Microsoft SQL Server: Web Security

[laredo512]

I posted this question in another thread, and I was suggested to post it as a separate thread to get more of an opinion on this:

If I were to host a database server for external users in this example:

1 - The users use an application that connects to MS SQL for the DB operations the app requires to perform.
2 - The MS SQL server is off site at another office where it also doubles up as a web server.

I was thinking of getting a Cisco Firewall unit and hard code their fixed IP to let them through... unless theres a way to have them use a secure channel ?

What would be your opinion(s) on this?

Nerseus :"Id mention quickly that Microsoft highly recommends that the SQL Server and Web servers stay separate - and Id take that advice. SQL takes up a lot of memory, disk and CPU. Webservers are cheap, comparatively, and easier to scale out if needed. You normally only want one SQL Server box - but a big one."

Thanks for any views on the matter