For this customer, there is actually a small dumb unmanaged switch above the firewall. The network tail comes in from the DC into port 1 of the unmanaged switch, then port 2 goes to the WAN port of an internal corporate firewall and port 3 connects to the WAN port of the cloud firewall. Other than that, there are no other networks connected in this instance.
Their public IP allocation lives outside the firewalls, but the unmanaged switch has no concept of IPs etc.
Cheers.