That doc is a bit old really. Loading AES-NI by itself is better in anything after 22.01. The BSD crypto device is not used by anything usefully from that point on. OpenVPN (OpenSSL) will use AES-NI directly if the CPU supports it OpenVPN with DCO enabled will use it with the AES-NI module loaded as will IPSec.
And yes anything with QAT support should use that instead.

Steve

@hescominsoon You might want to consider tnsr first and then breaking down past that for the firewall needs.

Beyond that you might want to think about overall throughput. 1700 units over 10g is about 6mbps per location. You're talking about giving residents 8x that throughput - you will hit congestion at times, possibly very often.

@fsc830 @rcoleman-netgate thank you for your answers. I just opened a ticket to Netgate support.

@ggilley FWIW, I've used the QNAP QSW-308-1C with the unified RJ45/SFP+. That worked, and so did the Planet Technologies XT-705A.

I've also tried the UniFi Flex XG, and that didn't work. For some reason the ATT router didn't want to passthrough or assign an IP, but I could manually assign an address on the subnet (vs passthrough).

The other thing to be mindful of, performance compared to the on-router speedtest. The HUMAX router seems to lose about 300Mbps, and then the media converters may lose a bit too.

Another FYI, unlocking x710 for any SFP+ module

https://forums.servethehome.com/index.php?threads/unlocking-any-brand-sfp-modules-on-intel-x710.29040/

unlocking x520 for any SFP+ module

https://forums.servethehome.com/index.php?threads/patching-intel-x520-eeprom-to-unlock-all-sfp-transceivers.24634/

Follow up with what kind of performance you get. I've noticed all sorts of variations with different equipment. It's hard to say what's best, even though they all sync on the AT&T side.

Great result. The MAC addresses you have there should be sequential and I don't believe they were. If you don't see sequential MACs in pfSense you might want to open a new ticket with support and get the full set of uboot envs for your specific device to be sure.

Steve

@rcoleman-netgate said in Factory Reset or Corrupted Image:

In this system it does not do a FR at all, just a system-level reset like you'd find on a desktop PC

So, it's like the power cord : a perfect way for totally messing up the disk file system.

@voltron7552 : every time you reset the device with that button, or the power is removed witthout doing a user initiated power down using the GUI or console SSH access, option 6, run asap this : How to Run a pfSense Software File System Check (5/2020)
This is not optional.

@keyser This is a specific issue with FreeBSD, not specifically a pfSense issue. There are a number of things that the FreeBSD core OS isn't capable of at the moment but are moving towards so hopefully in the coming years some of those things might be.... more capable?

Got a long enough SFP+ DAC cable to try, and it works fine between the 1537 and FS.com media converter.
So the failure with using 10GBASE-SR must just be some auto-negotiation issue with those SFP+ modules, that only occurs with the media converter setup.

There have never been CE images for any ARM platform and there are no plans to do so. Nothing has changed there.

However you could upgrade your VMs to Plus if you want them to all be running the same version. There's no issue with running a mix of CE and Plus installs though.

It could be argued that the differences between ARM and x86 are larger than those between Plus and CE so it may not make much difference in that respect.

Steve

Simply rebooting is often what shows up some long standing problem. It's why we always recommend rebooting before running an upgrade. Many firewalls only ever get rebooted at upgrade but that's when you're most likely to see a hardware failure and if you don't test that it looks like a problem with the upgrade.

Steve

@stephenw10 Thanks a lot, everything is up and running on latest version

an additional question to this post: does anybody know what the definition of "small", "medium" and "large" business is? in all recommendations from netgate they define it in this scale but I was not able to find a hint where they explaine what they think that small, medium and large is?

Mmm, that should have been clear when we issued the RMA.

Please let me know if you still have questions or if we have a hole in our process that needs attention.

Steve

Mmm, as far as I know this is the first report of it we've seen.

The 3100 has a switch but it doesn't use a lagg or vlans by default. Only the 7100 does that.

Steve

No, shouldn't be if it's set to the 'Latest stable' branch in System > Update.

You can turn it off by running: pfSense-led.sh update 0

Steve

Yeah, it still checks against available kernel memory:
https://github.com/pfsense/pfsense/blob/master/src/usr/local/www/system_advanced_misc.php#L356

That could probably be removed with tmpfs there but it's only a significant restriction on arm32 and limiting ram disk size there is not terrible anyway.

https://redmine.pfsense.org/issues/13508

Steve

Nice recovery!

The ECL should work in a VM if it sees a mounted USB drive (daX). We have seen issues on faster machines, or slow USB drives, where it fails to mount before the ECL runs. I could imagine you might be hitting that in a VM.

Steve

@creationguy Temps are what i have as well. Mine was in an open rack in an open basement and i would get around 53. I have the 6100 and the temps are the exact same.

That's the maximum forwarding performance across all interfaces combined. That's also without filtering which is the biggest overhead you will hit there. 2Gbps is low though. I'd expect to see 3-4Gbps at least. There are a lot of variables there however.

I didn't have a chance to test the 10G port directly yet. I do have a new workstation that can test at those speeds far more easily so I should be able to get some numbers soon.

Steve