Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    SG-2100 vs SG-3100 vs SG-5100... ? Purchase advice needed

    Scheduled Pinned Locked Moved Official Netgate® Hardware
    26 Posts 12 Posters 9.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      Cabledude
      last edited by Cabledude

      Hello all,

      For the last two weeks I have been testing a rented SG-1100, to see if pfSense was a good option for me. In fact I like it more than my USG 3P, because all settings can be controlled in the GUI. Furthermore internet reviews state that pfSense is a reliable system.

      My question:
      I am debating SG-2100 vs SG-3100 vs SG-5100. My purposes are the following:

      • 200 mbit/s FTTH, possibly expanding to 500 mbit/s
      • Gbit VLAN routing
      • OpenVPN s2s (future requirement, it's in the works)
      • Suricata
      • pfBlocker
      • up to 50 clients
      • VoIP ATA for my 2 analog phones
      • Logging traffic, NTOPNG DPI analysis

      I may wish to engage in future projects so I want my device to be able to handle the above tasks easily. It would be a waste of money to splash out 400 for an SG-3100 only to find out I need to replace it two years on.

      I have some 10GbE capable devices coming next year, such as a 10GbE capable UniFi switch and a new Synology NAS. There will be no layer 3 routing needs for these devices as they will be in the same subnet so the 10GbE switch can handle that traffic in layer 2.

      My profile
      I am 50 y/o, a home user that started to learn networking about 1-1,5 years ago. I have quite an extensive (for a beginning home user, yes) UniFi setup (see signature below). I use 7 VLANs for separating IoT traffic from secureLAN, cameras, legacy devices and such.

      Currently I managed to install and configure the SG-1100 to replace my ISP FttH router and all is working correctly. I also took out my USG and the SG-1100 is now routing traffic across all of my VLANs.

      I choose Netgate hardware for ease of operation, power saving (eco friendly) and because pfSense upgrades will be tested on my hardware.

      Pete
      Home: SG-2100 + UniFi + Synology. SG-1100 retired
      Parents: SG-1100 + UniFi + Synology
      Testing: SG-1100 w/ 120GB SSD via ext USB (eMMC dead). Works great

      1 Reply Last reply Reply Quote 0
      • keyserK
        keyser Rebel Alliance
        last edited by keyser

        The SG-2100 is underspec’ed for your needs. Suricata and ntopng will kill the effective bandwidth on the device because of their relatively heavy CPU consumption.

        I think a SG-3100 will meet your needs now, but going 500mbit would likely require a little restraining of your suricata settings for it not to become a bottleneck. Otherwise it should still be fine - but at it’s limits and internal Gbit VLAN routing will likely be impacted when heavy internet use/inspection is taking place.

        The SG-5100 is undoubtedly the best choice if 500mbit will become a reality and you wish to have “options” for the future. And in any case it will deliver full Gbit VLAN routing without issues regardless of internet bandwidth used.

        Love the no fuss of using the official appliances :-)

        1 Reply Last reply Reply Quote 1
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Yes, I would agree. If you want to be able to run Suricata, pfBlockerNG and NtopNG at 500Mbps with VPNs and do it 'easily' then go for the SG-5100.

          Steve

          1 Reply Last reply Reply Quote 1
          • C
            Cabledude
            last edited by

            Okay Thanks a lot for taking the time to reply and for your recommendations. Looking at the unit prices I think I should lower my requirements a bit. As I didn’t know what to expect all items listed are at the max I think they could ever be. Spending 300 extra for the 5100 over the 3100 may not be justified.

            So first: “up to 50 clients” is more than I probably need. When counting all phones, iPads, AppleTVs, synology, and macs I come to 20, so 25 total would be a better estimate. The children will be at school most of the day anyway.

            Then 500mbit/s is more like a worst case scenario, we’ve had 60 down 10 up until last month and that proved mostly adequate. So let’s assume 200/200 will be what the netgate should be able to handle.

            The s2s VPN will be to our parents home to be able to backup our data on a local NAS I m going to move to their home. They have a very low ISP plan, probably no more than 50/10.

            Suricata i will want to run.

            NTOPNG is more like a way to identify which data is sent from which devices, so I can check whether or not my IoT crap is phoning home and to keep an eye on system resources. I haven’t even played with NTOPNG yet and really didn’t know it could be such a resource eater.

            So based on this, could I get by comfortably with the SG-3100?

            Thanks!!
            Pete

            Pete
            Home: SG-2100 + UniFi + Synology. SG-1100 retired
            Parents: SG-1100 + UniFi + Synology
            Testing: SG-1100 w/ 120GB SSD via ext USB (eMMC dead). Works great

            keyserK 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz

              Just get a 7100 ;) Go big or go home! hehehe

              Call the upgrade a xmas present to yourself.. If you have to justify the extra cost to the budget committee (significant other) hehehe

              In fact I like it more than my USG 3P

              Yeah its not even close.. While the usg3p isn't a bad little box.. At a good price point.. Its just doing anything is just so much harder than how easy it is in pfsense.. I ran one for a bit, couldn't get back to pfsense fast enough.. My sg4860 was on back order, and need something to handle a recent upgrade to 500/50 for internet..

              It sat on the self for quite a bit, but my son recently bought a house... So got him a flexHD for AP and let him use my usg3p, he doesn't really do anything and only has 100/5 for internet.. So for that sort of setup its fine - and it reports into my controller so.. Can keep an eye on stuff for him..

              I was in a toss up over the 3100 or the 4860.. I went really for the 4860 because of the discrete interfaces vs switch ports.. I do switching on my switch - I want my router to have interfaces ;)

              Other than the extra horse power - the 5100 over the 3100 has interfaces vs switch ports, and can run TNSR if that is something you might want to play with.. I do believe the 5100 also supports QuickAssist and AES-NI, while I believe the 3100 is just AES-NI.. The 5100 also can upgrade the ram and storage I do believe as well.. All big pluses if you plan on keeping it around for a while.

              Don't get me wrong the 3100 will prob be great setup for you - but hey why not treat your self to a better box -- if you can afford it..

              If (knock on wood) my 4860 took a dump.. And I was in the market - it really would be a toss up between the 5100 and the 7100.. The ability to do some 10ge would be attractive..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              C 1 Reply Last reply Reply Quote 2
              • C
                Cabledude @johnpoz
                last edited by Cabledude

                @johnpoz hi john thanks for such an elaborate reply, straight from the enthusiast’s heart :-). First: yes I could afford even a 7100 in that I won’t starve, but we’re not millionaires so then I cannot buy this or that, iow it’s me that has to be convinced of a buy, the wife couldn’t care less about what I do with my money.

                I thought the 3100 has three logical interfaces, just the lan is actually a 4p switch. Will tick the “logical interfaces” box well enough for me I suppose. Or did you mean something else, which I may be missing...

                The sg-1100 has just one logical interface split across wan, lan and opt using VLANs 4090, 4091 and 4092. Not quite my cup of tea. But I got working as a FttH WAN split VLAN 4/6 by tying those two as tagged VLANs to the WAN interface.

                By the way Like you I also do all of my switching outside the firewall, i.e. soon on a 10Gbe UniFi switch. The netgate just needs to perform gigabit L3 routing, I will keep the 10Gbe hungry devices (workstations and NAS for photo editing) in the same VLAN so layer 2 switching will take care of that.

                Be aware that the 7100 also has the Soc internal “SG-1100 like” VLAN design to tie the lagg together and all LAN side VLANs need to get tied to the LAN ports in Interfaces/switch settings.

                I’m not at all interested in TNSR.

                So that leaves combining openvpn, suricata and ntopng. For our limited family use, based on your reply, I conclude the 3100 will do for my current use case.

                Will chew on this for now. Price vs upgradability.

                Would appreciate you clarifying the logical ports vs switch benefit of the 5100. Are you using many ports on your netgate box? I will typically only use WAN and LAN and maybe separate ports for IPTV.

                Cheers,
                Pete

                Pete
                Home: SG-2100 + UniFi + Synology. SG-1100 retired
                Parents: SG-1100 + UniFi + Synology
                Testing: SG-1100 w/ 120GB SSD via ext USB (eMMC dead). Works great

                M 1 Reply Last reply Reply Quote 0
                • B
                  Burner27
                  last edited by

                  I have had issues running Suricata and SNoRT on my sg-3100. Random reboots with no explanation. Brought it up to Netgate and they told me it could be an issue with the ARM processor. They recommended I go to the SG5100.

                  1 Reply Last reply Reply Quote 2
                  • I
                    iso667
                    last edited by

                    Hi!

                    I am in a very similar situation. But I purchased the SG-2100.

                    I don't use Suricata or other things you have posted because I am really new to pfSense and I am starting learning how it works and what can I do.

                    I have a UniFi ecosystem with two switches and two access points and I run the controller actually on a raspberry-pi.

                    I am here writing to ask you about the reason to migrate from the USG to pfSense, is it because the pfSense has more functionalities and possibilities?

                    I think that the USG could be a "very limited" Firewall, but I am a bit attracted by the idea of having everything centralized into a unique administration console. I have renewed all my network at the same time, but I bought the pfSense first.

                    Nowadays I am thinking in buying a Cloud Key gen 2 from UniFi to manage the devices, because I need the raspberry-pi to use it at my IoT VLAN with homebridge installed on it. So I was tempted on buying a UDM (UniFi Dream Machine) or maybe a Cloud Key + USG. So your opinion could be very useful to continue with the SG-2100.

                    There is no any "real" need from my point of view to move from the SG-2100 to USG or UDM, just the "centralized" management perspective and that I have a 12 months old baby and less time that I want to configure my Network devices at home :)

                    I work as a CCIE and I am used to networking, so the only thing to move to "all unifi" is to save some time while at home. On the other hand I think I would lost a lot of functionalities and this is the reason you are going to go with NetGate, am I right?

                    The thing I love from the SG-2100 is that it has an SFP connector, that is not present at the SG-3100, and with this SFP, if your provider gives you a GPON connection based on fiber, you can connect this fiber straight to the device. In any case I am using an external ONT and connect the WAN port using RJ-45. But in case this could be interesting to you, it is something I took into account when I decided to buy this device.

                    Thanks!!

                    ISO

                    keyserK 1 Reply Last reply Reply Quote 0
                    • keyserK
                      keyser Rebel Alliance @Cabledude
                      last edited by

                      @Cabledude said in SG-2100 vs SG-3100 vs SG-5100... ? Purchase advice needed:

                      Okay Thanks a lot for taking the time to reply and for your recommendations. Looking at the unit prices I think I should lower my requirements a bit. As I didn’t know what to expect all items listed are at the max I think they could ever be. Spending 300 extra for the 5100 over the 3100 may not be justified.

                      So first: “up to 50 clients” is more than I probably need. When counting all phones, iPads, AppleTVs, synology, and macs I come to 20, so 25 total would be a better estimate. The children will be at school most of the day anyway.

                      Then 500mbit/s is more like a worst case scenario, we’ve had 60 down 10 up until last month and that proved mostly adequate. So let’s assume 200/200 will be what the netgate should be able to handle.

                      The s2s VPN will be to our parents home to be able to backup our data on a local NAS I m going to move to their home. They have a very low ISP plan, probably no more than 50/10.

                      Suricata i will want to run.

                      NTOPNG is more like a way to identify which data is sent from which devices, so I can check whether or not my IoT crap is phoning home and to keep an eye on system resources. I haven’t even played with NTOPNG yet and really didn’t know it could be such a resource eater.

                      So based on this, could I get by comfortably with the SG-3100?

                      Thanks!!
                      Pete

                      If the settings and needs you have are restrained to your explanation Here, i believe a sg-3100 Will suffice :-) I have No experience with suricata Being unstable on arm based devices

                      Love the no fuss of using the official appliances :-)

                      1 Reply Last reply Reply Quote 1
                      • keyserK
                        keyser Rebel Alliance @iso667
                        last edited by

                        @iso667 said in SG-2100 vs SG-3100 vs SG-5100... ? Purchase advice needed:

                        Hi!

                        I am in a very similar situation. But I purchased the SG-2100.

                        I don't use Suricata or other things you have posted because I am really new to pfSense and I am starting learning how it works and what can I do.

                        I have a UniFi ecosystem with two switches and two access points and I run the controller actually on a raspberry-pi.

                        I am here writing to ask you about the reason to migrate from the USG to pfSense, is it because the pfSense has more functionalities and possibilities?

                        I think that the USG could be a "very limited" Firewall, but I am a bit attracted by the idea of having everything centralized into a unique administration console. I have renewed all my network at the same time, but I bought the pfSense first.

                        Nowadays I am thinking in buying a Cloud Key gen 2 from UniFi to manage the devices, because I need the raspberry-pi to use it at my IoT VLAN with homebridge installed on it. So I was tempted on buying a UDM (UniFi Dream Machine) or maybe a Cloud Key + USG. So your opinion could be very useful to continue with the SG-2100.

                        There is no any "real" need from my point of view to move from the SG-2100 to USG or UDM, just the "centralized" management perspective and that I have a 12 months old baby and less time that I want to configure my Network devices at home :)

                        I work as a CCIE and I am used to networking, so the only thing to move to "all unifi" is to save some time while at home. On the other hand I think I would lost a lot of functionalities and this is the reason you are going to go with NetGate, am I right?

                        The thing I love from the SG-2100 is that it has an SFP connector, that is not present at the SG-3100, and with this SFP, if your provider gives you a GPON connection based on fiber, you can connect this fiber straight to the device. In any case I am using an external ONT and connect the WAN port using RJ-45. But in case this could be interesting to you, it is something I took into account when I decided to buy this device.

                        Thanks!!

                        ISO

                        The SG-2100 does not have a lot of CPU horsepower so forget using it for deeper traffic inspection. It’s a great litte device and Very userfriendly - it will also do lots of interesting things a little USG cannot (pfBlockerNG and so on). But it cannot offer what the USG can in terms of unified management, so that’s a good reason to stay with Unifi in your case.
                        Also: The SFP port is a Gbit Ethernet port, so unless your provider runs Ethernet over GPON your idea will not work. I have No idea if you can even get a GPON tranceiver that terminates Ethernet over GPON and works with Netgate devices.

                        Love the no fuss of using the official appliances :-)

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          ISPs providing exactly that do exist but I don't think we have ever tested one with a SG-2100.

                          I love to hear about it if anyone has. 😉

                          Steve

                          keyserK 1 Reply Last reply Reply Quote 0
                          • I
                            iso667
                            last edited by

                            I read this "extensive" post for this to work here in Spain. Finally a company called Carlitoxx-Pro started shipping a GPON to GigabitEthernet device. There is also a ZISA one that is sold online from China:

                            https://forum.mikrotik.com/viewtopic.php?t=116364

                            It is from Mikrotik, but all the electronics are inside the device so I think it should work while the SG-2100 provides power to the GPON.

                            I've seen that UniFi also sells a GPON to Gigabit adapter but I don't know if this one could work on a SG-2100:

                            https://dl.ubnt.com/ds/uf_gpon

                            If you look into the data sheet, there is a GPON for ONT side, not for OLT. But I don't know if this SFP could work against "non-unifi" OLT's.

                            But yes, I think it is "doable" :) for the moment I am using a UF Loco ONT and connect my SG-2100 straight to RJ-45 cable, but maybe in the future I'll try one of those.

                            BR!

                            ISO

                            1 Reply Last reply Reply Quote 0
                            • keyserK
                              keyser Rebel Alliance @stephenw10
                              last edited by

                              @stephenw10 said in SG-2100 vs SG-3100 vs SG-5100... ? Purchase advice needed:

                              ISPs providing exactly that do exist but I don't think we have ever tested one with a SG-2100.

                              I love to hear about it if anyone has. 😉

                              Steve

                              I’m running a SG-2100 with a 1000Base-BX20 SFP in the SFP slot that connects my fiber to the home directly. As the tranciever indicates, my ISP uses single strand Gigabit Ethernet to the edge.

                              Love the no fuss of using the official appliances :-)

                              1 Reply Last reply Reply Quote 1
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Nice!

                                I tested some BiDi modules here and they worked without issue.

                                Steve

                                W 1 Reply Last reply Reply Quote 0
                                • W
                                  wblanton @stephenw10
                                  last edited by

                                  @stephenw10 said in SG-2100 vs SG-3100 vs SG-5100... ? Purchase advice needed:

                                  Nice!

                                  I tested some BiDi modules here and they worked without issue.

                                  Steve

                                  Steve,

                                  Do you know if the 1G BiDi will work with the XG-7100 1U? I've having some issues using the "generic" ones from FS.com. I've started another thread but haven't heard anything.

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    The one I have does:

                                    [21.02.2-RELEASE][root@7100.stevew.lan]/root: ifconfig -vvvm ix1
                                    ix1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                                            description: IX1
                                            options=e138bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,WOL_UCAST,WOL_MCAST,WOL_MAGIC,VLAN_HWFILTER,RXCSUM_IPV6,TXCSUM_IPV6>
                                            capabilities=f53fbb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,WOL_UCAST,WOL_MCAST,WOL_MAGIC,VLAN_HWFILTER,VLAN_HWTSO,NETMAP,RXCSUM_IPV6,TXCSUM_IPV6>
                                            ether 00:08:a2:0e:a5:92
                                            inet6 fe80::208:a2ff:fe0e:a592%ix1 prefixlen 64 scopeid 0x4
                                            inet 172.21.16.243 netmask 0xffffff00 broadcast 172.21.16.255
                                            media: Ethernet autoselect (Unknown <rxpause,txpause>)
                                            status: active
                                            supported media:
                                                    media autoselect
                                            nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                            plugged: SFP/SFP+/SFP28 1000BASE-LX (LC)
                                            vendor: OEM PN: SFP-GE-BX03-D SN: NV20200713025 DATE: 2020-07-14
                                            module temperature: 27.94 C Voltage: 3.31 Volts
                                            RX: 0.20 mW (-6.79 dBm) TX: 0.12 mW (-8.97 dBm)
                                    
                                            SFF8472 DUMP (0xA0 0..127 range):
                                            03 04 07 00 00 00 02 00 00 01 01 01 0D 00 03 1E 
                                            00 00 00 00 4F 45 4D 20 20 20 20 20 20 20 20 20 
                                            20 20 20 20 00 00 90 65 53 46 50 2D 47 45 2D 42 
                                            58 30 33 2D 44 20 20 20 41 20 20 20 06 0E 00 09 
                                            00 1A 00 00 4E 56 32 30 32 30 30 37 31 33 30 32 
                                            35 20 20 20 32 30 30 37 31 34 20 20 68 F0 01 0B 
                                            FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
                                            FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
                                    

                                    Though I was quite surprised about that. It doesn't report a link speed so cannot be set to 1G fixed which is often required for use like this.

                                    Steve

                                    W 1 Reply Last reply Reply Quote 0
                                    • W
                                      wblanton @stephenw10
                                      last edited by

                                      @stephenw10 Good to know it's possible! Have you been running this without any issue?

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Not for any time. I just moved it from an SG-2100 to test. I saw no problems though and it also runs fine in the SG-2100, been running there for months.

                                        Steve

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          msf2000 @Cabledude
                                          last edited by

                                          @cabledude
                                          You may be able to do the SG-3100 but only if you offload Suricata and/or nTopNG to a separate machine. Otherwise, go with the 5100 as suggested earlier.

                                          I speak from experience, as having tried it before. ;)

                                          B B 2 Replies Last reply Reply Quote 1
                                          • B
                                            Biggy823 @msf2000
                                            last edited by

                                            @msf2000 I too happen to be in the same boat. I have the SG-3100 and currently experiencing lock ups and random reboots. It just does not have the horse power needed to run these applications. I am now facing the hard choice that I am going to have to upgrade to the 5100. Don't make the same mistake that I did.

                                            1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.