Splitting a single ISP line through a core switch to 2 firewalls best
The firewall IP address will move between whichever firewall is active in the cluster, so the vlan must be available where both firewalls will connect. It can be a switch, or router, or however you can do it.