I'm about to replace our old BM 3.5. with a completely new server.

The new 3.8 server should preferably have three nics to allow for a dmz net.

What is the secureset/simplest way to do this?
I'm thinking of only enabling the public and private nics, install BM, get
it up and working and lastly enable the dmz nic and set up filters.

Am I missing something? will I get into huge routing/filtering/NAT troubles?
or is it the nice secure and simple way I think it is?