I am now wondering if I have enough compute for that environment in the Optiplex, or whether I should bite the bullet and buy a Netgate 3100 to be sure. This really isn’t hurting me at the moment, since I have a family of five sitting behind the firewall and no one complaining of slow performance, but I will be moving a production environment of 24 end users behind a pfSense firewall in the next couple of months, and I had planned to install pfSense on an old Optiplex 7010 SFF with 8 GB of ram and a quad core i5 to do that. This is perplexing to me since the processors never seem to indicate more than about 30% usage for more than a few seconds, the RAM seems similarly taxed, and as far as I can tell, the little firewall/IDS never pages anything to swap. My “problem” is that pfSense running on this hardware seems to be passing no more than about 640 Mbps (of an available 970 Mbps) through the firewall/IDS. ( I am not sure if I am actually using these in 64 bit mode since if I run sysctl -a | grep -i, I can see the follwing : “:32”, which leads me to believe I may have missed a BIOS setting and might be running in 32 bit mode, or some compatibility mode that defaults to 32 bit). I have kind of a corollary question/issue for non-netgate hardware pfSense users to what extent does the processor(s) actually inhibit bandwidth throughput? I have been running pfSense/pfBlocker/Suricata on a dual homed HP thin client with AMD G-T56N dual core processors running at 1.6 Ghz with 4 GB of RAM. For home use, it can do everything as long as you have the ram to match it.
I’m not going to lie, I’m a huge fanboi of the i310100 for routing. The i3 is solid, encryption causing the cpu to roll along at 40%. But interesting the C3758 is nearly maxed out (cpu usage at 94%) when it’s on the download side. Now I get close to 900 mbps in both directions. Turns out the solution was, as you suggested, setting Crypto Hardware as: AES-NI CPU-based acceleration. Equivalently configured, the Protectli is $150 less ($546 vs $699), and its CPU is nearly twice the power ( vs … For example, compare the Protectli FW6C (CPU: I5 7200U) vs Netgate SG-5100 (CPU: Atom C3558). Still trying to figure out how to maximize ipsec throughput, and it seems that perhaps Protectli hardware is a better bet than Netgate. Protectli vs Netgate hardware Networking & Firewalls
0 kommentar(er)
