HI
All branch firewalls can do a DUAL mode, which means they can be a transparent switch for some interfaces and a stateful L3-firewall for other interfaces, the connection between are vlan-interfaces ( is the same as irb )
( only on most versions you need to reboot after first commir to switch mode )
the layer 2 part consists of interfaces with family ethernet-switching and either trunk or access with different vlans
each vlan, which should be reachable via other vlans need to have a vlan.## interface with a family inet... L3 configuration, and those interfaces need to be put into security zones and need security policy in order to forward traffic.
so the layer 2 part is stateless and unfiltered, the intravlan traffic is locally switched , the L3 area is a normal firewall.
without having exact performance data the switch-part in my experience is a normal ethernet switch, with adequate wirespeed throughput, and does not at all affect the L3-firewall performance
we used such a config in a smaller datacenter with 2 srx240 in cluster, (by the way to have better redundancy why not using 2 smaller SRX instead of one srx 650 ?)
regards
alexander