I've been running my CCR for a while now as my router with 2 WAN's in failover mode, the router hands off to additional switches for the home network and labs. I recently picked up a firewalla gold plus and run it in transparent bridge mode. However it only right now has a 2.5G ports on it. And putting it directly between the router and the switches seems to be extremely inefficient. How would you guys run this?

My current gear is set up like this:
CRS326-24S+2Q+RM (Supports 3 racks of servers with ML use cases needs tons of bandwidth)
CSS326-24G-2S+RM (Supports WIFI & IOT & Desktop machines)
Firewalla Gold Plus
CCR2004-1G-12S+2XS ( Edge router supports WAN Failover and routing for the network)

Right now connecitons are CRS326 On port 1&2 of Firewalla, CCR2004 on Port 4 of Firewalla

I feel like it would be much more efficient to keep Xfinity & Startlink on port 1&2 of the router, have the Firewalla on port 3 (WAN) and Port 4/5 as (LAN) port for Firewalla, and putting the switches on port 6/7 then route all publicly facing traffic throught he firewalla and everything internally through the CCR. Am I thinking about this wrong?