At our organization we have a single firewall sitting between our internal zones and the public internet. Currently all of our trusted zones are defined as different vlans on a layer 3 switch plugged into one physical interface on the firewall. The DMZ zone is defined on the firewall itself and is trunked to a layer 2 switch from a separate physical interface on the firewall.
Is this a fairly secure way to separate our trusted zones from our DMZ or does this pose a lot of problems?
Also does having the DMZ vlan defined on the firewall and trunked to a layer 2 switch pose a risk or should I look into getting another layer 3 switch for the DMZ as well?
I have considered trying to get funding for a second firewall to place between our primary firewall and our trusted zones but I don’t know if that would be the best place to make a change to yield the best amount improvement if at all.