An internal firewall exists in most installations on the A1 interface, which is the private interface towards the enterprise. The diagram shows an external firewall on the B1 interface.