With old debian 8, we have to work with debian NIC doesn't matching with physical label on netgate.
For example, physical:eth2 is debian:eth0, etc.

With stretch, this problem is more complex, we have to work with the predictable network interface name.

Left: physical / right: Debian 9 NIC
eth0 / enp4s0
eth1 / enp3s0
eth2 / enp020f0
eth3 / enp020f1
eth4 / enp020f2
eth5 / enp0s20f3

It's really annoying and we have to fix it (inspired by this article).
For more security, we match the PCI id and the MAC address. Informations below are for the netgate 4860 (centrale 3540). I think you have to check your hardware because it can change over time.

1. Getting the PCI ID and MAC address for each interface.

   udevadm info -e | grep -A 5 -B 18 "INTERFACE=enp" #Stretch
   udevadm info -e | grep -A 5 -B 18 "INTERFACE=eth" #Jessie

   The result should look like:

   [...]
   P: /devices/pci0000:00/0000:00:14.1/net/enp0s20f1
   E: DEVPATH=/devices/pci0000:00/0000:00:14.1/net/enp0s20f1
   E: ID_BUS=pci
   E: ID_MODEL_FROM_DATABASE=Ethernet Connection I354
   E: ID_MODEL_ID=0x1f41
   E: ID_NET_DRIVER=igb
   E: ID_NET_LINK_FILE=/lib/systemd/network/99-default.link
   E: ID_NET_NAME_MAC=enx0008a20cb2be
   E: ID_NET_NAME_PATH=enp0s20f1
   E: ID_OUI_FROM_DATABASE=ADI Engineering, Inc.
   E: ID_PATH=pci-0000:00:14.1
   E: ID_PATH_TAG=pci-0000_00_14_1
   E: ID_PCI_CLASS_FROM_DATABASE=Network controller
   E: ID_PCI_SUBCLASS_FROM_DATABASE=Ethernet controller
   E: ID_VENDOR_FROM_DATABASE=Intel Corporation
   E: ID_VENDOR_ID=0x8086
   E: IFINDEX=3
   E: INTERFACE=enp0s20f1
   E: SUBSYSTEM=net
   E: SYSTEMD_ALIAS=/sys/subsystem/net/devices/enp0s20f1
   E: TAGS=:systemd:
   E: USEC_INITIALIZED=4244300
   [...]

2. Add rules for the interface name.

   vim /lib/udev/rules.d/70-persistent-net.rules

   In my case, the file is the following, but you need to adapt to your configuration.
   = is for matching, == is for assignation.
   Don't use the format with [Match] & [Link]. It's seem to be out of date and doesn't work with systemd.

   SUBSYSTEM=="net", KERNELS=="0000:04:00.0", ATTR{address}=="00:08:a2:0c:b2:xx", NAME="lan0"
   SUBSYSTEM=="net", KERNELS=="0000:03:00.0", ATTR{address}=="00:08:a2:0c:b2:xx", NAME="lan1"
   SUBSYSTEM=="net", KERNELS=="0000:00:14.0", ATTR{address}=="00:08:a2:0c:b2:xx", NAME="lan2"
   SUBSYSTEM=="net", KERNELS=="0000:00:14.1", ATTR{address}=="00:08:a2:0c:b2:xx", NAME="lan3"
   SUBSYSTEM=="net", KERNELS=="0000:00:14.2", ATTR{address}=="00:08:a2:0c:b2:xx", NAME="lan4"
   SUBSYSTEM=="net", KERNELS=="0000:00:14.3", ATTR{address}=="00:08:a2:0c:b2:xx", NAME="lan5"

3. Only for Jessie (and lower?): remove the existing udev rules in /etc and prevent the file generation on next reboot.

   echo "# disable net-generator rules in /lib/udev" > /etc/udev/rules.d/75-persistent-net-generator.rules
   rm /etc/udev/rules.d/70-persistent-net.rules

4. Adapt interfaces list (specific to your installation).

   vim /etc/network/interfaces

   [...]
   allow-hotplug eth1
   iface lan1 inet dhcp
   [...]

5. Reboot

   reboot

6. And check results.

   ip a

7. Check the correspondence between NIC label and physical label.

   tail -f /var/log/syslog | grep kernel

   Connect and disconnect (physically) and check the corresponding line.

   [...]
   Oct 30 10:11:50 3540 kernel: [  129.120407] igb 0000:04:00.0 lan0: igb: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX/TX
   Oct 30 10:11:52 3540 kernel: [  131.774607] igb 0000:04:00.0 lan0: igb: eth0 NIC Link is Down
   [...]

8. If you have some trouble, you can add log.

   vim /etc/udev/udev.conf

   udev_log="debug"

   But don't forget to remove after your fixing.

I've made some tests with debian 8 and i encounter this problem:
If i comment 1 line in udev rules (for example eth4), eth4 retrieve his old default name (eth2) and eth2 get the name “rename”. In this case, eth2 physical become eth4 and this is unsafe. For preventing this (and preventing a wrong naming when an interface is out of order), interface name is vlanX.
If i comment the vlan4 line in udev rules, vlan4 (eth4 physical) become eth2, but vlan2 stay vlan2 and eth4 physical simply doesn't work because /etc/network/interfaces doesn't content ethX declarations.