Thanks for the comment! I’m not sure if the WAN is PPPoE on the pfSense box - is this something I configure or is it set by the ISP?

Oh wait I think I see what you’re saying. My internet is through cable (not ethernet), so I think you are saying to do this:

internet
   │
   ▼
modem
   │
   ▼
managed switch──────────────┐
    │                       │
    ▼                       ▼
arris router           pfSense box

Isn’t this a problem because then the managed switch is on the ISP’s network?

Also, you said that the WAN interfaces of both the arris router and pfsense should be in that managed switch, but then also (last bullet) that the router and pfsense plug their LAN output into the managed switch? Was that just a typo?