Dual-firewall IDMZ alternatives

Two ways to build an industrial DMZ: separate IT and OT firewalls (each with its own boundary, policy and failure domain) or a single three-legged firewall, with the DMZ services on each (jump server, historian replica, patch server, file transfer, remote access gateway) and a comparison on boundaries, availability, power, management, policy and common-mode dependencies.