While I am using Cisco kit, this isn't really Cisco related, more general network design.
In the past I have connected internet connections straight in to a layer 3 core switch, 3750X's, 6509's and H3C 12504's. Dual internet connection (either same provider or different) in to the core switch which is an access port for a specific VLAN, let's say VLAN 900. I then have my HA pair of firewalls connected with the Outside interface in to the switch on an access port also on VLAN 900. The firewall will of course then have Inside and DMZ interfaces connected to the switch in their respective VLAN's.
I've never had a problem with this and nobody has questioned me on this however it has since come in to question that this isn't safe and far better if I connect straight in to the firewall. However, my issue here is that by connecting all 4 cables in to the switch (2 x internet connections and 1 Outside interface from each firewall) I am giving full resiliency to an internet connection or firewall dying. We can add more resiliency by adding another core switch so 1 firewall and 1 internet connection to one core switch and the other FW and internet connection to the other core switch.
To me that is sensible, reliant and secure. However nobody here, or in my last job, knew networks enough to question this but someone above me, who does admit he is not a network person, is questioning and would like a better answer then what I can give. So rather then be bullish and stand my ground I wanted to throw this up in the air and ask if I am doing the right thing and hear other perspectives.
Thank you for your time