LAGG and L2 redundancy confusion

[Krisbe]

Hi

I'm setting up an environment with two pfSense firewalls and two (Mikrotik) switches. But I'm confused how to use LAGG and LACP. Is the setup the same when using LAGG between one firewall and one switch?

See the attached image. Do I use the settings correct?
On SW01, do I put both links to both firewalls in one LAG group? Or in two groups like in the image?

login-to-view

Thanks all

[Derelict]

That would be up to the switches.

Are they physically stacked? If so, you should be able to just create an LACP LAGG using a port on each switch.

If they are not stacked they'll need to support something like Multi-Chassis Trunking.

It would be two LACP LAGGs - one to each firewall with the same VLAN(s) on them.

[Krisbe]

Hi

No, the switches are not stackable.

"It would be two LACP LAGGs - one to each firewall with the same VLAN(s) on them."
You mean two LAGG groups on both switches? Eg. like: in LAG1 both eth0 ports from fw01 and fw02 and in LAG2 both eth1 ports from fw01 and fw02? Or do I get that wrong?

[Derelict]

I doubt you can create those laggs if the switches are not stackable.

login-to-view

[Krisbe]

Hi

Hmm no okay, the switches are not stackable, so LAG won't be an option for now.
My best option is to create the setup like described in https://www.netgate.com/docs/pfsense/book/highavailability/layer-2-redundancy.html I guess?

Other ideas are welcome.

[Derelict]

Yes. Without stacked switches (or MCT) that is probably your best guide.

[Krisbe]

What about the "FAILOVER" protocol instead of LACP? That is active/passive I think? Isn't that a solution for the 2-switch setup? Then I just need to create this LAGG on pfSense, but not on the switches?

[Derelict]

You can try it and test it. I've never done it.