DMZ gateways

Where should the DMZ gateways live in a data center redesign?

We have a pair of Nexus switches and a firewall cluster, with separate web and database DMZ subnets. Should the gateways live on the firewall, or on the…