4100/6100 Base or Max
-
Hi folks,
I decided to go with a 4100 or 6100, but am a bit puzzled by Base or Max and 4 GB RAM (4100) or 8GB RAM (6100).#1 Base or Max: logging?
Netgate recommends the SSD (Max version) for logging packages.
So even if I would like to do some logging, would 16GB storage provide enough space for let's say 5 users / 30 devices?#2 4100 vs 6100
The 6100 is only 200 more. So I could choose the 6100 and have some more leeway and keep things cool, which benefits life span.
Furthermore, it's 8GB RAM vs 4GB and 4cores vs 2. When would I require 8GB of RAM vs 4?Our network has 5-10 users, 4 switches, 6 AP's, 30 client devices. Currently running pfBlocker, Avahi, OpenVPN (just for GUI access, not to "work from home").
Pete
Home: SG-2100 + UniFi + Synology. SG-1100 retired
Parents: SG-1100 + UniFi + Synology
Testing: SG-1100 w/ 120GB SSD via ext USB (eMMC dead). Works great -
@Cabledude
My personal opinion; stay away from anything with eMMC storage.My first Netgate appliance was an SG-5100 with the std 8GB eMMC. I got less than 2 years of service before the storage went EOL and bricked the unit. At that point it was too late to upgrade to a SSD since the unit would not boot due to the failed eMMC. Granted, I was new to pfSense at the time, and didn't know that I was rapidly burning through the storage by over-logging, etc.
I replaced the failed SG-5100 with a 4100-MAX. I am also much more aware of storage usage now...
-
@Cabledude the number of users is almost irrelevant. How many MB of logs per day is what you’re asking and that depends on so many things.
Netgate’s package list is here, note the right column for SSD recommendations: https://www.netgate.com/supported-pfsense-plus-packages
We have a bunch in service for us and clients and have never had an eMMC write life problem. Our logging is also way lower than others have posted here. For instance we turn off logging of the default block rules, can always turn that on if needed. We also started using RAM disks a couple years ago.
8GB RAM is more [useful] for very large tables, pfBlocker lists, larger RAM disk storage, or similar. We have small RAM disks in 3100s with 2 GB RAM though and it’s fine for our needs.
What is your connection speed?
-
I have the 2100-MAX with the expanded SSD works like a champ. I abuse it I have Squid, Squidguard, lightsquid, authenticated NTP server running, Snort IPS/IDS, SSL certificates, both SSL intercept and transparent mode is running, Clam AV, both layer 2, 3 filters running, static IP mappings, content acceleration running, I have my DNS resolver
running over port 853 and it's set running resolving A records only. A trained atack Service watchdog package, I use to run NUT ups package, It's a tank, I have been testing it for some time now. It's impressive. I have an external AP running with 12 or so devices, again not all at the same time. I even run traffic shaping with Codel queus.I report any and all bugs I can find, I comb the thing with config changes all the time. The forum and support team is amazing.
I can recommend it only if you use the cache and want the proxy to cache running. It will fill up my allotted space I have set aside for it and start to delete the old items.
pfSense makes amazing software.
Still some bugs with OS fingerprint identification ACL rule matching
But my SSD they installed from the factory is a
champ.It's even got cloud based backups that auto run.
Works great no issues. Also software has been upgraded a few times already.
Fyi I also turn off logging for most of the rules once it's set the way I want.
I wish it had 8GB ram is all.
-
@JonathanLee thank you for sharing and that is an impressive list. How is your CPU usage? The 2100 that you run basically has the same CPU as my 1100 but my units do get quite hot.
Pete
Home: SG-2100 + UniFi + Synology. SG-1100 retired
Parents: SG-1100 + UniFi + Synology
Testing: SG-1100 w/ 120GB SSD via ext USB (eMMC dead). Works great -
@SteveITS said in 4100/6100 Base or Max:
We also started using RAM disks a couple years ago.
Yes I used to have RAM disks even on 1985-ish windows boxes. Didn't know you could create those in pfSense. So you use the RAM disks for logging only, to alleviate reads/writes on eMMC?
8GB RAM is more user for very large tables, pfBlocker lists, larger RAM disk storage, or similar. We have small RAM disks in 3100s with 2 GB RAM though and it’s fine for our needs.
What is your connection speed?
We have 200/40 cable now, we will soon have 500/500 fiber but as the Netgate team writes "pfSense / Netgate grows with you": the 4100/6100 is serious equipment and what I buy today is not meant for just 2-4 years and should easily go to gigabit fiber. However 95% of the time our internet bandwidth usage is lower.
-
@Cabledude It is great the only time I see it MAX out on it is on system start up, reboots. Snort rebuilds take up some CPU and ram when that occurs too.
Its warm on the bottom I have it elevated with a older cooke tray that fits right into my wooden side table perfectly, so it's good good airflow.
This is it running with my son playing roblox right now on the xbox one.
I am running a Cortex-A53 and it does have some AVX-512 instruction set commands on it. I just learned about AVX-512 (Advanced Vector Extensions) while taking an intro to assembly code class recently.
ARM = Advanced RISC Machine (WE USE THIS WITH THE 2100)
RISC = Reduced Instruction Set Computer
CISC = Complex Instruction Set Computer Older NASA VAX systems use to CISC, they could do anything with assembly code it had so many instructions (VAX was huge in 1990s)
It is impressive to see this processor run with some good code like pfSense.
-
@Cabledude
https://docs.netgate.com/pfsense/en/latest/config/advanced-misc.html#ram-disk-settingsIt can be set for /tmp and/or /var. it doesn’t preallocate memory. On ufs it’s a bit safer upon power loss. One can lose logs etc upon power loss. Of course don’t run out of space, check your usage first before setting it. Very large pfBlocker lists or heavy logging can take up lots of space. It does take a reboot to change.
Either should be ok for that speed. If you were going to use Suricata or something that scans packets the 6100 would have more CPU headroom at gigabit.
-
@Cabledude said in 4100/6100 Base or Max:
#1 Base or Max: logging?
If 'logging' is on your list, then you should already have some network syslogger available on one of your LANs, and you've chosen to use an external log storage.
'logging' means : you want actually look at the logs, use them for post mortem analyzes, like knowing what happened when things went bad.
Checking log files is a good thing, although time consuming. You might as well make your live more conformable while doing so.
Know that pfBlocker is using it's own log files - here : /var/log/pfblockerng. These are handled by pfBlocker, and not send over to some remote syslogger. So, if you plan to use pfblockerng, just forget the nvme drive right away. Go for SSD direct (MAX).Also, a bigger drive means : you can use, even abuse, the snapshot ZFS facilities.
Btw : I use a 4100 MAX over a close to 1 Gbit/sec symmetric connection, about 30 local devices and about 10 or so active captive portal users (hotel here) and the 4100 handles that just fine. See here for some pfSense stats.
@Cabledude said in 4100/6100 Base or Max:
Our network has 5-10 users, 4 switches, 6 AP's, 30 client devices. Currently running pfBlocker, Avahi, OpenVPN (just for GUI access, not to "work from home").
That's what I use. I've added FreeRadius for authentication, because why would I do things the easy way if much harder is available ?
I also use some quality of live packages like acme, Notes, nut, ShellCMD, Cron.No "help me" PM's please. Use the forum, the community will thank you.
Edit : and where are the logs ?? -
@Gertjan or log with a security onion box.
-
@Gertjan said in 4100/6100 Base or Max:
Hi Gertjan thank you for your reply, interesting stats pages. Your CPU % usage looks a lot like mine and I have an SG-1100, but it does get quite warm.
Please note that the increased CPU starting around midnight is when I activated pfBlocker. It's a fairly basic config:
IP - IPv4:
IP - Geo:
DNSBL:
The reason I want to get a 4100 or 6100 is that the 1100 just doesn't seem to cut it. It gets very hot occasionally, I did have some issues such as WAN outages and DHCP missing gateway advertisements. Even the 4100 seems heavy for my network, but I feel the 4100/6100 may be more future proof than the 2100.
So, if you plan to use pfblockerng, just forget the nvme drive right away. Go for SSD direct (MAX).
That is quite a statement. Is this because you feel the eMMC is written to extensively by pfBlocker alone?
-
@Cabledude pfBlocker in DNSBL mode I believe by default is set to log all blocks. You can turn that off. Without that it doesn’t use much disk.
If you are largely using your existing configuration, use https://docs.netgate.com/pfsense/en/latest/troubleshooting/disk-lifetime.html to see what your current wear is on your eMMC. Then factor in new packages.
I believe both the 4100 and 6100 are passively cooled like the lower models.
The 1100 may not quite do 500/500 because it is one switch and VLANs to isolate ports.
-
@JonathanLee said in 4100/6100 Base or Max:
@Cabledude It is great the only time I see it MAX out on it is on system start up, reboots. Snort rebuilds take up some CPU and ram when that occurs too.
I am genuinely confused after letting it rest for a couple of weeks and after re-reading your posts. Could the 2100 prove to be adequate for my needs is what I am tinkering about now.
Its warm on the bottom <...> it's good good airflow.
Warm on the bottom is not preferred, too warm is a. no-go. Of course any device gets a little warm just by having it powered on for a while. The 4100/6100 heatsink is considerably heavier than the 2100's so it should stay cooler and be more long lasting.
And I am looking for some leeway to keep things cool, guaranteed. But the 4100/6100 cost around double and consume about triple the energy.
This is it running with my son playing roblox right now on the xbox one.
I also use 7 VLANs and I have about 40 static DHCP v4 mappings.
It is impressive to see this processor run with some good code like pfSense.
So yes. I'm sold on pfSense, that is for sure.
All input considering, the 2100 Max appears to be adequate, the 4100 Max will do the job quite easily and the 6100 Max would be more than I ever need. So the 4100 is probably the obvious choice...
-
@Cabledude said in 4100/6100 Base or Max:
So the 4100 is probably the obvious choice...
And get the MAX
I've one and you win some very nice feature : No more 'disk space' issues.
You can go wild with the logs.
Install snort and forget about for many days, or weeks, before your system comes down crashing on you because the 'drive is full' (with the standard 4100 this will be a matter of hours ... and you have the 'log management doesn't work' issue)
You can create a lot of ZFS "System > Boot Environments", so, before adding a package, upgrade pfSense, make a snap shot. If there is just one issue : two clicks and your back using a working router.Also : I hope I'm telling your BS now : the 4100 is an Intel device. The 2100 an arm. So, yes, it runs hotter. So, yes, the arm - 2100 will be more greener ;)
If I have the choice, I would go for an Intel device.I never looked in my 4100 (a bit hard to open) but I presume the bigger MAX version NVME drive is easier to replace.
And lasts longer ...as it is a bigger drive so more choice to overwrite cells before failure, because more memory. -
Hey @JonathanLee I was debating 4100/6100 but after reading your posts the 2100 Max is in my shopping bag waiting for me to pull the trigger.
A huge pro for me is low energy cons. (5W)
But I have two big doubts still, hope you could think along.@JonathanLee said in 4100/6100 Base or Max:
I have the 2100-MAX with the expanded SSD works like a champ. I abuse it I have Squid, [...] It's a tank, I have been testing it for some time now. It's impressive. I have an external AP running with 12 or so devices
I have around 40, not all at the same time
I can recommend it only if you use the cache and want the proxy to cache running.
Could you please do some noob translate and elaborate? I don't understand any of this. But I don't use proxies.
I wish it had 8GB ram is all.
What would you do if you'd have 8GB?
So my concerns are:
#1. SG-2100 CPU is identical to the one in my SG-1100, which I find not very powerful. GUI dash can take 6-9 secs to load.Its warm on the bottom
Not a technician myself but I would say a more powerful CPU that keeps cool (4100) should live longer than a weak CPU that gets warm.
@Cabledude It is great the only time I see it MAX out on it is on system start up, reboots.
#2. I use pfBlocker which can whip up the CPU to 40-50% peaks. Do you use pfBlocker? I didn't see it in the list. You do use Snort which may or may not be similarly CPU hungry.
Snort rebuilds take up some CPU and ram when that occurs too.
So bottom line is I don't use very large pfBlocker lists, I probably won't use snort/suricata or ntopng. My main goal is to have a stable system which at the moment I don't have, probably mainly due to insufficient RAM.
I also went back to UFS (not ZFS) which improved stability a lot. ZFS was also too RAM hungry.@Gertjan said in 4100/6100 Base or Max:
If 'logging' is on your list, then you should already have some network syslogger available
Not really. I do care for the basic pfBlocker logs, that is what I meant when I said SSD not eMMC.
Thanks,
Pete
Home: SG-2100 + UniFi + Synology. SG-1100 retired
Parents: SG-1100 + UniFi + Synology
Testing: SG-1100 w/ 120GB SSD via ext USB (eMMC dead). Works great -
@Gertjan said in 4100/6100 Base or Max:
Btw : I use a 4100 MAX over a close to 1 Gbit/sec symmetric connection, about 30 local devices and about 10 or so active captive portal users (hotel here) and the 4100 handles that just fine. See here for some pfSense stats.
That stats page is awesome. Is this Zabbix? Care to share how you built this?
Thanks,
-
@Cabledude As alluded to above if you get the 2100 you will likely need to replace it if you upgrade to 1G fiber. From various posts here it should top out around 700-800 Mbps without Suricata/Snort.
pfBlocker shouldn't normally use CPU outside of processing lists and feeds. It basically just puts info in to firewall aliases or DNSBL lists.
re: SSD/eMMC see this list.
@Cabledude said in 4100/6100 Base or Max:
ZFS was also too RAM hungry
That's cache.
https://docs.netgate.com/pfsense/en/latest/hardware/tune-zfs.html#zfs-memory-tuning -
Thank you @SteveITS for your swift response.
@SteveITS said in 4100/6100 Base or Max:
@Cabledude As alluded to above if you get the 2100 you will likely need to replace it if you upgrade to 1G fiber.
Yes thank you for pointing that out and I am well aware of that. We have 200/40 cable atm and gigabit fiber was more future proofing than a current requirement. For what we do 500/500 would be way more than adequate.
From various posts here it should top out around 700-800 Mbps without Suricata/Snort.
That would be quite satisfying.
pfBlocker shouldn't normally use CPU outside of processing lists and feeds. It basically just puts info in to firewall aliases or DNSBL lists.
I appreciate that, but my monitoring suggests otherwise (see above post):
Please note that the increased CPU starting around midnight is when I activated pfBlocker. It's a fairly basic config
However, given you are much more experienced than myself, you are probably right and the graph points to some other process. I haven't checked the process names.
re: SSD/eMMC see this list.
Thanks, I remember seeing that page before. You may have mentioned this now to make me find out that pfBlocker doesn't require SSD, am I right? Based on the above posts I am sold on SSD though, if for nothing else I get peace of mind.
@Cabledude said in 4100/6100 Base or Max:
ZFS was also too RAM hungryThat's cache.
https://docs.netgate.com/pfsense/en/latest/hardware/tune-zfs.html#zfs-memory-tuningI studied that page. I had some erratic behaviour before on my SG-1100 when it was on ZFS. I don't know what triggered that, but someone mentioned ZFS uses more RAM so I reconfigured using UFS. The unit has been much much more stable since.
However, at a complete flash and config restore, more things get reset so it may have had nothing to do with ZFS after all. Fact is I ran ZFS and pfBlocker + some other stuff so 1GB RAM is still on the small side.
The SG-2100 is basically an SG-1100 with more RAM and more switch ports (which I absolutely don't need) so the premium in terms of unit cost seems high.
However 4GB up from 1GB just might solve all the issues I had with my SG-1100. -
I would generally recommend getting the Max for safety.
That said, if you have a UPS you can mitigate the eMMC risk by using RAM disks.
Having lost an eMMC on a 5100, I became concerned about the eMMC on my (non Max) 6100, and recently made the switch to RAM disks. The two graphs below illustrate the dramatic effect of the change:
In case you are going to ask... the dip shown for July 26-27 was checking the impact of disabling default rule and pfBlockerNG logging.
The little blips you see every 24 hours are /var/log and /var/db/rrd being copied from memory to the eMMC.
-
@Cabledude said in 4100/6100 Base or Max:
pfBlocker doesn't require SSD, am I right? Based on the above posts I am sold on SSD though, if for nothing else I get peace of mind.
It does not require an SSD, no. Everything that "requires" an SSD depends on logging. If you disable logging of the default block rules, and don't use or log DNSBL, then there's not much disk writing. Others log everything or run Suricata on web servers, etc., and log a lot of stuff.
The 2100 also has a separate WAN port instead of using the switch, and does not use VLANs, which is why it can get over 500 Mbps (500 in + 500 out = 1000). So it adds +3 GB and a NIC.
