Firewall in SAP landscape

Hello Folks,

I try to understand the risks, if we don't have a firewall between application and database server?

End users will never access database server as per the plan.Also do you recommend firewall between QAS and PRD systems?

Since we have a secured LAN, I wonder whether these firewall settings are mandatory.In our environment the system is not connected to internet. From DR perspective, we may deploy a parallel system in another data center.

I appreciate your replies.

Thanks

Bala