R: Layer 3 and Firewall

> How can we tackle this risk ?

> What is the technical workaround. Is it a REALLY BAD idea to have
> multiple Firewall segments connected on the same 6509?

Well, the problem is not the 6509 itself, if someone not trusted has access
to the telco room and to the management of the switches (in particular L3
switches) he can have a lot of fun anyway.
Relegating segments on separate devices is of no purpose if the untrusted
man can play with a L3 device and pull the right cables on.
However creating vlans potentially exposes the network to threats like vlan
hopping, but why bother with these games if you can access the device itself
and change the config?
Wan access is less of a concern to me, for that you need to perform nat and,
if I recall correctly, 6509 doesn't do nat by itself.
Bye,
    Max.