PC Engines apu2 experiences

Stewart

@thewaterbug
We have a lot of the APU2C4 units out there, and they make an APU4 now with 4 ports instead of 3 if that interests you. The largest client we use it at is a hotel with 6 buildings and normally around 150-200 guests at a time on a 500Mbit fiber connection (~30 devices on the Office LAN network and ~150 devices on the Tenant OPT1 network). No issues. Not sure it could go much higher as a max speed but it is running Suricata (On Office and Tenant networks), pfBlocker (On office and Tenant networks), and Squid+ClamAV+SquidGuard (On the Office network only). No issues there. We have other clients using the IPSEC and OpenVPN and they work very well. Don't know top speed but it certainly doesn't feel slow. I can't compare to the MBT-2220 with 2 cores that are likely twice as strong (Jaguar isn't exactly high IPC) but the APU2C4 can do 500Mbps just fine. Lately I've seen Suricata go wonky and cap out the CPUs on several units but that appears to be a log issue. Uninstalling/reinstalling seems to fix it so far. I hope that gives you some understanding.

TheWaterbug

Thanks! That's exactly what I wanted to hear.

Stewart

@thewaterbug
Just don't use snort. It is single-threaded and these don't have great single-threaded power. I've never seen Squid or pfBlocker cause hiccups. Suricata runs much better if you disable stream events but you'll want to keep your eye on it for a bit to make sure it runs smoothly. If there are CPU spikes you'll notice quickly enough.

TheWaterbug

Ah, apparently I don't have an APU2. I have an APU1. I booted into TinyCore and got the following:

coreboot table found at 0x7efdf000.
Found chipset "AMD SB7x0/SB8x0/SB9x0".
Enabling flash write... OK.
Identifying board "PC Engines apu1"... OK.
Found Macronix flash chip "MX25L1605A/MX25L1606E/MX25L1608E" (2048 kB, SPI) mapped at physical address 0xffe00000.
Error: Image size (8388608 B) doesn't match the flash chip's size (2097152 B)!

When I boot this board my console says:

PC Engines APU BIOS build date: Apr  5 2014

and my pfsense Dashboard reports:

System	Netgate APU
Netgate Device ID: 400a2blahblahblah

BIOS	Vendor: coreboot
Version: SageBios_PCEngines_APU-45
Release Date: Sat Apr 5 2014

Is that the latest legacy version for this board?

I suppose I got confused because I purchased this from Netgate in 2014 as a " Netgate APU2".

Veldkornet

I don’t know if Netgate make their own versions of the BIOS (because it says “SageBIOS”). I know if you check in package manager on pfSense, there is a package for the apu from them.

However, for the generic firmware, there are much newer ones available. See here: https://pcengines.github.io/#top

If you scroll a few posts back, we were “just discussing it” and how to flash the BIOS.

TheWaterbug

^^
but the oldest board in any of those lists [for the legacy releases] is "APU2", and it looks like have an APU with no digit (e.g. an APU1).

I've read many places on this forum that, for pfsense, the "mainline" releases are to be avoided.

Veldkornet

I don’t know why mainline’s are to be avoided, I have 4.8.0.5 running and it works just fine.

I think with the flash utility you can backup your existing firmware if you can no longer find it on the internet. Then you can downgrade if you have problems.

fireodo

@veldkornet said in PC Engines apu2 experiences:

I don’t know why mainline’s are to be avoided, I have 4.8.0.5 running and it works just fine.

I think with the flash utility you can backup your existing firmware if you can no longer find it on the internet. Then you can downgrade if you have problems.

Agree with you, but why update if everything is working well? :-) Is there any benefit?

Veldkornet

@fireodo said in PC Engines apu2 experiences:

Agree with you, but why update if everything is working well? :-) Is there any benefit?

Well, I'm not saying that you have to do anything. But you could use that same argument for everything software related... Why update Windows if everything works? ?

You can read through all of the release notes yourself, but they fix bugs and release new features every so often. Recently, they've enabled ECC memory in 4.8.0.5

VAMike

@thewaterbug said in PC Engines apu2 experiences:

I suppose I got confused because I purchased this from Netgate in 2014 as a " Netgate APU2".

yes, it's been confusing people for years. all the netgate apu's were based on the older pcengines apu1 design, regardless of their naming convention.

@veldkornet said in PC Engines apu2 experiences:

Recently, they've enabled ECC memory in 4.8.0.5

not for the apu1

stephenw10

@veldkornet said in PC Engines apu2 experiences:

I don’t know if Netgate make their own versions of the BIOS (because it says “SageBIOS”).

We didn't.

It's possible to put the newer BIOS versions on APU1 if you want. I did it a while back just to test if it could be done:

BIOS 	Vendor: coreboot
Version: v4.8.0.1
Release Date: Fri Jun 8 2018

That would be what was sold by Netgate as the APU2 or APU4 to indicate 2 or 4GB of RAM at the time. Also as the VK-T40E2/4 from the pfSense store.

I'm not aware of any advantages that BIOS brings but mine has been running solidly with for months just as one data point.
[Edit: actually it does appear to add new devices as bootable]

See: https://forum.netgate.com/post/777287
Steve

TheWaterbug

@vamike said in PC Engines apu2 experiences:

@thewaterbug said in PC Engines apu2 experiences:

I suppose I got confused because I purchased this from Netgate in 2014 as a " Netgate APU2".

yes, it's been confusing people for years. all the netgate apu's were based on the older pcengines apu1 design, regardless of their naming convention.

Aha! Thank you. I am very slightly less confused, now.

So I apparently have only a dual-core box with no AES-NI support. And the PCEngines "APU2xxx" was never sold by Netgate, correct?

Does my Netgate APU unit then belong in the "Official Netgate Hardware" forum?

TheWaterbug

@thewaterbug said in PC Engines apu2 experiences:

How does the APU2 stack up against the MBT-2220, performance-wise, for running pfsense, IPSec, and OpenVPN? ...

The APU2 has: "AMD Embedded G series GX-412TC, 1 GHz quad Jaguar core with 64 bit and AES-NI support, 32K data + 32K instruction cache per core, shared 2MB L2 cache."

while the MBT-2220 has: "Intel Atom E3826 (2 x 1.46 GHz, 1MB cache, AES-NI)"

That comparison was inaccurate, since I have an APU1, not an APU2. The correct comparison is now:

The APU1 has: "AMD G series T40E APU, 1 GHz dual core (Bobcat core) with 64 bit support, 32K data + 32K instruction + 512KB L2 cache per core."

while the MBT-2220 has: "Intel Atom E3826 (2 x 1.46 GHz, 1MB cache, AES-NI)"

So my spiffy new MBT-2220 units are clearly more performant than my old APU units, especially for anything that can use AES-NI acceleration.

stephenw10

@thewaterbug said in PC Engines apu2 experiences:

Does my Netgate APU unit then belong in the "Official Netgate Hardware" forum?

You can open a thread there but there are a lot of APU users who did not purchase through our store. You might well get more views here.

Steve

TheWaterbug

^^
Then I'll keep it here, where I get more views!

By this weekend I should have one of my APU units re-installed with 2.4.4 and an IPSec tunnel to an MBT-2220 running 2.4.4. Can I use iperf between them to measure tunnel performance? Max line rate is only 20 Mbps.

If I can saturate that with AES turn on (software only) then there's no urgency to upgrade the hardware.

Stewart

@thewaterbug

We used to use the APU1C2 before changing to the APU2C4 with the advent of 2.5 needing aes-ni. We tested them at 300Mbps and, although I don't recall actual numbers for AES in software we were able to get decent speeds and nobody complained. I think you'll be fine with 20Mbps.

TheWaterbug

Thanks! I guess I missed the very loud debate about 2.5 requiring AES-NI. I'll probably limp along with my ancient hardware until support for 2.4 goes away.

stephenw10

It should be no problem at 20Mbps.
2.5 is still a way out.

Steve

VAMike

and who knows, maybe by the time 2.5 comes along, they will have backed off this pointless aes-ni requirement and won't force retirement of working hardware.

Stewart

@vamike

While I wish they didn't implement it to be mandatory until the next major revision (and maybe 2.5 is a major revision, idk), I really don't see much of a problem. They gave us something like 2 years notice and 2.4 will be supported for at least a year after 2.5 is released which is likely still some months away as FreeBSD12 isn't even out yet. By that time most of us will have more old equipment that supports aes-ni laying around. For my company it means having to spend about another $1,500 in hardware to replace 6 more devices with APU2s but that's a small price compared to purchasing the alternatives.

I do feel bad for people who paid money for devices specifically for pfSense, like the APU1 series, only to find it will be retired 3 years later but the 2.4 line will still work in the them without issue forever. You still get 5 years of supported service life out of the equipment. The other big name firewalls we use are SonicWall and they don't offer anything beyond the 5 year mark, either.

I don't know what precipitated the requirement but I appreciate the big heads up. I hope it's for more than VPN traffic and it is somehow used foundationally to further enhance security. I also hope it clears up the confusion as to what the aes-ni settings should be to get the best performance out of our boxes. I guess we'll see once it launches.