PC Engines apu2 experiences

[Veldkornet]

@kevindd992002 said in PC Engines apu2 experiences:

Does this mean that as long as you add those lines to /boot/loader.conf, running the latest FW's is fine?

I'm currently running 4.8.0.5 on pfSense 4.2.2 with a SSD in ZFS and except for the small things I mentioned about the reboot not working if the system had been running for a long time, all seems to be fine. I have those lines in my config as well.

[kevindd992002]

@veldkornet

I see. So no fix yet for the system hang on a reboot issue yet? Even just a workaround of any sort?

[Veldkornet]

@kevindd992002 said in PC Engines apu2 experiences:

@veldkornet

I see. So no fix yet for the system hang on a reboot issue yet? Even just a workaround of any sort?

Yes, pull out the power plug

I don't see it as a major issue, the newer versions have more improvements so I'll stay on it. You'll have to have a read through all of the changes if you want to see everything. 4.8.0.5 now supports ECC for example.
I linked to the reboot issue on Github somewhere above if you want to follow it.

[kevindd992002]

@veldkornet

Argh. It will be an issue for me if I manage a pfsense box remotely.

Ok, I'll take a look at that then. Why can't they fix it?

[Veldkornet]

@kevindd992002 said in PC Engines apu2 experiences:

@veldkornet

Argh. It will be an issue for me if I manage a pfsense box remotely.

Ok, I'll take a look at that then. Why can't they fix it?

I don't know? Read through this.

[TheWaterbug]

How does the APU2 stack up against the MBT-2220, performance-wise, for running pfsense, IPSec, and OpenVPN?

I needed a new box about a month ago, and since Netgate wasn't offering APU2 units any more I went with an MBT-2220. It works fine, but I miss the 3rd Ethernet port and the internal expansion slots. [After performing installations on both units I also realize I prefer having a serial console, because then I don't need a monitor and keyboard. I just need a cheap USB-Nullmodem cable.] I thought Netgate stopped selling the APU2 because it was obsolete or unavailable, but apparently the APU2 is still widely available at retail, and is a few dollars less expensive than the MBT-2220.

The APU2 has: "AMD Embedded G series GX-412TC, 1 GHz quad Jaguar core with 64 bit and AES-NI support, 32K data + 32K instruction cache per core, shared 2MB L2 cache."

while the MBT-2220 has: "Intel Atom E3826 (2 x 1.46 GHz, 1MB cache, AES-NI)"

I'm not savvy enough to know which hardware is better. I have 3 (and soon to be 4) sites meshed together with IPSec tunnels among them, and I'm adding one site that will be connecting via OpenVPN. Max wire speed at any of these sites is 50 Mbps, and they're typically 20 Mbps or slower.

Thanks!

[Stewart]

@thewaterbug
We have a lot of the APU2C4 units out there, and they make an APU4 now with 4 ports instead of 3 if that interests you. The largest client we use it at is a hotel with 6 buildings and normally around 150-200 guests at a time on a 500Mbit fiber connection (~30 devices on the Office LAN network and ~150 devices on the Tenant OPT1 network). No issues. Not sure it could go much higher as a max speed but it is running Suricata (On Office and Tenant networks), pfBlocker (On office and Tenant networks), and Squid+ClamAV+SquidGuard (On the Office network only). No issues there. We have other clients using the IPSEC and OpenVPN and they work very well. Don't know top speed but it certainly doesn't feel slow. I can't compare to the MBT-2220 with 2 cores that are likely twice as strong (Jaguar isn't exactly high IPC) but the APU2C4 can do 500Mbps just fine. Lately I've seen Suricata go wonky and cap out the CPUs on several units but that appears to be a log issue. Uninstalling/reinstalling seems to fix it so far. I hope that gives you some understanding.

[TheWaterbug]

Thanks! That's exactly what I wanted to hear.

[Stewart]

@thewaterbug
Just don't use snort. It is single-threaded and these don't have great single-threaded power. I've never seen Squid or pfBlocker cause hiccups. Suricata runs much better if you disable stream events but you'll want to keep your eye on it for a bit to make sure it runs smoothly. If there are CPU spikes you'll notice quickly enough.

[TheWaterbug]

Ah, apparently I don't have an APU2. I have an APU1. I booted into TinyCore and got the following:

coreboot table found at 0x7efdf000.
Found chipset "AMD SB7x0/SB8x0/SB9x0".
Enabling flash write... OK.
Identifying board "PC Engines apu1"... OK.
Found Macronix flash chip "MX25L1605A/MX25L1606E/MX25L1608E" (2048 kB, SPI) mapped at physical address 0xffe00000.
Error: Image size (8388608 B) doesn't match the flash chip's size (2097152 B)!

When I boot this board my console says:

PC Engines APU BIOS build date: Apr  5 2014

and my pfsense Dashboard reports:

System	Netgate APU
Netgate Device ID: 400a2blahblahblah

BIOS	Vendor: coreboot
Version: SageBios_PCEngines_APU-45
Release Date: Sat Apr 5 2014 

Is that the latest legacy version for this board?

I suppose I got confused because I purchased this from Netgate in 2014 as a " Netgate APU2".

[Veldkornet]

I don’t know if Netgate make their own versions of the BIOS (because it says “SageBIOS”). I know if you check in package manager on pfSense, there is a package for the apu from them.

However, for the generic firmware, there are much newer ones available. See here: https://pcengines.github.io/#top

If you scroll a few posts back, we were “just discussing it” and how to flash the BIOS.

[TheWaterbug]

^^
but the oldest board in any of those lists [for the legacy releases] is "APU2", and it looks like have an APU with no digit (e.g. an APU1).

I've read many places on this forum that, for pfsense, the "mainline" releases are to be avoided.

[Veldkornet]

I don’t know why mainline’s are to be avoided, I have 4.8.0.5 running and it works just fine.

I think with the flash utility you can backup your existing firmware if you can no longer find it on the internet. Then you can downgrade if you have problems.

[fireodo]

@veldkornet said in PC Engines apu2 experiences:

I don’t know why mainline’s are to be avoided, I have 4.8.0.5 running and it works just fine.

I think with the flash utility you can backup your existing firmware if you can no longer find it on the internet. Then you can downgrade if you have problems.

Agree with you, but why update if everything is working well? :-) Is there any benefit?

[Veldkornet]

@fireodo said in PC Engines apu2 experiences:

Agree with you, but why update if everything is working well? :-) Is there any benefit?

Well, I'm not saying that you have to do anything. But you could use that same argument for everything software related... Why update Windows if everything works? ?

You can read through all of the release notes yourself, but they fix bugs and release new features every so often. Recently, they've enabled ECC memory in 4.8.0.5

[VAMike]

@thewaterbug said in PC Engines apu2 experiences:

I suppose I got confused because I purchased this from Netgate in 2014 as a " Netgate APU2".

yes, it's been confusing people for years. all the netgate apu's were based on the older pcengines apu1 design, regardless of their naming convention.

@veldkornet said in PC Engines apu2 experiences:

Recently, they've enabled ECC memory in 4.8.0.5

not for the apu1

[stephenw10]

@veldkornet said in PC Engines apu2 experiences:

I don’t know if Netgate make their own versions of the BIOS (because it says “SageBIOS”).

We didn't.

It's possible to put the newer BIOS versions on APU1 if you want. I did it a while back just to test if it could be done:

BIOS 	Vendor: coreboot
Version: v4.8.0.1
Release Date: Fri Jun 8 2018 

That would be what was sold by Netgate as the APU2 or APU4 to indicate 2 or 4GB of RAM at the time. Also as the VK-T40E2/4 from the pfSense store.

I'm not aware of any advantages that BIOS brings but mine has been running solidly with for months just as one data point.
[Edit: actually it does appear to add new devices as bootable]

See: https://forum.netgate.com/post/777287
Steve

[TheWaterbug]

@vamike said in PC Engines apu2 experiences:

@thewaterbug said in PC Engines apu2 experiences:

I suppose I got confused because I purchased this from Netgate in 2014 as a " Netgate APU2".

yes, it's been confusing people for years. all the netgate apu's were based on the older pcengines apu1 design, regardless of their naming convention.

Aha! Thank you. I am very slightly less confused, now.

So I apparently have only a dual-core box with no AES-NI support. And the PCEngines "APU2xxx" was never sold by Netgate, correct?

Does my Netgate APU unit then belong in the "Official Netgate Hardware" forum?

[TheWaterbug]

@thewaterbug said in PC Engines apu2 experiences:

How does the APU2 stack up against the MBT-2220, performance-wise, for running pfsense, IPSec, and OpenVPN? ...

The APU2 has: "AMD Embedded G series GX-412TC, 1 GHz quad Jaguar core with 64 bit and AES-NI support, 32K data + 32K instruction cache per core, shared 2MB L2 cache."

while the MBT-2220 has: "Intel Atom E3826 (2 x 1.46 GHz, 1MB cache, AES-NI)"

That comparison was inaccurate, since I have an APU1, not an APU2. The correct comparison is now:

The APU1 has: "AMD G series T40E APU, 1 GHz dual core (Bobcat core) with 64 bit support, 32K data + 32K instruction + 512KB L2 cache per core."

while the MBT-2220 has: "Intel Atom E3826 (2 x 1.46 GHz, 1MB cache, AES-NI)"

So my spiffy new MBT-2220 units are clearly more performant than my old APU units, especially for anything that can use AES-NI acceleration.

[stephenw10]

@thewaterbug said in PC Engines apu2 experiences:

Does my Netgate APU unit then belong in the "Official Netgate Hardware" forum?

You can open a thread there but there are a lot of APU users who did not purchase through our store. You might well get more views here.

Steve