@viktor_g Thanks. What's the ETA for this to be included in an updated Suricata package?

@r0bb10 Thank you very much for your guide.

I'll see if I can locate a e3372h stick and give your procedure a spin :-)

@rlmajor2k9 said in Lost internet access after Xfinity Reboot...:

can ping to 8.8.8.8.

Specifically when sourced from the LAN?

There are two reasons why you might not be able to connect out when pfSense itself can. Either there is a bad default route (or none) or no outbound NAT. Pinging from the LAN IP should test both those things.

Check the routing table in Diag > Routes. Make sure a default route exists and is correct.

Steve

NetGate would score a big win in my books if they make a product that's between the 5100 and 6100 with;

A minimum of 4 regular RJ45 LAN ports (1/2.5GB) 2 LAN ports in 1/10GB SFP+ 2 WAN ports in both RJ45 (1/2.5/10GB) and SFP+ in 1/10GB

Same Case or form factor as the 6100 or 5100

NetGate please make it happen....

With that many VLANs I would be editing the config manually as you did. What exactly did you do?

The SG-4860 is all igb NICs and the 6100 has none so they would all need to be changed.

If you want you can open a ticket with us and we can convert that config for you:
https://www.netgate.com/tac-support-request

Steve

I can live with that. Thank you.

Not on the built-in interfaces, no. They are 10G/1G only.

Steve

Ok, well what do you see? Can you post the logs so we can review?

@stephenw10 thanks for the answer

Thank you for the clarification and technical insight. I will put this device in a different spot that does not rely on transmitted VLAN tags.

@gerald26500 said in Netgate 6100:

@keyser Oh man , I feel so stupid.
Il all FW rules I had IPV4 TCP ... instead of IPV4 *
so all good now
I really appreciate your help though !
Thanks!

😂 Those things happens to all of us. As Long as it works as intended all is good👍

It could. Potentially. But, as I said, it would very easy to end up with some asymmetry and the unexpected blocking that brings with it.

Steve

Hi again,.. just reading through previous posts re: ADVA's and 1G sm connetivity.. As it happens I have had repeated success with with media convertors (as have many I'm sure) but thought I'd mention it here as a possible help to others.. With 6 ADVA's, all 1G SFP presented (and different providers) I have used these to succesfully connect: 4b96af75-b8b8-433a-a4d2-e30ec2dc2450-image.png

I did try the Mikrotik SFP in the 7100 for a direct connection to ADVA.. but no joy...

Pricing is good for the kit too... as I mentioned it has worked very well over past 3 years (when first went in) on 6 sites with 1G SFP ADVAs...

@stephenw10 said in Proper steps for ZFS pave & (re)install on 6100:

The biggest advantage is that ZFS is a more robust file system. If you are installing somewhere that power cannot be guaranteed you are far less likely to have file system damage issues caused by outages.

Steve

Sounds good. I guess it'll be the first thing I'll do after receiving my unit.

The 3100 cannot run ZFS usefully, it's not available in any current installer.

Is that unit somehow actually running ZFS?

If so you should definitely re-install 21.05.2 clean. Or wait for 22.01.

Steve

I have some generic LC BiDi modules I use for testing that work in the 6100.

In the combo port the PHY is wired to be 1G only so they don't show as fibre:

[22.01-RC][admin@6100-2.stevew.lan]/root: ifconfig -vvm ix2 ix2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 description: WAN2 options=8138b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,WOL_UCAST,WOL_MCAST,WOL_MAGIC,VLAN_HWFILTER> capabilities=f53fbb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,WOL_UCAST,WOL_MCAST,WOL_MAGIC,VLAN_HWFILTER,VLAN_HWTSO,NETMAP,RXCSUM_IPV6,TXCSUM_IPV6> ether 90:ec:77:0f:74:44 inet6 fe80::92ec:77ff:fe0f:7444%ix2 prefixlen 64 scopeid 0x7 media: Ethernet autoselect (1000baseT <full-duplex,rxpause,txpause>) status: active supported media: media autoselect media 10baseT/UTP media 100baseTX media 1000baseT nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

In the 10G SPF port it shows as:

[22.01-RC][admin@6100.stevew.lan]/root: ifconfig -vvm ix1 ix1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 description: IX1 options=8138b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,WOL_UCAST,WOL_MCAST,WOL_MAGIC,VLAN_HWFILTER> capabilities=f53fbb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,WOL_UCAST,WOL_MCAST,WOL_MAGIC,VLAN_HWFILTER,VLAN_HWTSO,NETMAP,RXCSUM_IPV6,TXCSUM_IPV6> ether 00:08:a2:12:17:7f inet6 fe80::208:a2ff:fe12:177f%ix1 prefixlen 64 scopeid 0x6 inet 192.168.79.2 netmask 0xffffff00 broadcast 192.168.79.255 media: Ethernet autoselect (Unknown <rxpause,txpause>) status: active supported media: media autoselect nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> plugged: SFP/SFP+/SFP28 1000BASE-LX (LC) vendor: OEM PN: SFP-GE-BX03-U SN: NV20200713016 DATE: 2020-07-14 module temperature: 29.84 C Voltage: 3.32 Volts RX: 0.17 mW (-7.60 dBm) TX: 0.08 mW (-10.57 dBm)

Steve

@keyser said in Symmetrical gigabit and performance of the Netgate 6100:

I upgraded to 1000/1000 and the SG-2100 topped out at about 640'ish Mbps (no inspection/monitoring).
So I have just upgraded to a SG-6100 and it handles the 1000/1000 effortless with thousands of sessions, suricata (lot of rules) and ntopNG running. There is definitely room for a lot more throughput in it. My guess is it would handle 2.5Gbit under these circumstances as well.

Superb. Exactly what I was looking for. Thank you!

@styxl As always you can simply import your config, follow the guide and reassign your logical interfaces (WAN. LAN, OP1, OPT2) to the desired physical interfaces in the SG-6100 (Igc0-3 and ix0-3)

Indeed there is no switch in the 6100 all it's interfaces are discrete NICs.

The additional LAN interfaces should already be assigned so just enable them and assign a static IP/subnet. Then enable dhcp on the interface if you need it and add firewall rules to pass traffic as required.

Steve