Use a real router/firewall, and put the web servers and database servers in separate VLANs, both outside the internal LAN, with firewall rules controlling access to the bare minimum required ports from the web servers to the database servers, and from the database servers though to any internal resources.

That way, if an attacker gets a beachhead on one of your web servers, at least they aren't on the same network with unrestricted access to attack your database server(s), and if you have any kind of reasonable monitoring in place you should receive notifications about the breach of the web servers before the attackers have had much time to attack anything else.

What's up with the unreasonable resistance to having more than one firewall?