Incredible that no one answered this or at least gave it a go...

I went ahead and did this. I created two VLANs (100 and 200) on my QNAP switch and connected the ISP Gateway 2.5G port to a port on the Switch tagged as VLAN 100. I then connected the XE75 Pros 2.5G port to another port on the Switch tagged on VLAN 100. The rest of the ports on the Switch are tagged on VLAN 200.

If I then connect one of the 1G ports on the XE75 Pro running router to VLAN 200, it ALL works... However, that is, of course, not what I want...

I then tagged the port the XE75 Pro Router is using on the Switch as VLAN 200 also, and removed the cable between the Router and VLAN 200, which worked for a short while.

However, it stopped working after a few minutes, and then I was back to scratch.

Is there a way to tag WAN on VLAN 100 and LAN on VLAN 200 on the same port on the XE75 Pro? 

  @KillerBob 

I think you are trying too hard. This is what can work:

1. Configure ISP Gateway (Shaw XB7) to run in its default router/gateway mode;

2. Configure Deco mesh to run in Access Point mode: Switching a Deco to Access Point (AP) Mode

3. Connect QNAP M408 switch 10G port to Shaw XB7 2.5G port;

4. Connect Main Deco XE75 Pro 2.5G port to QNAP M408 switch 10G port;

5. Connect Satellite Deco XE75 Pro 2.5G port to QNAP M408 switch 10G port.

Network diagram will look as follows:

The only question is: does QNAP M408 support Deco Ethernet backhaul? You'll find answer to that after wiring everything above way. More about Deco Ethernet backhaul here: General questions about Ethernet Backhaul feature on your Deco

I know that would an option… and that is my fall-back plan. However, I am tired of all the restrictions in the ISP Gateway providing DHCP and NAT. One for instance is that IP reservations are very challenging to change… Also, by running the Deco is AP mode you loose QoS capabilities.

  @KillerBob 

Checked XB7 on Shaw Web site, found that it is the same Ignite WiFi Gateway (Gen 2) modem I have with Rogers.

I would agree if you were to be disappointed with DNS: when Rogers upgraded my modem to Ignite Gen 2 I have lost AdBlock service I run on Synology NAS, because I can't change DNS servers in Ignite Gateway to point to Synology NAS. But I can live with that.

As for IP reservations, what is hard about them? Open "Gateway > At a Glance," scroll down to the bottom of "Connected Devices," click on "View Connected Devices" button and there for every connected device you'll see an EDIT button, where you can enable or disable IP reservation per device.

Using QoS and priority devices makes sense for consistently overutilized network. In all other cases, it is just waste of your time to configure and manage it. I'll go even further and say that if you truly manage to utilize your Internet link to the max most of the time (which would be unusual for a home network), just upgrade to the next tier of Shaw Internet service.

It is not that I cannot use IP reservations, but try and change one, and you will see what I mean. The XB7 is incredibly slow to take DHCP changes, and when the XB7 auto assigns an IP, often with the wrong details, it is difficult/impossible/slow to delete or change it without a hardware reset. And yes, let us not talk about DNS.

As for QoS, I have the 1.5G internet from Shaw/Rodgers, which is the fastest they offer in Saskatoon. I like QoS and have used it for years to ensure that my NAS and ATV have priority, which with teenagers in the house is necessary.

  @KillerBob 

Not sure if there is difference in Ignite Gateway firmware for Shaw and Rogers. I had no issues configuring IP reservations for my NAS, Main Deco, network printer.

Just tested IP reservation for my smartphone: yes, it took 10 seconds for IP reservation screen to switch to confirmation after I pushed "Save" button, but you do that once for each of devices you need IP reserved, and these should be just few. If you need to add/change/modify IP reservations often, you are not managing your home network the right way.

Back to QoS: my NAS is hardwired to Ignite Gateway, which I can do with Deco mesh running in Access Point mode. No Deco QoS for me.:)

Anyway, good luck with your endeavour. When you get tired of trying to bend the system your way, follow your fall-back plan and you'll run the system the way it were designed.

From General questions about Ethernet Backhaul feature on your Deco:

  @KillerBob 

You do not describe how you connect your satellite Deco.

If I understand well, you want to use a 2.5 Gb port of the Main Deco (in Router mode) for the WAN, the Deco Ethernet backhaul, and the devices cabled onto the Main Deco.
Is it really efficient, given that all your LAN traffic, except the traffic of the devices connected by wifi to the main Deco, would travel twice on the 2.5 Gb port?

Setting the Deco in AP mode would also probably let some Ethernet LAN traffic bypass the Deco.

 Nope - that's not what I am saying...

Each node is connected to my switch; the main to a port tagged on VLAN 100 and VLAN 200. The two nodes on ports tagged on VLAN 200.

  @KillerBob 

1. connected the XE75 Pros 2.5G port to another port on the Switch tagged on VLAN 100.
2. connect one of the 1G ports on the XE75 Pro running router to VLAN 200
3. removed the cable between the Router and VLAN 200

The way I read it, you are using the 2.5 Gb port of the main Deco for everything.