OPNsense Forum

English Forums => Zenarmor (Sensei) => Topic started by: DocGonzo74 on February 02, 2022, 02:33:43 PM

Title: Zenarmor + igb interfaces
Post by: DocGonzo74 on February 02, 2022, 02:33:43 PM
Upgraded to 22.1 and really want to put this package into blocking mode.  So far all I've been able to get working is passive mode.  Every time I switch to emulated or native routed mode, my throughput tanks.  I get a warning about moving to the netmap kernel. 

Is there a netmap kernel I should be using with 22.1? 
Title: Re: Zenarmor + igb interfaces
Post by: sy on February 02, 2022, 03:07:15 PM
Hi,

Normally, Netmap is compatible with igb drivers. Do you have VLAN(s)? or please send a bug report and then look into the error. Please select all checkboxes.
Title: Re: Zenarmor + igb interfaces
Post by: DocGonzo74 on February 02, 2022, 05:27:23 PM
I'm using igb in the raw for my WAN interfaces.  I have LAGG w/ VLAN set up for my internal networks. 
Title: Re: Zenarmor + igb interfaces
Post by: sy on February 02, 2022, 06:12:54 PM
Hi,

Do you protect the parent LAGG interface or individual VLAN interface(s)? And is your switch configured to send all packets of a session to the same interface?


Title: Re: Zenarmor + igb interfaces
Post by: DocGonzo74 on February 02, 2022, 06:29:47 PM
I have sticky connections configured..  At the moment, I'm only able to protect the underlying interfaces (igb0,1,2,3) without an error.  When I try to stick the VLAN or the LAGG_VLAN interface (my LAN interface) I get an error from Zenarmor telling me to move to the netmap emulated driver. 

The link in the error points me to an older kernel.. I thought I read that the netmap kernel was integrated but I may be dreaming that bit :)
Title: Re: Zenarmor + igb interfaces
Post by: mb on February 02, 2022, 06:38:26 PM
@DocGonzo74,

Yes, we sponsored an effort on the lagg interface driver's netmap compatibility. This is currently in effect.

Having said that, we're getting mixed feedback about lagg + vlans. Some feedback says it's working perfectly, while some people have experienced problems.

We're not done here, and exploring new methodologies; and will keep the forum updated about developments.

Our advise - for now : if you have lagg + vlans, better to protect individual physical interfaces and configure the switch so that it distributes the packets for a single connection to the same lagg port.
Title: Re: Zenarmor + igb interfaces
Post by: DocGonzo74 on February 02, 2022, 07:08:48 PM
Got it.  Will keep an eye out for updates. 

Many thanks for the fast replies!