Where should the DMZ gateways live in a data center redesign?

For a smaller setup, putting the gateways on the firewall is usually the easier design to operate. The switches carry the VLANs, and routed traffic between the DMZ subnets goes through the firewall for policy enforcement.

Check the firewall's capacity with the inspection features you actually plan to enable, including peak traffic and a cluster failover. Gateway placement doesn't make traffic within the same subnet pass through the firewall, though.

The VRF design gives the switches more of the routing work, but it also gives you more routes and transit interfaces to maintain. It may make sense as the environment grows, especially where high-volume traffic can stay within a routing domain without needing firewall inspection.

Separate VRFs don't inspect traffic by themselves. Make sure every permitted path between the web and database VRFs goes through the firewall, and check both forward and return routing. If all the significant traffic still has to cross the firewall, moving the gateways won't remove that bottleneck.

Map the actual traffic flows before picking based on a reference architecture. In the path described, traffic crosses the data center firewall and later a separate edge firewall. Size each firewall and the links on its path for the traffic and policies it handles.

Also test failure behavior. A cluster may have enough capacity with both members available but less headroom during maintenance or a failure. Whichever gateway placement you choose, check routing convergence and whether return traffic follows a path the stateful firewall can handle.