Hi,
Not sure what vendor firewall you are using, but if you are using clustering on the firewalls with one IP representing both devices, the diagram without the cross-connects should work fine. So, let's look at a couple of scenarios assuming the firewall on the right is the primary device and the VSS chassis on the right is also the primary device. If the primary VSS device fails, the secondary chassis on the left will take over and forward traffic to the passive firewall. Now in this situation, you want to make sure when the primary VSS goes down, the primary firewall hands over the traffic forwarding responsibility to the standby firewall so the traffic is not sub-optimal by going through the passive firewall, the interconnect, and then the active firewall. The second scenario is if there is a link failover between the primary switch and the primary firewall. In this case, the same concept as above should apply and the traffic should simply go through the secondary chassis and the new active firewall both on the left.
HTH
