VMWare vs Netgate appliance in terms of performance



  • My company is about to begin rebuilding the internal network of a partner because some of the requirements for systems the partner is running is such that their current network is inadequate.

    More specifically, we configuring a new PBX that will be deployed almost completely as VMs on a VMWare server.

    It occurs to me, that I could just install the pfsense software in a VM on the VMWare host and run that as the router. My concern is one of performance. This location is not particularly large; they have about 6 people on site regularly with no requirements for anything particularly high bandwidth. They are soon going to have equipment such that it will be necessary to have separate internal LANs (this requirement is the one that's prompting the upgrade).

    I am not against doing this but I have some concerns. I have already setup a pfSense VM in their location with a single WAN port for the purpose of hosting an IPSEC site to site VPN. The performance is often somewhat lackluster. Doing a ping test from my site to the remote site's internal network through the VPN, and then the same test from my site to the remote site's public ip address shows almost identical ping times. However, that's just single packets at a time. It's more noticeable when I pull up the VMWare ESXi login page through the site to site connection, which involves quite a bit more data transfer. We previously had a PC hosting a VPN for us there, but it was very limited; it was a client to site connection only. However, the performance on that one was noticeably better.

    I'm not against a virtual deployment, but I do have to ask if this I expected, that a VM deployment on a server should not be expected to perform as well as a physical appliance on hardware dedicated to networking.

    The load this device will carry is small. The location in question has a half dozen employees and none of them have any requirements that call for relatively large bandwidth consumption. We'd also only be virtualizing their router if we went this way; the switches would remain physical devices in the rack.