I want to set up a SQL Server 2005 database, a Reporting Services instance, and IIS to view reports via the web and web applications.
How many servers are optimal for this setup? I hear various things about the security of having IIS on the same box as a SQL Server.
I'm preparing to price out some servers for this type of configuration and want to make sure I buy enough.
I would consider at a minimum 1 box for IIS in a DMZ and one SQL Server box (with reporting services) behind the firewall.
As for performance it really depends on the load you expect to have. IIS can be load balanced easily, but if you are heavily dependent on Session State then you will need to use IP Affinity to make sure when a session is started on one box that that session is always accessed from that box.
SQL Servers also cluster well with a SANS unit to give a general storage place for the Databases. Or you could consider log shipping for an active-passive. I have even seen people use log shipping for a updatable version of the db and a read-only version for reporting.
Clearly there are many ways to go. But if you could elaborate on the load you expect then I could probably give a better suggestion. Otherwise keep an eye on the performance and tune or add hardware as needed.