Slow upload speeds on HP Z2 G9 PFSense Box

[Bear]

@stephenw10 It’s not testing okay from PFSense to the WAN side. The up speeds are diminished. The up test isn’t long enough to show the speed drop. And even then, it’s still significantly lower.

Getting rid of the bridge is a non-starter. I’ve got a complex setup with multiple physical network segments on the same subnet that have rules for accessing each other. It’s the primary reason I’ve been using pfsense since it was Mon0wall. I can’t spent 8+ hours trying to figure out how to make this all work and rewriting firewall rules just for another data point when none of the other data points have yielded any actionable remedial suggestions.

The only things I’m left with are maybe my transceiver works on the 6100 but not the X520 for some reason. So I’ll either try another transceiver or try a x710-based copper NIC instead of the SFP+ based one as the 710 supports NBaseT.

[stephenw10]

Well in your earlier tests you were seeing >1Gbps from pfSense to the external server but you said you were still seeing ~400Mbps from a client behind it. Is that not the case?

The actual value of the upload from pfSense directly is never accurate, especially it high values. But it's a useful test when it returns above the throughput throttle.

Even if you need a bridged setup it would still be useful to run a test without the bridge. If that doesn't show a restriction then there is clearly something in the bridge config causing it. In which case we can dig into that. Though there's not much you can set there,

[Bear]

@stephenw10 I was seeing 1.4Gbit from the client behind it that, over time, tapers down to 450-700Mbit. On the 6100, same setup, seeing 2.2-3.5Gbit steady, depending on time.

[stephenw10]

Well if I was testing that I would still repeat that test with a very basic setup, no bridging.

However that seems to imply a WAN side issue so if there are no errors I'd look at the sysctl mactstats for the WAN NIC for anything that is getting exhausted without throwing an actual error.

Checking the output of netstat -m during the test might also be interesting.

[Bear]

@stephenw10

This is a production network with active users. I can't just "turn off bridging."

I'm going to try a different transceiver/chipset to see if that has any impact, and then try a 710-based copper NIC after that to completely avoid using a transceiver if that's not successful.

I don't see why the bridge itself which has worked fine on the 6100 would suddenly be the root cause of issues with the i5 system.

[stephenw10]

@Bear said in Slow upload speeds on HP Z2 G9 PFSense Box:

I don't see why the bridge itself which has worked fine on the 6100 would suddenly be the root cause of issues with the i5 system.

Me either. I'm not aware of any specific issue that would present like this. But I've seen many issues with bridged interfaces behaving unexpectedly.

Can you connect a local iperf server to a different NIC/interface so you are routing it and test to/from that?

[Bear]

@stephenw10 Yup - I can try that, though it would be on a different Intel NIC. Same IX driver though. - An X550.

I'm not using the X550 for the WAN as it doesn't support multi gig, at least not under FreeBSD from what I gather. The X710 should. More data tomorrow. :)

[stephenw10]

The X550-T does support 2.5 and 5G. It's one of the few NICs that does. But I assume you have the SFP varient? If you module works in the X710 and X553 I would expect it to work there too.

But it should also be a good for a local test at 10G.

[Bear]

@stephenw10 My X550-T2 is only connecting at 1Gbit when I plug it into my RG.

HOWEVER, when I do use a port on the X550-T2 that's part of the bridge, connected to WAN, I floor my 1Gbit connection on both up and down speeds.

Is there anything I need to do in order to enable NBaseT mode on the X550-T2?

[stephenw10]

You might need to set a fixed speed. Or set the advertised rates for auto-negotiation to 5G on using the sysctl:

[admin@8200-2.stevew.lan]/root: sysctl -d dev.ix.0.advertise_speed
dev.ix.0.advertise_speed: 
Control advertised link speed using these flags:
	0x1 - advertise 100M
	0x2 - advertise 1G
	0x4 - advertise 10G
	0x8 - advertise 10M

	0x10  - advertise 2.5G
	0x20  - advertise 5G

	100M and 10M are only supported on certain adapters.

It's possible it has an old firmware.

I would expect it to link at a higher rate if the connected device advertises it.

[Bear]

@stephenw10

Great News!

I added a system tunable

login-to-view

Using a port on the X550.

After applying, I got a physical 5Gbit Link to my BGW320.

Now, running speed tests, I'm doing better than I ever have:

login-to-view

So it appears that there's something going on with the FS Transceiver. I did try a 10GTek, and while the up-speeds were better, they were nowhere near what I'm getting presently.

So, I'm concluding that these transceivers can be iffy, at least with a BG320.

I think the most sane thing to do now, since I need 4 ports on this bridge, would be to install a second X550T2 into my PFSense Box and replace the X520, since this seems to be working.

Can I get you the new Netgate ID after I do that switcheroo to make sure I keep my registration?

I'm glad it ended up not being a filtered bridge thing, and was just strange transceiver behavior.

[stephenw10]

Wow, nice result!

I guess the X550 just wasn't advertising 5G as a link option previously?

Yeah, transceivers an be odd. But usually they fail in the 6100 because the X553 is missing the data lines to read the link speed. Here that appears to have actually helped.

Yes, let me know when you have the final NICs in place and we can fix you up.

[Bear]

@stephenw10 said in Slow upload speeds on HP Z2 G9 PFSense Box:

Wow, nice result!

I guess the X550 just wasn't advertising 5G as a link option previously?

No, it wasn't. I tried running Intel's Firmware Update utility, v.3.70, and it said that there was nothing to update. After adding the system tunable, though, it connected just fine. I've verified it persists through reboots.

Yeah, transceivers an be odd. But usually they fail in the 6100 because the X553 is missing the data lines to read the link speed. Here that appears to have actually helped.

That's what's strange. I suppose I'd recommend an FS transceiver for the 6100, but only the 6100. As the FS Transceiver was crap otherwise.

Yes, let me know when you have the final NICs in place and we can fix you up.

Will do - I'll get it to you Sunday - Likely going to down everything and do the swap and reconfigure then.

Thanks for helping walk me through this - It was EXCEPTIONALLY frustrating, expecially for a system that's this..overbuilt. It should have enough power to run a high speed filtered bridge + Suricata + OVPN :)

[Khna01]

This post is deleted!

[Bear]

@Khna01 Thanks for the response :) - The root cause was a SFP+ to multigig transceiver. I'm going to move to an all copper setup, since my BGW320 is using NBaseT 5Gbit copper, and I've got shared SFP+/copper ports on my local switch. ATT's confirmed their 10GBit service will use copper as well, so it'll hold me for a while.

[Bear]

To close this out, installed a second X550-T2 - The system didn't even need a network device reconfiguration since the network device driver was identical (though my Netgate ID changed - DM'd @stephenw10 to update that on Netgate's end).

Here's my final config:login-to-view

Everything works perfectly. With the CPU power set to ultimate efficiency, while hammering it with speed tests, I only get to 12% CPU usage. If I set the dial to midway between Perf and efficiency, I can't crack 4%. Haven't tried full perf mode yet.

Nice to know I've got power to spare in case I decide to start running more services on the box.

There are likely more efficient ways to set this up, but this works perfectly for my setup as-is. I'll likely move to using VLANs when I do some HW replacement later, but there's no rush.

[Khna01]

This post is deleted!