I have a couple of switches, so I don't really need the extra lan ports on the firewall. I keep two of the firewall lan ports free from always on VPN, because sometimes it's useful.