Who rated this post

Hello @Kenneth716 of course.

Now thinking about Internet access not the LAN/Trust side.

Let's say "Ideal" or something more ambitious.

If you have a stack of switches, for example Cisco, you connect your ISP links to the stack.

You can have your LAG/AE/portchannel in cross-stack ethernchannel (e.g. two switches).

Which example:

Create a LACP portchannel in the stack.
Portchannel 1 ( Active ):: One interface on the upper switch and one on the lower switch.
Portchannel 2( Passive ):: One interface on the upper switch and one on the lower switch.

Then in the PA you configure LACP with two interfaces, one that will connect in the upper switch of the stack and another one in the lower switch.

The same with the passive, one interface on the top stack and one on the bottom switch.

With this you have on one side high availability of links, in case of failure of the switch one of the stack the traffic continues in the active FW and flowing through the lower switch of the stack in a transparent way and also when it is all operative the fact of having more bandwidth capacity by the LAG.

If you do not have a switch stack, just remember to set up two port.channels, one for the active and one for the passive.

Cheers