Ran head-on into the same trap today. Expected the GPEN21 to be basically a three-port switch, with one copper PoE in, one copper PoE out, and one SFP. Found out that ETH2 to SFP isn't switched at all, maybe even an undocumented combo port. Cool. The AP behind the ETH PoE is now isolated from network. All this makes it much less usable as a "smart injector".
Just finding out now that in the brochure it says "GPEN21 has an Ethernet and an SFP port for fiber connectivity. These ports can be used for simultaneous external connections, but not for cross-port
Now I'm kinda asking myself: Why?