I must apologize, I don't speak English well and it's hard for me to explain myself.
What really amazes me about the switch software is the way it works. I have done a lab and I have verified that if you connect a device to a port that sends 802.1q traffic in VLAN 50 and another port on the same software switch that sends 802.1q tagged traffic in Vlan 50 they can communicate with each other without creating the VLAN in the switch software (no gateway needed). The software switch does not look at the tag and the traffic passes even if you have several vlans created in the switch software.
However, if we want to route the VLANS with others from the switch software, or other firewall ports, it does distinguish the VLANs. When you are routing traffic distinguishes the tagg.
That's why I was wondering if explicit mode might be more recommended, but I've read that in that mode you can only make rules for traffic coming through the software switch ports, between them. But not with other Firewall ports. Therefore, this option is not valid for me and I will have to understand how the switch software works in level 2 since it seems that if there is no routing, it communicates everything that happens between its ports regardless of anything. Similar to a HUB?
I really appreciate your help and I will continue investigating to see if I can understand and get used to the fact that the traffic that goes through it, at level 2, seems to not take the label into account and see if this could pose a security problem between the Vlans created in the switch software, to route between them with policies through the firewall, which will be the gateway for each of them.