Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
It might be.
Outbound on the port toward the ISP you would direct each FW's traffic to one of the 2960S's 4 egress queues and configure SRR that each of those 3 queues gets 33% (or 1:1:1) of the bandwidth.
Inbound is tricky and problematic. The problematic issue is, unless we can configure QoS on the ISP port to your 2960S we cannot really control bandwidth usage. We can, though control bandwidth to the FWs, similar to the egress to the ISP, and this will somewhat achieve fair sharing for traffic like TCP, but not for other traffic. (Again, downstream bandwidth management is very difficult to fully control.)
The tricky part is managing bandwidth to the FWs. We need all 3 FW traffic on the same port, so we can again do what I described for egress to the ISP. This can be accomplished on the same switch by placing the FWs into a different VLAN and then, on the same switch, cross connecting two additional ports between the original VLAN and the new FW VLAN. (BTW, if you do this, you should/must move the described QoS for the ISP egress port to this new cross connect port too.) The cross connected ports will be able to manage bandwidth sharing in both directions.
NB: If the ISP bandwidth is 100 Mbps, the cross connected ports should also run at 100 Mbps.
PS:
BTW, CDP may continuously complain the cross connected ports are in different VLANs. If it does, you could disable CDP on those ports.
