Webfacing - Where to run the HLL programs?

I've got an iSeries for web serving.  Let's call this WEB.  I've got 
another system where the data resides on.  Let's call this DATA.

At this time we are pursuing Webfacing some applications.

With webfacing you can have your WAS and the jsp's created by Webfacing on 
one iSeries, and your HLL programs on another.  And your data on one of 
these two, or another machine(s).

If we store our HLL (RPGLE, CLLE, etc) on WEB we can access the data on 
DATA using any number of methods:
- Stored procedures
- DDM
- SQL's CONNECT TO statement
- DATA QUEUE's, message queue's, MQSeries, etc

However we are leaning towards storing our HLL on DATA.

I want to make sure that I maximize security and performance with a 
secondary goal of making it simple.

One mandate is that there is zero replication of data.

Which machine takes the interactive hit?
A - The machine running WAS - WEB
B - The machine with all the HLL, screen files, etc - DATA

Currently WEB is in the DMZ and cannot initiate any processes on DATA.  No 
telnet, ftp, ddm, etc.  DATA can initiate most anything on WEB.
What do I have to open up on the firewall to allow WEB to run the HLL on 
DATA?

Any concerns, suggestions for improvement, etc?

Rob Berendt
-- 
"They that can give up essential liberty to obtain a little temporary 
safety deserve neither liberty nor safety." 
Benjamin Franklin