next »

[nyit_dk]

Hi

Is there any concern, running pfsense on the Alix 2D19 board, instead of the 2D13? (128MB mem vs. 256MB)

[Jason Litka]

I've never heard of the 2D19.

In any case, I'm not sure I'd go with it.  These systems are slow enough on 256MB.  With 128MB you're riding the bare minimum supported for pfSense.  You'll be limited to using it as a firewall only.  No snort, VPN, L7 filtering, or any other interesting features.

[nyit_dk]

Thank you for youre reply, if the Alix 2Dxx systems are slow, what hardware do you recommend, if the use is small business ~ 25 users, 1 or 2 IPSEC VPN tunnels.

And what is it that uses the memory? is it VPN tunnels or firewall rules or?

[rpsmith]

if you can wait a few weeks for it to be release, I would go with a Soekris net6501.

http://lists.soekris.com/pipermail/soekris-tech/2009-December/016250.html

Roy...

[nyit_dk]

I guess that the Soekris net6501 is another price.. ?

The Alix 2D13/19 is at ~ 150USD

[rpsmith]

I don't think they have released a price yet but I would expect it to be well over $300 USD.  alix2d13 might be your best bet depending on your Internet connection speed and how much VPN traffic are you expecting.

Roy...

[Jason Litka]

The 2D13 is a fine board for light use, I have one at home.  It works well for connections up to around 50/50 as long as you don't use any memory- or cpu-heavy options (like the ones I mentioned).  If you have need for snort, L7, VPN, etc then you should consider an Atom or something else faster.

As to the Soekris net6501, I'll believe it when I see it.  I seriously doubt that it will be available in a couple weeks.

[nyit_dk]

I have done some tests, and the WAN/LAN throughput on the Alix 2D19 is ~90mbit/s and IPSEC tunnel is ~70mbit/s so I guess that is decent?

[Jason Litka]

None of the Alix boards are capable of running IPSec at 70mbit/s, not even with a crypto accelerator.

[nyit_dk]

Well.. I did the test.. and it showed ~70mbit/s IPSEC

[jimp]

I'd seriously suspect the test was wrong then (or perhaps you're only doing AH and not ESP?) :-)

No matter what options have been chosen, I've never been able to push more than about 22Mbit/s through IPsec in tunnel mode with ESP.

http://doc.pfsense.org/index.php/Are_cryptographic_accelerators_supported

[Jason Litka]

I'd seriously suspect the test was wrong then (or perhaps you're only doing AH and not ESP?) :-)

No matter what options have been chosen, I've never been able to push more than about 22Mbit/s through IPsec in tunnel mode with ESP.

http://doc.pfsense.org/index.php/Are_cryptographic_accelerators_supported

Yup, I got about 18Mbit/s using the built-in acceleration and just about double that using the vpn1411.

[rpsmith]

Latest Soekris News:

"March 28, 2011:"

"We're very excited about some upcoming changes at Soekris!  In addition to our updated brand identity, logo and website, Soekris is launching several new products:"

"-Design work is completed on the net6xxx series. We expect to being testing prototypes this week, and production boards to be in stock and ready to ship by May 2011"

Roy...

[Jason Litka]

So a few more months then.

On a related note, the specs just changed.  Prior to their site redesign it said 600MHz-1.6GHz and 512MB-2048MB of RAM, now it caps out at 1GHz and 1024MB of RAM unless you order a "custom configuration" (probably in bulk).