• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

SG-2100 Network Interfaces Question

Scheduled Pinned Locked Moved General pfSense Questions
offloadinginterfacesg-2100
15 Posts 4 Posters 1.4k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    JonathanLee
    last edited by JonathanLee Dec 30, 2023, 5:10 PM Dec 30, 2023, 5:32 AM

    Hello fellow Netgate community members,

    Can you please help?

    Does anyone know the default recommended settings here for the SG2100??

    Screenshot 2023-12-29 at 9.30.02 PM.png

    Make sure to upvote

    1 Reply Last reply Reply Quote 0
    • S
      stephenw10 Netgate Administrator
      last edited by Dec 31, 2023, 7:47 PM

      Checksum offloading is enabled by default and should work on mvneta.

      J 1 Reply Last reply Dec 31, 2023, 8:16 PM Reply Quote 1
      • J
        JonathanLee @stephenw10
        last edited by Dec 31, 2023, 8:16 PM

        @stephenw10 Thank you,

        Is this the recommended now for SG-2100MAX

        Screenshot 2023-12-31 at 12.10.55 PM.png

        Make sure to upvote

        M 1 Reply Last reply Dec 31, 2023, 8:19 PM Reply Quote 0
        • M
          mcury @JonathanLee
          last edited by Dec 31, 2023, 8:19 PM

          @JonathanLee If using suricata, it is recommended that you disable LRO and hardware checksum offloading.
          https://docs.suricata.io/en/suricata-7.0.2/performance/packet-capture.html#offloading
          https://forum.netgate.com/topic/184858/suricata-blocking-ips-on-passlist-legacy-mode-blocking-both/75

          dead on arrival, nowhere to be found.

          J 1 Reply Last reply Dec 31, 2023, 8:20 PM Reply Quote 1
          • J
            JonathanLee @mcury
            last edited by JonathanLee Dec 31, 2023, 8:26 PM Dec 31, 2023, 8:20 PM

            @mcury Thanks for the reply,

            I do not use Suircata only Snort and Squid. I just always wondered what is recommended here for years.

            Make sure to upvote

            M 1 Reply Last reply Dec 31, 2023, 8:28 PM Reply Quote 0
            • M
              mcury @JonathanLee
              last edited by mcury Dec 31, 2023, 8:32 PM Dec 31, 2023, 8:28 PM

              @JonathanLee said in SG-2100 Network Interfaces Question:

              @mcury I do not use Suircata only Snort and Squid

              I don't think that there is a difference between Snort and Suricata when it comes to LRO/hardware checksum offload..

              bmeeks speaking about this

              more info: https://forum.netgate.com/topic/166908/snort-4-1-4_3-snort-inline-mode-crashes-wan-interfaces/5

              dead on arrival, nowhere to be found.

              J 1 Reply Last reply Dec 31, 2023, 8:33 PM Reply Quote 0
              • J
                JonathanLee @mcury
                last edited by Dec 31, 2023, 8:33 PM

                @mcury My issues is the 2100 is an ARM so it can't run inline mode and will not load *.SO rules.

                So is this a different on the 2100 @stephenw10 @bmeeks

                I have always wondered about this for years

                @stephenw10 said in SG-2100 Network Interfaces Question:

                Checksum offloading is enabled by default and should work on mvneta.

                Make sure to upvote

                M 1 Reply Last reply Dec 31, 2023, 8:35 PM Reply Quote 0
                • M
                  mcury @JonathanLee
                  last edited by mcury Dec 31, 2023, 8:36 PM Dec 31, 2023, 8:35 PM

                  @JonathanLee said in SG-2100 Network Interfaces Question:

                  Checksum offloading is enabled by default and should work on mvneta.

                  f1af9307-fe14-46ed-91e6-97008567da20-image.png

                  According to bmeeks, not when you are running Snort and/or Suricata. Legacy mode or not.

                  dead on arrival, nowhere to be found.

                  J 1 Reply Last reply Dec 31, 2023, 8:37 PM Reply Quote 1
                  • J
                    JonathanLee @mcury
                    last edited by Dec 31, 2023, 8:37 PM

                    @mcury Thank you

                    Make sure to upvote

                    1 Reply Last reply Reply Quote 1
                    • S
                      stephenw10 Netgate Administrator
                      last edited by Dec 31, 2023, 8:51 PM

                      Yeah I would disable it with Snort. Though I'm not aware of issues with it in mvneta specifically. It really doesn't help much so disabling it won't hurt.

                      J 1 Reply Last reply Dec 31, 2023, 9:08 PM Reply Quote 1
                      • J
                        JonathanLee @stephenw10
                        last edited by Dec 31, 2023, 9:08 PM

                        @stephenw10 Than you for the reply

                        Make sure to upvote

                        1 Reply Last reply Reply Quote 0
                        • B
                          bmeeks
                          last edited by Dec 31, 2023, 9:48 PM

                          The IDS/IPS packages prefer checkum offloading be disabled. And in many (or even most) cases you could expand that to "require" it be disabled. You are usually better off disabling all the hardware-assisted features such as LRO, checksum offloading, etc., when using either of the IDS/IPS packages.

                          J 1 Reply Last reply Dec 31, 2023, 9:54 PM Reply Quote 3
                          • J
                            JonathanLee @bmeeks
                            last edited by Dec 31, 2023, 9:54 PM

                            @bmeeks thanks for the reply

                            Make sure to upvote

                            1 Reply Last reply Reply Quote 0
                            • J
                              JonathanLee
                              last edited by Dec 31, 2023, 9:54 PM

                              Happy new year everyone

                              Make sure to upvote

                              M 1 Reply Last reply Dec 31, 2023, 10:34 PM Reply Quote 0
                              • M
                                mcury @JonathanLee
                                last edited by Dec 31, 2023, 10:34 PM

                                @JonathanLee said in SG-2100 Network Interfaces Question:

                                Happy new year everyone

                                Happy new year to everyone !! =)

                                Going to meet my friend now, Mr. Jack Daniels.. Nice guy.. hehe

                                dead on arrival, nowhere to be found.

                                1 Reply Last reply Reply Quote 1
                                15 out of 15
                                • First post
                                  15/15
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                  This community forum collects and processes your personal information.
                                  consent.not_received