The firewall comes imaged from our production group. By default there is an Admin Console rule which permits you to connect with the GUI to the internal port of the firewall (after you've done the Quick Start portion of the install). The port identification guide tells you which port is internal so you can connect with the GUI to that port and which port is external so you can hook that port up to your external switch.
All the ports, including the bge ports, can be used for additional internal network burbs. You can put any two ports into a bridge for transparent firewall mode (not just the bge ports).
The em ports (on the expansion NIC) do not necessarily go in order from em0 to em5, left to right. You need to plug a cable into a port and run 'cf int stat' on the command-line or click the 'Show Status' button in the upper-right of the Interfaces GUI screen to determine which port has a status of 'Conn/u' or 'Conn/d'. Note which port that is (em2, em3, etc.). Do this for each port to determine which ports are which in the configuration.