@nicholfd:
Thanks for your feedback. I thought my question was more "generic" is why I didn't include more details. The question was meant to ask why, in general, one method might be better than the other (trunking VLAN's to pfSense vs. separate VLAN to pfSense/).
Thanks,
Frank
Then you'll want a hybrid approach as I mentioned.
You don't want to try and route very high bandwidth traffic use cases through the pfSense box if the Brocade can help route it.
E.g. Servers to networked storage. Let the Brocade do VLAN (L3 routing) and apply ACLs accordingly there.
For traffic that needs more isolation/ protection, let pfSense handle the firewalling with a VLAN interface (so called trunked to pfSense).
Note that certain networks don't even need to be routed in many cases. Typically, your SAN will ride on iSCSI and those networks don't actually need an internet gateway of any sort.
If you do actually need internet access on those networks for any reason (obtaining firmware updates etc), then add a pfSense VLAN interface on that network and apply firewall rules + NAT.
I don't recommend this approach though. You should always download and check the updates onto a system that is direct attached to the storage networks and use it to apply the updates to the units.