The firewalls do ebgp towards the switches for every customer network (vlan).

ebgp towards the vrf's for SUNET-management also