DMZ - the physical layer

[John White <johnjohn () triceratops com>]

I was looking through the archives of the greatcircle
firewall list and came across some opinions regarding
the construction of DMZ's.

I'm using Baystack 450's as my backbone switches.
Bay 450's have a virtual lan function which can
be used to limit a collision domain to specific
ports.  I was planning on using this function to
create the DMZ.

However, I ran across some opinions that this type of
action was quite foolish.

Can someone give me the cons to this proposal?

An option would be to buy a cheap Netgear switch 
(under $500) to be a physically separate DMZ. 

Pros and cons on that vs the virtual lan?  $500
is a small price to pay if there are security problems
when using a vlan aa a DMZ.

John