Pfsense Nokıa IP380 Install
-
Hi,
It's atrange that all these config are not afecting the irq maping!
The question is: is it possible to force a config?Pierre do you have a running iposo? If yes do you have checked if there is some kernel option set?
Alex
-
Hi Alex
I don't have any IPSO running no more. I can provide you the full output of the bootlog I saved some weeks ago, before I installed pfSense. See the attached file: that is all what I kept. I also have an image of the disk, but it is several GB big.
Meilleures salutations.
Pierre
-
Pierre and Alex, My apologies. My hasty reading of the source code led me to misinterpret the parameters in the loader variable assignments I posted earlier. I have done some testing and confirmed I can change the reported interrupts on my system through the mechanism I have suggested (after correction of the parameters).
I haven't seen any reports that either of you have followed exactly my previous suggestions. I hope we can all pay closer attention to the details.
Lets start with the fxps:
| Device | IPSO irq | FreeBSD irq |
| eth1/fxp0 | 6 | 11 |
| eth2/fxp1 | 10 | 11 |
| eth3/fxp2 | 11 | 11 |
| eth4/fxp3 | 12 | 11 |Suppose eth2/fxp1 is in use. It interrupts on irq10 but FreeBSD thinks it interrupts on irq11 so FreeBSD will call the interrupt handler for eth2/fxp1 on an irq11 interrupt. If eth2/fxp1 interrupts then FreeBSD will call the irq10 handlers (none of which is the actual eth2/fxp1 handler) none of which will clear the eth2/fxp1 interrupt condition so irq10 interrupt will happen again and again: irq10 storm!
The following lines in /boot/loader.conf.local should fix this:```
hw.pci0.2.3.INTA.irq=6
hw.pci0.2.4.INTA.irq=10
hw.pci0.2.5.INTA.irq=11
hw.pci0.2.6.INTA.irq=12where the value of the variable hw.pci0.2.3.INTA.irq specifies the interrupt line to use for the device with PCI address (PCI domain=0, PCI bus =2, PCI device number on bus = 3). Please try this, reboot after updating /boot/loader.conf.local and verify the irqs reported in the dmesg output and the output of
vmstat -iEdit: Corrected typo in lines for /boot/loader.conf.local -
Hi wallabybob
I am really happy to read your post. You look like the first person understanding exactly what's happening here. Alex and I are more Linux men and noobs in the world of pfSense/FreeBSD.
I am ready to test what you are proposing, but I will probably not be able to do it today, because of other priorities.
I will make my file /boot/loader.conf.local look like:
hw.pci0.2.3.INTA.irq=6 hw.pci0.2.4.INTA.irq=10 hw.pci0.2.5.INTA.irq=11 hw.pci0.2.6.INTA.irq=12correcting the tipo on the last line: INTA/irq -> INTA.irq, and I will post the ouptput of vmstat -i
Regards.
Pierre
-
Hi,
I tried it but it's still not working as expected.
With the following loader.conf.local
hw.pci0.2.3.INTA.irq=6 hw.pci0.2.4.INTA.irq=10 hw.pci0.2.5.INTA.irq=11 hw.pci0.2.6.INTA.irq=12 hw.pci0.3.5.INTA.irq=13 hw.pci0.3.6.INTA.irq=15I get these results
#vmstat -i interrupt total rate irq0: clk 32550 99 irq4: uart0 676 2 irq7: 21 0 stray irq7 21 0 irq8: rtc 41663 127 irq10: fxp1 1002 3 irq11: ubsec0 fxp2 32516 99 irq14: ata0 2177 6 Total 110626 339vmstat -ai interrupt total rate ??? 0 0 irq0: clk 33828 99 stray irq0 0 0 irq1: 0 0 stray irq1 0 0 irq3: uart1 0 0 stray irq3 0 0 irq4: uart0 728 2 stray irq4 0 0 irq5: 0 0 stray irq5 0 0 irq6: fxp0 0 0 stray irq6 0 0 irq7: 22 0 stray irq7 22 0 irq8: rtc 43300 127 stray irq8 0 0 irq9: 0 0 stray irq9 0 0 irq10: fxp1 1002 2 stray irq10 0 0 irq11: ubsec0 fxp2 33794 99 stray irq11 0 0 irq12: fxp3 0 0 stray irq12 0 0 irq13: dc0 0 0 stray irq13 0 0 irq14: ata0 2195 6 stray irq14 0 0 irq15: dc1 ata1 0 0 stray irq15 0 0 Total 114891 338The irq mapping has changed but the NICs are not working anymore and pfsense is slower as before.
I can configure each interface as usual but for example the local one is no more responding and the WAN gets no address.The good point is that the irq storm disappear …
Is our irq mapping wrong or is something other?
Alex
-
The irq mapping has changed but the NICs are not working anymore and pfsense is slower as before.
I can configure each interface as usual but for example the local one is no more responding and the WAN gets no address.The good point is that the irq storm disappear …
Is our irq mapping wrong or is something other?
Thanks for the data. Looks like some progress is being made. What is the front panel designation of the NICs you are using? and for for what purpose? (which is LAN? WAN? etc). From the interrupt counts it looks as if only two NICs are in use since only two have non-zero interrupt counts.
correcting the tipo on the last line: INTA/irq -> INTA.irq, and I will post the ouptput of vmstat -i
Thanks. Not a good start in attention to details on my part. I'll correct the error in the original post.
-
Currently I'm only using fxp0(wan) and fxp1(lan), I'm testing the box :D
But I have tried to use the other port for the lan interface with the same result.Alex
-
Currently I'm only using fxp0(wan) and fxp1(lan), I'm testing the box
But isn't there a front panel designation: eth1? eth2? etc.
fxp1 and fxp2 are the only NICs with non-zero interrupt counts so I suspect you are really using fxp1 and fxp2 but that you have done a mental translation from ethx (x=1, 2, 3, 4) to fxpn (n=0, 1, 2, 3). Correct?
One of the earlier replies gave a mapping from the ethx to the fxpn but with no mention of how that was derived. I'm suspecting that mapping is not correct. I have vague memory of some Nokia IP? boxes where the electrical ordering of NICs on PCI buses didn't correspond to the front panel ordering but its over 4 years ago that I worked on the Nokia IPxxx boxes.
-
Sorry, you are right I made a mental mapping
On the front panel I have Eth1 to Eth4.
I have checked and I have the following correspondence:Eth1 : fxp0
Eth2 : fxp1
Eth3 : fxp2
Eth4 : fxp3In the welcome screen of pfsense I get the same information about the up links.
And for my tests I'm using Eth1(fxp0) and Eth2(fxp1) for the wan and lan interface.
Alex
-
I have checked and I have the following correspondence:
Eth1 : fxp0
Eth2 : fxp1
Eth3 : fxp2
Eth4 : fxp3How did you determine this mapping is correct rather than (say) eth1 <-> fxp3 … ?
In the welcome screen of pfsense I get the same information about the up links.
Do you mean pfSense reports fxp0 and fxp1 up? (I don't know how pfSense would know about eth1 and eth2).
Do you see the problem: you say you are using fxp0 and fxp1 but fxp1 and fxp2 are the NICs with non-zero interrupt counts. Maybe your translation from the front panel label to fxpn is not correct? Maybe you moved one or more cables after booting? Can you account for the anomaly?
-
Hello wallabybob
I will make my file /boot/loader.conf.local look like:
hw.pci0.2.3.INTA.irq=6 hw.pci0.2.4.INTA.irq=10 hw.pci0.2.5.INTA.irq=11 hw.pci0.2.6.INTA.irq=12With these settings I promised you to test, the irq10 storm is worse than ever and there was no connectivity on the NICs. I removed /boot/loader.conf.local and now, I can reboot and have connectivity. But the storm is still there. Up to now, I only use fxp0 (WAN) and fxp1 (LAN), just like Alex. We will have to try something different.
-
Hi wallabybob
I promised you:
I will make my file /boot/loader.conf.local look like:
hw.pci0.2.3.INTA.irq=6 hw.pci0.2.4.INTA.irq=10 hw.pci0.2.5.INTA.irq=11 hw.pci0.2.6.INTA.irq=12I am sorry to tell you these settings are worse than before: the irq10 storm was heavier, and the NIC's were no longer working. The only ports I am using now are fxp0 (WAN) and fxp1 (LAN), just as Alex. If you want me to try something different, I am ready to do it.
Thanks in advance.
-
I can not run, unfortunately. I get an error when installing the USB
-
Hi Alex and wallabybob
I found a set of entries in /boot/loader.conf.local where the NICs are working, at least fxp0 and fxp1, and no irq10 storm. Here is my file:
hw.pci0.2.3.INTD.irq="6" hw.pci0.2.4.INTA.irq="10" hw.pci0.2.5.INTB.irq="11" hw.pci0.2.6.INTC.irq="12" hw.pci0.3.5.INTB.irq="11" hw.pci0.3.6.INTC.irq="15" hw.pci0.4.5.INTB.irq="15" hw.pci0.4.6.INTC.irq="12"Basically, these are the values collected from IPSO but in the correct format: lines starting with hw and not hint, correct order of parameters for PCI domain/bus/device_number.
I will connect more switches to the ports in the hope that all the NICs will go on working, and I will inform you.
Oh yes: and this is the output of # vmstat -i
interrupt total rate
irq0: clk 16552 99
irq4: uart0 560 3
irq7: 23 0
stray irq7 23 0
irq10: fxp1 dc0 dc* 2158 13
irq11: ubsec0 fxp0* 16507 99
irq14: ata0 2765 16
Total 38588 232There is something strange with this output: irq6, irq12 and irq15 are not set as I expected, but… it works.
Anyway, I hope these setting will also work for Alex: since he has a subset of my NICs in his configuration, this should do the job for him too.
Regards.
Pierre
-
Sorry, other commitments mean I will have very limited time to devote to this for at least the next week, maybe the next two weeks.
There are a number of inconsistencies in the accounts so far:
1. Alex and Pierre both say they are using fxp0 and fxp1 but fxp1 and fxp2 show significant interrupt rates for Alex while Pierre sees significant interrupt rates for fxp0 and fxp1.
2. Pierre reports interrupt storm on irq10 with my suggested modifications to /boot/loader.conf.local but the IPSO startup reports only one device on irq10: fxp1 and fxp1 was assigned to irq10 in my suggested modifications.
Maybe the boxes have different motherboards. Maybe the IPSO startup output we have is from a different box
From memory, the front panels of these devices designate the onboard (not on expansion slot) NICs as eth1, eth2, eth3 and eth4 but both Pierre and Alex report devices fxp0 and fxp1 in use. To get this to work correctly we need appropriate IPSO source code (used to be available from Nokia on request if I recall correctly; don't know about Checkpoint who took over the firewalls from Nokia) or an accurate association between front panel port name, FreeBSD device name and IRQ. Both Pierre and Alex have made associations between front panel port names and FreeBSD device names. I want to know how these associations were derived. If they have been assumed then they can't be trusted and they will need to be derived from the source code or worked out by experiment..
If anyone can track down the source code for a version of IPSO that supported IP380 I'll take a look at it to try to derive the association I requested.
There is something strange with this output: irq6, irq12 and irq15 are not set as I expected, but… it works.
All the hw.pci….irq entries for fxp NICs and dc NICs need to specify INTA because these devices request interrupts on their INTA line. The INTx reported by IPSO refer to interrupt lines on the motherboard which is different from interrupt lines the actual devices use. More detailed explanation will have to wait.
-
Hi,
So I have tested the last config posted by pierre.
It's also working on my box and I get this results:# vmstat -i interrupt total rate irq0: clk 16552 99 irq4: uart0 414 3 irq7: 16 0 stray irq7 16 0 irq10: fxp1 dc0 dc1 2158 13 irq11: ubsec0 fxp0* 16507 99 irq14: ata0 2765 16 Total 38588 232All interface are responding but unfortunatly the web interface on the lan is not.
All interface are responding but unfortunately the web interface on the lan is not.
Another strange point is why the irq are not used as configured in the loader.conf.local?
For example, only fxp1 have to be on the irq10 and from the vmstat info we have still 3 active nics on this irq.Wallabybob> I confirm that I have not the same version of the firewall as pierre, I have an older one. I have also the same as pierre but this one is not booting anymore, but I can confirm that the motherboard is not 100% the same.
Alex
-
Guys,
Need help here please !!!. At the moment i have done the following:
- I have the live iso for pfsense 2.0
- Have the new kernel files
- removed disc from ip380 and mounted onto virtuabox running on windows XP
I opened the iso with poweriso and added the files that i downloaded ( Thanx Alex) but it wont load the kernel.
Am i going about this in the wrong way ?
How did you get to install ?
am i right in the way i change the ISO ?
should I be using another install file other than the live iso ?
should i be installing in another way than virtuabox ?Please help :)
-
I don't know how is build the live iso.
For my firewall I have made a full installation of pfsense using a laptop (selecting console version without VGA output)After that I started the pfsense install on my laptop to replace the kernel with the new one for IP380.
At this point you have only to remove the disk from the laptop and put it into the Nokia box … that’s all!Alex
-
Hi
Guys,
Need help here please !!!. At the moment i have done the following:
- I have the live iso for pfsense 2.0
- Have the new kernel files
- removed disc from ip380 and mounted onto virtuabox running on windows XP
I opened the iso with poweriso and added the files that i downloaded ( Thanx Alex) but it wont load the kernel.
Am i going about this in the wrong way ?
How did you get to install ?
am i right in the way i change the ISO ?
should I be using another install file other than the live iso ?
should i be installing in another way than virtuabox ?Please help :)
Where did you "add" the new files? You have to rename the directory /boot/kernel to something different, v.gr. /boot/kernel.orig, and then, you can copy the contents of Alex deepst directory in his zip archive (files kernel.gz and *.ko) to /boot/kernel
Good luck.
Pierre
-
Thanks for the reply , so if i have it right i do a normal install on the laptop to usb, then when its done i rename the directory on the hard drive and put the files on ?