I have a Deco BE16000 set up in Router mode, behind an AT&T BGW320 in IP Passthrough mode (no bridge mode). The BGW router has its own configurable firewall. The specs on the BE16000 say it has an "SP