Unable to Use Guest Wifi in AP Mode and a Switched Wired Backhaul

Not Netgear, and even less practical knoledge on these Orbi WiFi 7 systems. However, a lot of experience on designing and implementing bigger SMB class networks. 

What Orbi does (and this is the same for several Orbi generations!) is to maintain two networks on the same physical LAN, doing some L2 isolation- The guest network logically exists on Orbi devices only, and does aparently share the same wired backhaul. And it does -not- make use of VLANs for seggregating the this magic guest network. Really useful and meaningful is this guest network implementation only in Orbi router mode, and never in AP mode - unless I understand things wrong here.

The obvious fix would be -if- Netgear would force tagged VLANs, at least for the guest network - and would add some controls to make this clearer. From the bigger picture, the Netger Insight mangement does in general allow such configs, but not sure by how far this is implemented on the Orbi WiFi 7 product line. 

As-is, I must say that you have choosen the wrong product combination for what you like to achieve with your small business class Firewalla, with random switch for the backhaul - and at the end of the day your limited of networking know-how.

Netgear does offer many different switches -and- Wireless Access Points supporting VLANs - and many are Insight manageable.

To cause even more confusion in the market for normal end-users, the IEEE implemented this IEEE 1905.1 add-on to the Ethernet standardisation. Some vendors have pushed products to the market, aparently allowing seamless co-opertion of multiple "networks" - promoted as wireless Mesh systems - but re not telling the users that all devices (including the switch infrastructure needs to be compliant to that other magic 1905.1.

Sorry for destroying some (and more!) illusions here.

Regards,

-Kurt.