Hello,
I prefer to split your uplinks between two virtual switches:
- First one for LAN connectivity (LANvSW)
- Second one for WAN connectivity (WANvSW)
For high availability and redundancy, you can configure the above virtual switches with 2 uplinks each one.
Or one uplink for WANvSW and three for LANvSW (depend on your config).
Note: uplinks of WANvSW should connect to WAN network and the same for LANvSW uplinks.
Then and for WANvSW, create a port group with settings needed and connect to it the first leg of pfsense machine.
For LANvSW, create the needed port groups and connect them to VMs (like second leg of pfsense)
Please consider marking this answer "correct" or "helpful" if you think your question have been answered correctly.
Cheers,
VCIX6-NV|VCP-NV|VCP-DC|