SG-1100

chrismacmahon

https://www.reddit.com/r/PFSENSE/comments/abyqwt/and_news_on_espressobin_pfsense_release/ed5dpr1/

johnpoz

That is just Jim saying to be patient ;)

chrismacmahon

I guess we should be patient then.

johnpoz

heheheheeh ;)

jimp

Good things come to those who wait. :-)

https://www.netgate.com/press-releases/sg-1100-press-release.html
https://www.netgate.com/solutions/pfsense/sg-1100.html

johnpoz

Looks like a winner for our branch offices for sure! Can't wait get the go ahead to order for next offices we replace current firewalls with this.

Maxburn

Do we have OpenVPN performance numbers yet? I'm assuming it should have no issue with my little 100/10 Mbps pipe. Sounds perfect for the house or work from home situation.

Rico

Yeah some OpenVPN numbers would be nice.
One more URL here ;-) https://www.netgate.com/blog/netgates-new-sg-1100-punches-way-above-its-weight.html

-Rico

akuma1x

I'm so excited! Is that weird to get enthusiastic about a firewall offering? LOL

And it's about time (in a good way, not being sarcastic...) that there's an affordable 3 port firewall box from Netgate. Hurry up now and make the wall mounting brackets.

Jeff

Rico

@akuma1x said in SG-1100:

I'm so excited! Is that weird to get enthusiastic about a firewall offering?

We are both weird dudes then.

-Rico

Rico

So what is the default Switch Configuration for the SG-1100?

-Rico

jimp

@rico said in SG-1100:

So what is the default Switch Configuration for the SG-1100?

Three discrete ports: WAN, LAN, OPT1

But you can rearrange that however you like since they are all ports on the same switch.

Grimson

Can you upgrade the RAM? If not any plans on providing a version with 4 GB ram? 1 GB just doesn't cut it with pfBlockerNG and a more advanced config.

jimp

Not that I'm aware of

Maxburn

It's an EspressoBin board inside, RAM is soldered to the board. Now the ExpressoBin boards appear to be available in varying memory configs though.

There was a picture of the board on the twitter announcements.

Maxburn

@grimson You might have a point there, I just checked my pfSense which is running in a VM at the moment and I'm looking at this below. I'd be running just under 80% memory usage on the SG1100 looks like? Seems like bandwidthd is a hog according to top, could dump that.

Memory usage 38% of 2002 MiB
SWAP usage 20% of 1022 MiB

SteveITS

@grimson said in SG-1100:

Can you upgrade the RAM? If not any plans on providing a version with 4 GB ram? 1 GB just doesn't cut it with pfBlockerNG and a more advanced config.

Does pfBlockerNG use that much though? Perhaps it depends on the aliases being held in memory. We generally have a few rules that "allow from the US" so don't have a lot of active pfBlockerNG aliases.

I looked at a couple routers and one on a SG-3100 without packages is around 200 MB, while a PC running pfBlockerNG and Suricata is around 730 MB it says. Another SG-1100 running pfBlockerNG and Suricata is around 500 MB currently.

Maxburn

Maybe I'm not sure what to look at, I'm not super familiar with reading the top command

Memory usage reported on dashboard 38% of 2002 MiB
Top results are;
Mem: 177M Active, 1116M Inact, 160M Laundry, 396M Wired, 199M Buf, 101M Free

jimp

FreeBSD will grab free memory to use for things like caching so you can't always go by specifically how much is used and free as a guide. Free RAM is wasted RAM, they say.

Odds are your memory needs are lower than the used % shown, but that isn't necessarily true 100% of the time.

Grimson

@teamits said in SG-1100:

Does pfBlockerNG use that much though? Perhaps it depends on the aliases being held in memory. We generally have a few rules that "allow from the US" so don't have a lot of active pfBlockerNG aliases.

Well I monitor memory usage with telegraf, and during normal operations it uses between ~600 and ~900 MB (not including buffers). But when pfBlockerNG updates it lists (with TLD enabled) the memory usage (again without buffers) goes up to ~1400 MB with spikes to ~1800 MB. So this would likely force the SG-1100 to swap, which IMHO is a no-no for a firewall.

For reference I'm using GeoIP, the PRI1 IP feeds for IPv4 and IPv6 and DNSBL for adblocking, so my lists aren't insanely huge. I also don't use any kind of IPS/IDS which would increase memory usage too. And that's a setup I would recommend for home users.

Also just to make it clear, I have no personal interest in buying any of the appliances for myself, as I'm a firm believer of using standard components to build all my PC devices by myself. Though I'm still looking for a IMHO good Netgate appliance I could recommend with a clear conscience to home users around me.

And all of this is obvious only my personal preference and opinion.