Choose LAGG membership before assigning OPNsense VLAN networks

Bottom line: Draw the physical-member, optional LAGG and VLAN-interface hierarchy before moving an address. Make the intended management interface and recovery access explicit, then review the assignment changes in that order.

Source fact: what the authority says

The OPNsense VLAN and LAGG guide requires LAGG member interfaces to be unassigned before creation. The LAGG step is optional; the guide permits VLANs directly on a physical interface and permits a LAGG with one member. After assigning the VLAN interfaces, the parent should stay unassigned, with a rare exception for assignment without network configuration to override link speed. Each VLAN interface needs a unique IPv4 or IPv6 network, and conflicting networks prevent inter-VLAN routing.

What the source does not establish

The source provides an OPNsense interface-building sequence and a switch guideline, not a vendor-specific switch configuration. This article focuses on interface ownership and network placement; it does not qualify aggregate bandwidth or every trunk security property.

Applicability questions

• Which physical interfaces would become LAGG members, and what assignments exist now?
• Will the VLAN parent be a physical interface or an optional LAGG?
• Which assigned VLAN will carry management access and its address?
• What independent access remains available if the intended hierarchy is wrong?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

DSE recommends an interface worksheet with separate rows for each physical member, parent device and assigned VLAN. Put the current and intended address only on the rows where they belong. Have the switch owner review the matching link design without treating a familiar interface name as evidence of the correct hierarchy.

Plan the assignment transition during an approved maintenance window. Establish console or other independent recovery access before touching the management path. Preserve the current configuration and a device-to-port map so a reviewer can identify the exact member that would be unassigned.

Use a proposed two-VLAN example to review the network plan. Give each VLAN a separate approved test subnet and name the intended client and gateway observations. Check the complete site address plan for conflicts rather than copying the documentation’s sample addresses into production.

Keep a single-member LAGG choice deliberate. Record why the extra abstraction is wanted and which later change it is meant to support. Do not add a second cable or alter switch membership as an unreviewed follow-up to the interface assignment change.

Verification and evidence

Proposed verification: inspect the saved member assignments, parent references and VLAN interface addresses against the worksheet before allowing test traffic. In an isolated or approved pilot, verify management access on its intended VLAN and compare one named client path on each test network.

Retain the firewall and switch configurations together with physical port labels. Record any mismatch between the planned hierarchy and the active view before proceeding. Treat link status, correct VLAN addressing and permitted application access as separate results, and exercise the agreed recovery path if management reachability is lost.

Official references

• OPNsense — VLAN and LAGG Setup — official product documentation; confirm the installed release and configuration.

Source review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.