Getting a serial console working on the first serial port (uart0/COM1) is simple and works as per the instructions (https://docs.opnsense.org/manual/how-tos/serial_access.html#connecting-to-the-serial-console).
On some servers the second serial port is the one that redirects to the BMC so if you want the console available via SSH to the BMC you have to use the correct port.
Getting a serial console working on a different serial port is less obvious, but quite possible and can be done entirely from the web GUI.
Find Serial Ports
firewall:~ # dmesg | grep uart
uart0: <16550 or compatible> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
uart0: console (115200,n,8,1)
uart1: <16550 or compatible> port 0x2f8-0x2ff irq 3 on acpi0
uart0: <16550 or compatible> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
uart0: console (115200,n,8,1)
uart1: <16550 or compatible> port 0x2f8-0x2ff irq 3 on acpi0
This shows two serial ports, uart0 with base address 0x3f8, and uart1 with base address 0x2f8 which is the one I want because it redirects to the BMC shell.
Test Serial Port
You can check you've got the correct one by connecting to and then starting a getty on it from a separate root shell on the firewall, e.g.
/usr/libexec/getty 3wire.19200 ttyu1
Adjust the speed (19200 in this case). Search /etc/gettytab for '3wire' to see available speeds.
If you need to restart it to try a different speed or whatever, kill the getty with
pkill -f 'getty.*ttyu1
Configure Serial Port For Console
To use the serial port at uart1, make a note of the base address from the dmesg output then go to System: Settings: Tunables and add two new tunables, adapting the base address and speed to match your hardware:
Tunable hw.uart.console
Value io:0x2f8,br:19200
Description Use second serial port as the serial console for redirection to BMC
Tunable comconsole_port
Value 0x2F8
Description Force serial console to use second serial port
Connect to the relevant serial port and reboot the firewall to make sure it's working as expected. The settings are boot-time and 'm not aware of a way to apply it without a reboot.