Filtering and no filtering simultanious

Phatsta

Probably a question for @Derelict :)

Currently building a new datacenter and trying to achieve highest possible redundancy on a budget. This is the setup I'm designing at the moment.

alt text

The problem is that I need a WAN switch for server hosting where customer has their own router (and where the needs are basic), but placing a single switch between the CPEs and HA will make the entire network non-redundant. Unless of course I place two switches, which will require an additional switch, network interfaces in the routers, DAC cables and more $$$. So I'd much rather place the switch after the HA. But...

Since I want the WAN switch to be on the actual WAN, it would require to disable routing, something along these lines;
https://www.reddit.com/r/PFSENSE/comments/bzsomv/use_pfsense_as_firewall_but_not_a_router/

But if I do that it will break everything else. Does anyone have a better idea?