With old debian 8, we have to work with debian NIC doesn't matching with physical label on netgate.
For example, physical:eth2 is debian:eth0, etc.

With stretch, this problem is more complex, we have to work with the predictable network interface name.

Left: physical / right: Debian 9 NIC
eth0 / enp4s0
eth1 / enp3s0
eth2 / enp020f0
eth3 / enp020f1
eth4 / enp020f2
eth5 / enp0s20f3

It's really annoying and we have to fix it (inspired by this article).
For more security, we match the PCI id and the MAC address. Informations below are for the netgate 4860 (centrale 3540). I think you have to check your hardware because it can change over time.

1. Getting the PCI ID and MAC address for each interface.

   udevadm info -e | grep -A 5 -B 18 "INTERFACE=enp" #Stretch
   udevadm info -e | grep -A 5 -B 18 "INTERFACE=eth" #Jessie

   The result should look like:

   [...]
   P: /devices/pci0000:00/0000:00:14.1/net/enp0s20f1
   E: DEVPATH=/devices/pci0000:00/0000:00:14.1/net/enp0s20f1
   E: ID_BUS=pci
   E: ID_MODEL_FROM_DATABASE=Ethernet Connection I354
   E: ID_MODEL_ID=0x1f41
   E: ID_NET_DRIVER=igb
   E: ID_NET_LINK_FILE=/lib/systemd/network/99-default.link
   E: ID_NET_NAME_MAC=enx0008a20cb2be
   E: ID_NET_NAME_PATH=enp0s20f1
   E: ID_OUI_FROM_DATABASE=ADI Engineering, Inc.
   E: ID_PATH=pci-0000:00:14.1
   E: ID_PATH_TAG=pci-0000_00_14_1
   E: ID_PCI_CLASS_FROM_DATABASE=Network controller
   E: ID_PCI_SUBCLASS_FROM_DATABASE=Ethernet controller
   E: ID_VENDOR_FROM_DATABASE=Intel Corporation
   E: ID_VENDOR_ID=0x8086
   E: IFINDEX=3
   E: INTERFACE=enp0s20f1
   E: SUBSYSTEM=net
   E: SYSTEMD_ALIAS=/sys/subsystem/net/devices/enp0s20f1
   E: TAGS=:systemd:
   E: USEC_INITIALIZED=4244300
   [...]

2. Add rules for the interface name.

   vim /lib/udev/rules.d/70-persistent-net.rules

   In my case, the file is the following, but you need to adapt to your configuration.
   = is for matching, == is for assignation.
   Don't use the format with [Match] & [Link]. It's seem to be out of date and doesn't work with systemd.

   SUBSYSTEM=="net", KERNELS=="0000:04:00.0", ATTR{address}=="00:08:a2:0c:b2:xx", NAME="lan0"
   SUBSYSTEM=="net", KERNELS=="0000:03:00.0", ATTR{address}=="00:08:a2:0c:b2:xx", NAME="lan1"
   SUBSYSTEM=="net", KERNELS=="0000:00:14.0", ATTR{address}=="00:08:a2:0c:b2:xx", NAME="lan2"
   SUBSYSTEM=="net", KERNELS=="0000:00:14.1", ATTR{address}=="00:08:a2:0c:b2:xx", NAME="lan3"
   SUBSYSTEM=="net", KERNELS=="0000:00:14.2", ATTR{address}=="00:08:a2:0c:b2:xx", NAME="lan4"
   SUBSYSTEM=="net", KERNELS=="0000:00:14.3", ATTR{address}=="00:08:a2:0c:b2:xx", NAME="lan5"

3. Only for Jessie (and lower?): remove the existing udev rules in /etc and prevent the file generation on next reboot.

   echo "# disable net-generator rules in /lib/udev" > /etc/udev/rules.d/75-persistent-net-generator.rules
   rm /etc/udev/rules.d/70-persistent-net.rules

4. Adapt interfaces list (specific to your installation).

   vim /etc/network/interfaces

   [...]
   allow-hotplug eth1
   iface lan1 inet dhcp
   [...]

5. Reboot

   reboot

6. And check results.

   ip a

7. Check the correspondence between NIC label and physical label.

   tail -f /var/log/syslog | grep kernel

   Connect and disconnect (physically) and check the corresponding line.

   [...]
   Oct 30 10:11:50 3540 kernel: [  129.120407] igb 0000:04:00.0 lan0: igb: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX/TX
   Oct 30 10:11:52 3540 kernel: [  131.774607] igb 0000:04:00.0 lan0: igb: eth0 NIC Link is Down
   [...]

8. If you have some trouble, you can add log.

   vim /etc/udev/udev.conf

   udev_log="debug"

   But don't forget to remove after your fixing.

I've made some tests with debian 8 and i encounter this problem:
If i comment 1 line in udev rules (for example eth4), eth4 retrieve his old default name (eth2) and eth2 get the name “rename”. In this case, eth2 physical become eth4 and this is unsafe. For preventing this (and preventing a wrong naming when an interface is out of order), interface name is lanX.
If i comment the lan4 line in udev rules, lan4 (eth4 physical) become eth2, but lan2 stay lan2 and eth4 physical simply doesn't work because /etc/network/interfaces doesn't content ethX declarations.

source

found Path and MAC address

ifconfig
udevadm info -e | grep -A 5 -B 18 "INTERFACE=eth"

add files like 1x-lanx.link in /etc/systemd/network/ with rules like :

[Match]
Path=<id_path>
MACAddress=00:e0:4c:36:01:6b

[Link]
Name=lan0

add file 99-default.link in /etc/systemd/network/ with rules like :

[Link]
NamePolicy=kernel database onboard slot path
MACAddressPolicy=persistent

to permit user-defined name of USB network interfaces, it's necessary to enable the 80-net-setup-link.rules rule with this command :

sudo ln -s /lib/udev/rules.d/80-net-setup-link.rules /etc/udev/rules.d/80-net-setup-link.rules

found ID_PATH and MAC address

udevadm info -e | grep -A 5 -B 18 "INTERFACE=<interface name>"
ip a

edit files like 1x-lanx.link in /etc/systemd/network/ with rules like :

[Match]
Path=<id_path>
MACAddress=00:e0:4c:36:01:6b

[Link]
Name=lan0

make sure file 99-default.link is present in /etc/systemd/network/ with rules like :

[Link]
NamePolicy=kernel database onboard slot path
MACAddressPolicy=persistent

to permit user-defined name of USB network interfaces, it's necessary to enable the 80-net-setup-link.rules rule with this command :

sudo ln -s /lib/udev/rules.d/80-net-setup-link.rules /etc/udev/rules.d/80-net-setup-link.rules