Placing the Gateway in a customer's DMZ that is not directly exposed to the Internet is the recommended internal connection option. By placing the Gateway in a DMZ behind an Internet firewall, the customer has control of traffic traversing their internal networks and also of inbound connections from the Internet.