It's long been a best practice for highly secure environments to use transport encryption between all tiers. The idea is that if someone compromises your datac

It's long been a best practice for highly secure environments to use transport encryption between all tiers. The idea is that if someone compromises your datacenter, it's often a second-tier box, a forgotten web app, an ssh bastion host, etc. These boxes might not have any sensitive information on them. However, the attacker might be able to use that box as a jumping off point to attack switches or other network devices where you could configure the network port of a compromised machine to receive a copy of all of the data being transmitted on the ports of more sensitive servers. You should treat external firewalls and iptables like seatbelts in cars - yes, they're great, yes, you're a lot more likely to survive something terrible with them, but that doesn't mean you can drive recklessly and drunk.