• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

SG-2100 Network Interfaces Question

Scheduled Pinned Locked Moved General pfSense Questions
offloadinginterfacesg-2100
15 Posts 4 Posters 2.1k Views 5 Watching
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J Offline
    JonathanLee
    last edited by JonathanLee Dec 30, 2023, 5:10 PM Dec 30, 2023, 5:32 AM

    Hello fellow Netgate community members,

    Can you please help?

    Does anyone know the default recommended settings here for the SG2100??

    Screenshot 2023-12-29 at 9.30.02 PM.png

    Make sure to upvote

    1 Reply Last reply Reply Quote 0
    • S Online
      stephenw10 Netgate Administrator
      last edited by Dec 31, 2023, 7:47 PM

      Checksum offloading is enabled by default and should work on mvneta.

      J 1 Reply Last reply Dec 31, 2023, 8:16 PM Reply Quote 1
      • J Offline
        JonathanLee @stephenw10
        last edited by Dec 31, 2023, 8:16 PM

        @stephenw10 Thank you,

        Is this the recommended now for SG-2100MAX

        Screenshot 2023-12-31 at 12.10.55 PM.png

        Make sure to upvote

        M 1 Reply Last reply Dec 31, 2023, 8:19 PM Reply Quote 0
        • M Offline
          mcury Rebel Alliance @JonathanLee
          last edited by Dec 31, 2023, 8:19 PM

          @JonathanLee If using suricata, it is recommended that you disable LRO and hardware checksum offloading.
          https://docs.suricata.io/en/suricata-7.0.2/performance/packet-capture.html#offloading
          https://forum.netgate.com/topic/184858/suricata-blocking-ips-on-passlist-legacy-mode-blocking-both/75

          dead on arrival, nowhere to be found.

          J 1 Reply Last reply Dec 31, 2023, 8:20 PM Reply Quote 1
          • J Offline
            JonathanLee @mcury
            last edited by JonathanLee Dec 31, 2023, 8:26 PM Dec 31, 2023, 8:20 PM

            @mcury Thanks for the reply,

            I do not use Suircata only Snort and Squid. I just always wondered what is recommended here for years.

            Make sure to upvote

            M 1 Reply Last reply Dec 31, 2023, 8:28 PM Reply Quote 0
            • M Offline
              mcury Rebel Alliance @JonathanLee
              last edited by mcury Dec 31, 2023, 8:32 PM Dec 31, 2023, 8:28 PM

              @JonathanLee said in SG-2100 Network Interfaces Question:

              @mcury I do not use Suircata only Snort and Squid

              I don't think that there is a difference between Snort and Suricata when it comes to LRO/hardware checksum offload..

              bmeeks speaking about this

              more info: https://forum.netgate.com/topic/166908/snort-4-1-4_3-snort-inline-mode-crashes-wan-interfaces/5

              dead on arrival, nowhere to be found.

              J 1 Reply Last reply Dec 31, 2023, 8:33 PM Reply Quote 0
              • J Offline
                JonathanLee @mcury
                last edited by Dec 31, 2023, 8:33 PM

                @mcury My issues is the 2100 is an ARM so it can't run inline mode and will not load *.SO rules.

                So is this a different on the 2100 @stephenw10 @bmeeks

                I have always wondered about this for years

                @stephenw10 said in SG-2100 Network Interfaces Question:

                Checksum offloading is enabled by default and should work on mvneta.

                Make sure to upvote

                M 1 Reply Last reply Dec 31, 2023, 8:35 PM Reply Quote 0
                • M Offline
                  mcury Rebel Alliance @JonathanLee
                  last edited by mcury Dec 31, 2023, 8:36 PM Dec 31, 2023, 8:35 PM

                  @JonathanLee said in SG-2100 Network Interfaces Question:

                  Checksum offloading is enabled by default and should work on mvneta.

                  f1af9307-fe14-46ed-91e6-97008567da20-image.png

                  According to bmeeks, not when you are running Snort and/or Suricata. Legacy mode or not.

                  dead on arrival, nowhere to be found.

                  J 1 Reply Last reply Dec 31, 2023, 8:37 PM Reply Quote 1
                  • J Offline
                    JonathanLee @mcury
                    last edited by Dec 31, 2023, 8:37 PM

                    @mcury Thank you

                    Make sure to upvote

                    1 Reply Last reply Reply Quote 1
                    • S Online
                      stephenw10 Netgate Administrator
                      last edited by Dec 31, 2023, 8:51 PM

                      Yeah I would disable it with Snort. Though I'm not aware of issues with it in mvneta specifically. It really doesn't help much so disabling it won't hurt.

                      J 1 Reply Last reply Dec 31, 2023, 9:08 PM Reply Quote 1
                      • J Offline
                        JonathanLee @stephenw10
                        last edited by Dec 31, 2023, 9:08 PM

                        @stephenw10 Than you for the reply

                        Make sure to upvote

                        1 Reply Last reply Reply Quote 0
                        • B Offline
                          bmeeks
                          last edited by Dec 31, 2023, 9:48 PM

                          The IDS/IPS packages prefer checkum offloading be disabled. And in many (or even most) cases you could expand that to "require" it be disabled. You are usually better off disabling all the hardware-assisted features such as LRO, checksum offloading, etc., when using either of the IDS/IPS packages.

                          J 1 Reply Last reply Dec 31, 2023, 9:54 PM Reply Quote 3
                          • J Offline
                            JonathanLee @bmeeks
                            last edited by Dec 31, 2023, 9:54 PM

                            @bmeeks thanks for the reply

                            Make sure to upvote

                            1 Reply Last reply Reply Quote 0
                            • J Offline
                              JonathanLee
                              last edited by Dec 31, 2023, 9:54 PM

                              Happy new year everyone

                              Make sure to upvote

                              M 1 Reply Last reply Dec 31, 2023, 10:34 PM Reply Quote 0
                              • M Offline
                                mcury Rebel Alliance @JonathanLee
                                last edited by Dec 31, 2023, 10:34 PM

                                @JonathanLee said in SG-2100 Network Interfaces Question:

                                Happy new year everyone

                                Happy new year to everyone !! =)

                                Going to meet my friend now, Mr. Jack Daniels.. Nice guy.. hehe

                                dead on arrival, nowhere to be found.

                                1 Reply Last reply Reply Quote 1
                                15 out of 15
                                • First post
                                  15/15
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                  This community forum collects and processes your personal information.
                                  consent.not_received