Skip to tutorial content
Rate module Not yet rated

Where to Place MID Servers in the Client Network

4 min read
On this page

In this lesson, you will learn:

  • The rules for MID Server placement
  • Why not put a MID in every zone
  • How SNWR placed its MID Servers

🔁 Quick look back: Last time: Validating the MID Server. You learned how validation proves a MID Server is ready.

1 The Problem: A MID Server in the Wrong Place Scans Slowly or Not at All

If a MID Server sits far from its targets:

  • Scans cross slow links.
  • Each firewall in between needs rules.
  • Some zones may be unreachable.

🎯 The problem: A MID Server in the wrong place scans slowly, or not at all.

👉 The fix: Place MID Servers close to what they scan, with few firewalls in between.

Table of zones and MID coverage.
Figure 1. Where SNWR placed its MID Servers.

2 Placement rules

  • Put the MID Server in or near the zone it scans.
  • Avoid scanning across slow WAN links.
  • Keep MID Servers out of the DMZ unless there’s no other way.
  • Add a second MID Server where you need failover.

3 How many?

Enough to reach every zone, handle the load, and survive one failure where it matters. More MID Servers mean more to patch and watch.

💡 Good to know: Start with fewer MID Servers and add more if scans are slow or zones are unreachable.

4 Project Clear View: How We Implemented It

📍 Situation: DD-D01 said where MID Servers go. Now they’re being installed.

🧭 Decision: Install each MID Server in its planned zone, and check it reaches its targets.

🛠️ Steps we took:

  1. Installed snwr-mid-mum-02 next to 01 in the Mumbai server zone.
  2. Installed snwr-mid-lon-01 in London in week 6.
  3. Installed snwr-mid-aws-01 inside the VPC.
  4. Tested each against a few targets in its zones.

✅ What we verified:

  • Each MID Server reaches its zones.
  • No MID Server sits in the DMZ.

📁 Evidence: The MID placement table in the runbook.

5 Quick recap

  • Place MID Servers close to their targets.
  • Avoid slow WAN links and extra firewalls.
  • Keep MID Servers out of the DMZ if you can.
  • Use as few as you need, plus failover.

6 Check yourself

Think of your answer first. Then tap to check.

1 Why does London have its own MID Server? Show answer

To avoid scanning across the slow WAN link.

2 How is SNWR’s DMZ reached? Show answer

From the Mumbai MID Servers, through one firewall rule.

3 What’s the cost of more MID Servers? Show answer

More hosts to patch and watch.

Nice work! SNWR’s MID Servers are in the right places. 🎉
Next up: Applications, IP Ranges and MID Capabilities

Was this lesson helpful?

Have a question or doubt?

Ask here and get help from instructors and fellow learners.

0 / 300

Only logged-in learners can post.