# Using engines to separate internal and external networks

The most common and most important use for a engine is to separate internal networks from the public Internet.

Table 1. External network considerations for engines
| Description | Implications on Engines
--- | --- | ---
Main purpose | Connectivity between the protected and public networks. | The Engine selects which traffic is permitted into and out of the internal networks and translates addresses between internal IP addresses and public IP addresses. The Engine is typically also a VPN endpoint.
Hosts | Only equipment directly connected to the public network, such as routers and the Engine. | The communicating hosts in external networks are unknown in many cases. IP address spoofing is a possibility. External hosts can be trusted if they are identified using VPN authentication mechanisms.
Users | Access to this network is open, but local access to the hosts is restricted to the administrative staff only. | Internal users are known and trusted. Users in public networks are unknown and untrusted. VPN authentication and encryption can be used to allow specific users access from external networks to internal resources.
Traffic volume | Varies from low to high, generally the full bandwidth of all Internet links combined. | Hardware requirements vary depending on the environment. Clustering allows flexible engine throughput adjustments. Multi-Link allows high availability and load balancing for outbound connections. QoS Policies can control the bandwidth use.
Traffic type | Any type of traffic can be encountered, especially in incoming traffic. Some filtering is done by the Internet service provider. | The Engine controls which traffic is allowed into your networks. It is beyond the Engine’s control what and how much traffic it receives from the public networks. Advanced inspection checks can be activated on the Engine and traffic can be redirected to a proxy service, depending on the protocol.
Network security | Little or no access controls to pre-filter traffic arriving from the Internet. Ensure that the hosts in this network are security-hardened and actively patched against known vulnerabilities. | Ensure the Engine’s policy is as restrictive as possible. Generally, new connections are not allowed from the external to the internal networks (servers for external services are placed in DMZs). After use, disable SSH access to the Engine’s command line from external networks.