pfSync interface: better to use dedicated or VLAN tagged, but LACP redundant?

[tm_an]

we currently consider a new network design:

Would it be better to put the pfsync on a physical net port (as suggested around the net) or would the increased bandwidth and security of a LACP bond outweigh the considerations behind that, even if that would bean using a tagged VLAN for pfSync?

Thanks for your input
Tobias

[jimp]

Best to be on its own physical port if possible. The busier the firewall the busier the pfSync interface will be handling state data updates and you will find that when combined with user traffic it would severely limit your throughput if it's all combined.

If your throughput and/or user count is fairly low then it may not matter, but I would still push for a dedicated interface if possible.

[tm_an]

Thanks for the insight.

The other traffic on that physical interface will be negletible (only management data), so we will go for redundancy with VLAN.