Using VLAN's in Firewall topologies

["btsec" <btsec () magna com au>]

Recently I have come across firewall design topologies involving switches
(eg Catalyst 5000) which are implementing VLANS.

For example (View with Courier Font):

Internet----Router1-----Switch1---Router3--Internal Network
                           |
Internet----Router2-----Switch2---Router4--Internal Network

Where the Switch is configured such that there are a number of VLANS,
with different subnets comprising of a Firewall and a DMZ for example.
So logically it could look like the below

Internet----Routers----Firewall---web servers---Routers----Internal Network

I personally am a bit concerned about using Switches (VLANS)
in such a design. I haven't seen too many security designs involving them.

Any comments on using switches for such purposes?

A few thoughts-
Pros    - less hardware (hubs and interconnects via trunking)
        - switch faster than hub
        - less chance of snooping

Cons    - No physical separation of outside and DMZ
        - security issues with VLANs, ISL trunking?

Thanks

Paul Therkelsen