location

**URL:** <https://forum.inductiveautomation.com/t/network-architecture-and-gateway-location/25401>\
**Category:** Ignition\
**Created:** [May 29, 2019, 2:52pm UTC](https://forum.inductiveautomation.com/t/network-architecture-and-gateway-location/25401 "2019-05-29T14:52:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vrautomation](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/vrautomation/32/11155_2.png) [@vrautomation](https://forum.inductiveautomation.com/u/vrautomation)\
**Post date:** [May 29, 2019, 2:52pm UTC](https://forum.inductiveautomation.com/t/network-architecture-and-gateway-location/25401/1 "2019-05-29T14:52:05Z")

</div>

Hi everyone,

We are looking for the possibility to add an Ignition gateway to our architecture. We are actually designing a whole new network architecture.

We will have two separated network:  
1- Control lan  
2- Business lan

The two lan will be connected trought 2 firewall.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/e/e55d941512c3c0a93d23150f34815329d6033001.png)

What is the best pratices considering the gateway will act as historian and the user that will access the historian can be on the business lan (and can ask for big quantities of data).

Should the gateway be installed on the business lan? Or on the control lan?

---

<div class="post-metadata">

**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\
**Post date:** [May 29, 2019, 3:25pm UTC](https://forum.inductiveautomation.com/t/network-architecture-and-gateway-location/25401/2 "2019-05-29T15:25:39Z")

</div>

You’re missing an important section in your Architecture.

There should be a DMZ between the business firewall and the Control Firewall

```auto
Business LAN >>> Business Firewall >>> DMZ >>> Control Firewall >>> Control LAN

```

Servers which require access to both networks should be located inside of the DMZ, this is where your gateway should exist as well as other things like Data Base servers etc.

Edit:  
Also, if you do not feel like opening a hole in the Control Firewall for your control devices then one option is to have a second gateway which exists inside of the Control Network and is a remote tag provider to the Gateway in the DMZ, this way the ACL only need be modified to allow traffic between the two gateways.

---

<div class="post-metadata">

**Author:** ![vrautomation](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/vrautomation/32/11155_2.png) [@vrautomation](https://forum.inductiveautomation.com/u/vrautomation)\
**Post date:** [June 5, 2019, 12:45pm UTC](https://forum.inductiveautomation.com/t/network-architecture-and-gateway-location/25401/3 "2019-06-05T12:45:29Z")

</div>

Thanks for the help.

So if I unbderstand correctly, I need to put the Ignition Gateway and the DB server in the DMZ like this:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/f/fafed9ecd41dfbdfa436e1f02b7d6ae8d08922c8.png)

---

<div class="post-metadata">

**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\
**Post date:** [June 7, 2019, 5:04pm UTC](https://forum.inductiveautomation.com/t/network-architecture-and-gateway-location/25401/4 "2019-06-07T17:04:54Z")

</div>

Yes, that is generally what I would recommend.