DMZ architecture

The devices in your network are not always connected through a VPN. In that case, one or more DMZ relay(s) are required. 

As per the VPN, it is very important to size the DMZ relay(s) properly. It might be relevant to set several DMZ, by location for example, in order to avoid having more that 2000 (Windows) or 5000 (Linux) children to the DMZ relay.  

If the devices are connected through a WAN, they cannot use the relay list or the DHCP mechanisms to select their relay. In this scenario, it is necessary to set the DMZ relay as a static or as a backup relay in the devices relay module settings. For more information relay module settings parameteres, see Setting the Relay module parameters.