3100 will reach "End of Life" in 5 days

gweempose

I just received an email from Netgate informing me that the 3100 with reach "End of Life" on October 22. I absolutely love my 3100 and am super bummed about this. What are my options for replacing it? Is there a direct successor to the 3100?

johnpoz

@gweempose just because its EOL doesn't mean it stops working.. You could for sure continue to use it.. Did they state in the email they will no longer support it in any way.. For example will they not release new + versions of pfsense for it going forward, 23.09 that should be out soon, or the next version most likely 24.03?

https://www.netgate.com/support/product-lifecycle

Looks like they are saying the 2100 is the replacement

edit: my sg4860 was end of life 2020-04-12, and it still going strong and running 23.05.1

Until it actually dies, or they no longer provide updates too it, I have no plans on replacing it ;)

gweempose

@johnpoz said in 3100 will reach "End of Life" in 5 days:

@gweempose just because its EOL doesn't mean it stops working.. You could for sure continue to use it.. Did they state in the email they will no longer support it in any way?

According to the email, the 3100 will no longer receive any updates, so they are recommending that you upgrade to a newer device.

https://www.netgate.com/support/product-lifecycle

Looks like they are saying the 2100 is the replacement

Thanks! I'll take a look at the 2100.

uzumaki

Thanks! I'll take a look at the 2100.

I found this interesting as the eol 3100 is faster than the current 2100. There is no 3100 sweet spot anymore for a 1gbps connection.

3100: IMIX 1.98gbs
2100: IMIX 594mbps

bmeeks

Not surprised by this. The SG-3100 is an outlier now because it has a 32-bit ARM processor. The other active ARM platforms marketed by Netgate all have 64-bit CPUs.

A 32-bit ARM CPU is a very difficult platform to support these days as there are some popular FreeBSD ports that won't work anymore on 32-bit platforms (they won't compile using 32-bit tools).

gweempose

@uzumaki said in 3100 will reach "End of Life" in 5 days:

Thanks! I'll take a look at the 2100.

I found this interesting as the eol 3100 is faster than the current 2100. There is no 3100 sweet spot anymore for a 1gbps connection.

3100: IMIX 1.98gbs
2100: IMIX 594mbps

Interesting. The 2100 does indeed appear to be a step down from the 3100 spec-wise. I'd be tempted to go with the 4100, but it's really expensive, and probably major overkill for my home setup.

netplumbers

What I'm unclear on is if this really means that security updates are really ceasing. Previous notifications from netgate I interpreted to say that updates weren't guaranteed but are likely. If we're really no longer receiving support then it's an immediate need to replace for me.

jimp

The 23.09 release will include support for the 3100 yet since it's based on FreeBSD 14 which still has 32-bit ARM support, but it may be the last release. Hard to predict if we may need a 23.09.x point release for example which could still target the 3100.

We do usually put out patches for PHP/shell script type issues via the system patches package for some previous releases but we don't have a set schedule for those types of fixes.

FreeBSD is dropping 32-bit ARM support upstream in FreeBSD 15 so not a lot we can do there, the 3100 is Netgate's last 32-bit ARM system.

jwt

As @bmeeks implies, while FreeBSD is supporting 32-bit for the core of FreeBSD, getting some packages to build for 32-bit in increasingly difficult.

In particular, Suricata wants to leverage Rust and getting Rust supportable on 32-bit platforms is challenging.

In any case, the messaging was inadequately reviewed, and I can only offer my apology for same.

@uzumaki my son was running a 3100 on a Centurylink PPPoE encapsulated 1g/1g connection, and I could only get throughput to about 860mbps. I moved him to a 4100 (mostly because neither the 3100 or 2100 have available wall mount hardware) and now it's as fast as I can imagine wanting it to be.

Copy-pasta from an internal (so not marketing cleaned-up) benchmarking matrix. All figures are iperf3, single-stream, and in gbps.

Cut off at 4100 because I don't want to expose new products here.

FWD	ACL	NAT

SG-1100 0.86 0.82 0.78
SG-2100 0.95 0.90 0.80
SG-3100 0.92 0.88 0.84
NG-4100 2.37 2.37 1.73

As you can see, except for NAT, the 2100 is slightly faster than the 3100.

I don't have time to go find the source of your numbers, but someone internally said that you're pulling the 3100 figure from one comparison chart, and the 2100 from a different version of the same documentation.

keyser

@jwt I’m sorry but there is something wrong with those numbers. To be able to push almost 900mbits on a 2100 will require a VERY VERY specific set of circustances - not anything I have ever seen. Real life single stream session tops out at about 640mbit on every 2100 I have tried. The 3100 is quite a lot faster in real life (close to 1 Gbit) in my experience.

uzumaki

@jwt Sorry if I am mistaken, the only place I could find 3100 numbers were on the netgate Amazon product page. The 2100 numbers are from netgate.com.

jwt

@keyser the circumstances are literally iperf3 through the box.

jwt

@uzumaki likely one of the two is "old" then. I'll have someone in marketing find it and clean it up. thanks.!

uzumaki

@jwt Those were IMIX numbers in case you’re mistaking them for iperf3.

SteveITS

@uzumaki for reference for that comparison/difference, per https://shop.netgate.com/products/2100-base-pfsense :

Firewall (10k ACLs)
IPERF3 Traffic: 964 Mbps
IMIX Traffic: 249 Mbps

Also just for reference the 3100 was around $50 more expensive than the 2100, MSRP, IIRC, with half the RAM.

I mean I get it, because we have one and have eight-ish clients with one. But, the world moved on from 32 bit a while ago. We just moved a client last week who went from cable to gigabit fiber and I suggested they get a 4100 for the new office...they did not and kept the 3100. Just have to eval each situation I'd say...the ones that use VPN and/or 500+ Mbps and/or Suricata may be a better fit for the 4100. At least the 3100s will not just stop working.

In general I'd say Netgate has done a pretty good job keeping up older hardware...the SG-1000 for instance was "EOL" in 2019 but had updates through v22.05.

gweempose

How easy is it to transition from a 3100 to a 4100? I'm assuming you can just save your configuration and then use the .xml file to load the old settings onto the new device?

And one more question about the 4100. It looks like it has four 2.5 Gbps LAN ports, but the WAN port is only 1 Gbps. So even if I had a 2 Gbps feed coming from my ISP, the devices on my network would still only see about half that speed. Is this correct?

jimp

@gweempose said in 3100 will reach "End of Life" in 5 days:

How easy is it to transition from a 3100 to a 4100? I'm assuming you can just save your configuration and then use the .xml file to load the old settings onto the new device?

Since the 3100 has switched ports it can be a little trickier but TAC can convert the config for you, then all you'd have to do is import the adjusted config.

And one more question about the 4100. It looks like it has four 2.5 Gbps LAN ports, but the WAN port is only 1 Gbps. So even if I had a 2 Gbps feed coming from my ISP, the devices on my network would still only see about half that speed. Is this correct?

The labels on the ports are just labels reflecting the default assignments, you can reassign them any way you like. You can use any of the 2.5G "LAN" ports as WANs, you just need to change the interface assignments/config to match what you want.

johnpoz

@gweempose you can use any interface for wan. Just because port is "label" wan on the case doesn't mean you can't setup any other port as wan if you want.

I do believe there is some more too moving to 4100 from 3100.. The 3100 had switch ports, the 4100 has 6 discrete interfaces. So it would be a bit more than just import config - since the interfaces wouldn't be able to match up.

I do believe TAC would help you..

edit: hahah Jim beat me too it ;)

mer

@johnpoz said in 3100 will reach "End of Life" in 5 days:

Until it actually dies, or they no longer provide updates too it, I have no plans on replacing it ;)

I've got a SG-2440 that is in the same boat. I do have it sitting as a spare right now, but it still runs strong.

gweempose

@jimp said:

Since the 3100 has switched ports it can be a little trickier but TAC can convert the config for you, then all you'd have to do is import the adjusted config.

@johnpoz said:

I do believe TAC would help you..

Forgive my ignorance, but what is TAC?