@InstanceExtension said in PSA: Do not attempt Intel NVM Updates on NICs embedded onto Supermicro MBs:

Patrick Kennedy February 7, 2023 At 9:41 am

Ok, understood - these 2 interfaces are hanging off OpenFabric rather than PCIe - so not exactly short of bandwidth then!

☕️

Just to be clear the workstations using a VPN are using the OpenVPN link on firewall? Rather than VPNs from each workstation directly?

@sjstein There are a few, I've used https://docs.netgate.com/pfsense/en/latest/monitoring/graphs/bandwidth-usage.html#bandwidthd. If memory serves it only works on one interface.

@stephenw10 I have the cron job for it set to scrub once a month.

In general those NICs are compatible. If you're running Proxmox though it has to be compatible there.

Yes we need to know the total bandwidth the firewall will be required to pass. And if you're using VPNs what bandwidth does the VPN have to pass. All of it? Just for remote access?

Probably.

It's not ideal though. Intel NICs are better supported in general. Raid controllers can be an issue, it's almost always better to disable them and use a ZFS mirror instead if you need raid.
The graphics hardware should be irrelevant.
It's probably massively overpowered for a firewall!

If it supports FreeBSD pfSense will run there. I don't see that listed but it's probably just untested.

Steve

I bought a usb to ethernet adapter (two actually) set it to a simple static IP like 192.168.1. 40/24. Pfsense couldn't ping my connected laptop (192.168.1.41/24) and my laptop couldn't ping pfsense. Verified cables were good, both devices could ping THEMSELVES, even switched usb to ethernet adapters and verified mac addresses were seen using arp -a. But, still no pings.

So, from the menu i did a reset. And reconfigured pfsense to be the DHCP server and use the usb to ethernet adapter interface. BINGO, i can ping back and forth. I can also access the gui!

Over first hurdle, now find out how to upgrade to Plus.

Thank you for your help guys/gals.

First check the system logs for watchdog timeouts from the Realtek driver.

If you do see those you can try the alternative re(4) driver.

Steve

Had you connected to the console before?

What do you see when you try to connect to the console?

You're going to need a functioning serial console connection to either recover it or to reinstall clean.

Steve

Yup, you could certainly do that. Though I would personally choose any other hypervisor.

But I would test FreeBSD 14 on it bare metal if you can. If it throws the same panic there we can open an upstream bug for it.

Steve

Yes, only the x550 supports N-baseT like that.

@stephenw10 Thanks for the info. I only have a low profile expansion slot available on my pfSense box. I found a low profile bracket on the popular online auction site and got it for a few bucks, then I can try it once it comes in the mail. FWIW Amazon lists it as a currently available product priced at $676 (!) so there might be support for it.

Make sure the IP it's giving you is not conflicting with any other subnet on the firewall.

@mercer2 Super cool router that you bought. That is absolutely my dream router. Hows it been treating you? Did you get the speeds you were expecting?

It's only for a SIM card.

Those are not errors or even warnings. Those are messages from the boot log showing the timecounter hardware being detected/initialised:

Nov 10 10:41:17 kernel Timecounter "ARM MPCore Timecounter" frequency 12500000 Hz quality 1000 Nov 10 10:41:17 kernel Event timer "ARM MPCore Eventtimer" frequency 12500000 Hz quality 1000

Both the 1100 and 2100 show that as they share the same SoC.

Steve

Mmm, that does seem suspicious. I would normally expect a higher result when testing from a client behind the firewall. Unless that client itself is restricted.

You can see that in both cases no single core is maxed out. But when testing from the firewall directly the load created by iperf itself is larger than anything else.

@brad73435 said in Hardware upgrade question.:

can I use the saved configuration from the old system?

Yes. You can usually import the config and simply re-assign the interfaces but we can also convert the config for you to import directly if it's something more complex.

Steve

It didn't want to identify in my server so it got pulled and will try it in my desktop instead.