Ali
1) Do you mean arp poisoning ? To be honest i haven't heard this used as an argument that much for a separate switch between firewall and router as arp poisoning works at layer 2 and so the attacker would need to be on the actual network.
There are however good reasons for using a dedicated switch ie. if you misconfigure something like vlans on a dedicated switch then you only mess up the internet connectivity. If you are using a single switch for outside/dmz and maybe inside then a misconfiguration can have far more serious consequences.
Perhaps you could post the link to the thread you were reading ?
2) By provider independant do you mean IP addressing. If so, when you have connections to multiple ISP's provider independant addressing is a huge plus because both ISPs will advertise the same network. So you can setup your NAT translations for dmz servers etc. and if one ISP goes down then the traffic is simply routed via the other ISP. It also means if you move to another ISP you do not have to setup your NAT translations with new addressing.
Compare this with addressing provided by the ISP. If you have 2 ISPs and they each provide you with a block of addresses, then which ones do you use for NAT ? Each ISP is unlikely to want to advertise the others block as this goes against summarized addressing so you have a problem if the ISP whose IPs you are using fails because your NATs are not now reachable.
3) See the following docs -
Enterprise Multuhoming with NAT
http://www.cisco.com/en/US/customer/tech/tk648/tk361/technologies_white_paper09186a0080091c8a.shtml
BGP Multihoming to 2 different providers
http://www.cisco.com/en/US/customer/tech/tk365/technologies_configuration_example09186a008009456d.shtml
Enterprise SAFE reference design document (specifically chapter on Enterprise Internet Edge)
http://www.cisco.com/en/US/docs/solutions/Enterprise/Security/SAFE_RG/SAFE_rg.html
Jon
