Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VMWare Pentest lab: Extremely high CPU on host

    Virtualization
    29
    85
    65.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      k13tas
      last edited by

      Hello,
      i'm having similar problems with pfsense (2.0 and 2.1) and vmware. I'm not sure witch vmware version i'm using since it's in the "cloud", but cloud management concole says "powered by vmware". We used to run pfsense on very old PC and it worked like a charm, but now when we moved to "cloud" and got more CPU and RAM recources for pfSense it's suddenly not enought for pfSense. pfSense mamagement console says it's only using a few percents of CPU, but cloud administrator tells me we're using 100% and that's the reason our internet connection is so slow. I tried reinstalling and even installed 2.1 RC1, but it didn't help much. Does anyone have any idea what can be done or should i look for another firewall?

      1 Reply Last reply Reply Quote 0
      • S
        Supermule Banned
        last edited by

        Not good :(

        1 Reply Last reply Reply Quote 0
        • V
          Veni
          last edited by

          @k13tas:

          Hello,
          i'm having similar problems with pfsense (2.0 and 2.1) and vmware. I'm not sure witch vmware version i'm using since it's in the "cloud", but cloud management concole says "powered by vmware". We used to run pfsense on very old PC and it worked like a charm, but now when we moved to "cloud" and got more CPU and RAM recources for pfSense it's suddenly not enought for pfSense. pfSense mamagement console says it's only using a few percents of CPU, but cloud administrator tells me we're using 100% and that's the reason our internet connection is so slow. I tried reinstalling and even installed 2.1 RC1, but it didn't help much. Does anyone have any idea what can be done or should i look for another firewall?

          Have you tried pfSense 1.2.3? I'm about to revert from 2.0.1 to 1.2.3 this month due to high CPU usage on 2.0.x. I will be canceling the 3G backup route so 1.2.3 will be more than enough.

          1 Reply Last reply Reply Quote 0
          • S
            Supermule Banned
            last edited by

            Thats one of the reasons I havent upgraded yet.

            It showed the same on both of my physical server setup running in a VM.

            1.2.3 works great!

            1 Reply Last reply Reply Quote 0
            • K
              k13tas
              last edited by

              @Veni:

              @k13tas:

              Hello,
              i'm having similar problems with pfsense (2.0 and 2.1) and vmware. I'm not sure witch vmware version i'm using since it's in the "cloud", but cloud management concole says "powered by vmware". We used to run pfsense on very old PC and it worked like a charm, but now when we moved to "cloud" and got more CPU and RAM recources for pfSense it's suddenly not enought for pfSense. pfSense mamagement console says it's only using a few percents of CPU, but cloud administrator tells me we're using 100% and that's the reason our internet connection is so slow. I tried reinstalling and even installed 2.1 RC1, but it didn't help much. Does anyone have any idea what can be done or should i look for another firewall?

              Have you tried pfSense 1.2.3? I'm about to revert from 2.0.1 to 1.2.3 this month due to high CPU usage on 2.0.x. I will be canceling the 3G backup route so 1.2.3 will be more than enough.

              Thank you for a quick response. I haven't tried 1.2.3 yet. Is it secure? I mean it's an older release so there might be know security bugs, or isn't there?

              1 Reply Last reply Reply Quote 0
              • S
                Supermule Banned
                last edited by

                Not as far as I am aware.

                1 Reply Last reply Reply Quote 0
                • J
                  joshfokis
                  last edited by

                  I cant say I have had this issue yet, but then again I cannot get it configured where i can reach the lan from wan side. I am running it in virtual box, not sure if that would make a complete difference. although if you may have a guide on setup I could use that. I will try to redo and test out vmware this coming weekend.

                  1 Reply Last reply Reply Quote 0
                  • C
                    cmb
                    last edited by

                    There are XSS and CSRF vulnerabilities in 1.x's web interface. Though if you follow general best practices for managing any web-administered device (use a diff browser than you ever use for Internet), that's a non-issue. Every web-managed device has had some XSS and CSRF issues, and many commercial security-related products have a number of known unpatched XSS and CSRF. Some have released updates fixing them. There isn't anything imminently exploitable in any pfSense version, but I wouldn't recommend running anything prior to the latest stable release.

                    We and many, many others run most or all our production firewalls on ESX. This very site runs behind firewalls in ESX, and can route gigabit wire speed between internal VLANs, without any excessive CPU usage on the host. All of our production colos run their firewalls in ESX without any issues at all, and they're pushing significant loads. Why a minority of people see this, I don't know, but it's something we plan to investigate post-2.1 when time permits. It may be something that just goes away when we get to a newer FreeBSD base.

                    Note you do need to make sure you're on the latest ESX (5.0U1 or 5.1 should be fine), while I'm not aware of any ESX issues exactly along these lines, they have patched several bugs related to FreeBSD guests over the years, and there is at least one ugly one in 5.0 pre-update 1.

                    1 Reply Last reply Reply Quote 0
                    • V
                      Veni
                      last edited by

                      @Veni:

                      […]I'm about to revert from 2.0.1 to 1.2.3 this month due to high CPU usage on 2.0.x. I will be canceling the 3G backup route so 1.2.3 will be more than enough.

                      Reverted last month. Runs perfectly smooth. Right now 42 Mbps makes the guest drive up the clock to 506 MHz(out of 2,66 GHz) on the host. Perfect!

                      You guys that run your large setups on ESXi without any CPU utilization issues, what type of motherboard, pCPU and pNIC are you using?

                      1 Reply Last reply Reply Quote 0
                      • S
                        Supermule Banned
                        last edited by

                        Use IBM X3550M4 with Intel 10GbE cars X520-T2.

                        1 Reply Last reply Reply Quote 0
                        • V
                          Veni
                          last edited by

                          @Supermule:

                          Use IBM X3550M4 with Intel 10GbE cars X520-T2.

                          If you are running at 10 Gbit/s uplink, do you use DirectPath I/O with the pNIC's to pfSense or do you virtualize them to pfSense?
                          Otherwise the platform is a more current generation than mine.

                          1 Reply Last reply Reply Quote 0
                          • S
                            Supermule Banned
                            last edited by

                            I dont see any issues at all related to high CPU on 2.0.2 release.

                            Running 3 seperate FW's on 4.1 U3.

                            Packages:

                            File Manager
                            Open VM-Tools 8.8.1
                            PFBlocker
                            Snort

                            pfsenseCPU.jpg
                            pfsenseCPU.jpg_thumb

                            1 Reply Last reply Reply Quote 0
                            • S
                              Supermule Banned
                              last edited by

                              I am not. I only use 10Gbit internally and use the build-in 1Gbit for PF WAN.

                              No directpath, but virtualized through VmWare.

                              :)

                              I am running the 32bit version of Pfsense and VM version 7.

                              2vCPU and 1GB of memory. 11% memory used at the moment and 37% disk.

                              @Veni:

                              @Supermule:

                              Use IBM X3550M4 with Intel 10GbE cars X520-T2.

                              If you are running at 10 Gbit/s uplink, do you use DirectPath I/O with the pNIC's to pfSense or do you virtualize them to pfSense?
                              Otherwise the platform is a more current generation than mine.

                              1 Reply Last reply Reply Quote 0
                              • J
                                jp141
                                last edited by

                                Are people still having this issue with the latest esxi 5.1?

                                I am running 4.1 at the moment and basically any sort of large download kills access to every VM running on the host until it is complete! :(

                                I have tried everything I can think of and is listed on here, I am getting it on all versions of pfsense from 1.2.3 up to the latest.

                                It has got to the point now, I am either going to have to setup Pfsense on some dedicated hardware or switch to monowall but I really need openvpn :(

                                So is upgrading to esxi 5.1 a fix for this?

                                1 Reply Last reply Reply Quote 0
                                • S
                                  Supermule Banned
                                  last edited by

                                  Try to limit the download bandwidth. ;)

                                  Currently seeing ~2% CPU on the ESXi host on 2.0.3 REL.

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    jp141
                                    last edited by

                                    I have tried that, even if I limit to 20 meg it still plays havoc :(

                                    What version of ESX are you on?

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      Supermule Banned
                                      last edited by

                                      4.1 U3.

                                      Dont want to upgrade to 5.x since I dont need the new features in 5.x.

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        jp141
                                        last edited by

                                        Looks like my only option is to move to hardware in that case :(

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          Supermule Banned
                                          last edited by

                                          When use to running vm's then hardware is a pain in the ass…. :(

                                          1 Reply Last reply Reply Quote 0
                                          • J
                                            jp141
                                            last edited by

                                            I know there are going to be vlans everywhere but what else can I do, I cant get any version of pfsense to play nice.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post