The SG changed SW3 and SW4s links to access vlan 45. Which SW1 and SW2 would then tunnel between.
It would not be wrong to change them to trunk interfaces, allow vlan 45 and do QinQ would it? That's what I did and it works, and I don't seem to violate any of the restraints. Doing it this way also gives me more flexibility to add more vlans over this same link if I need to later