Hi all,
I upgraded from OPNsense 26.1.11_10 to 26.7.3_11 yesterday. The upgrade itself completed successfully and the firewall came back online.
This morning internet was down and the OPNsense UI was not reachable. At the console I saw repeated messages that looked like:
atlantic: FLB> F/W successfully loaded from flash
aq0: ring 0: __PAGESIZE=4096 MCLBYTES=2048 hw->max_frame_size=2048
aq0: ring 1: __PAGESIZE=4096 MCLBYTES=2048 hw->max_frame_size=2048
aq0: ring 2: __PAGESIZE=4096 MCLBYTES=2048 hw->max_frame_size=2048
aq0: ring 3: __PAGESIZE=4096 MCLBYTES=2048 hw->max_frame_size=2048
I could not log in at the console because the messages were scrolling, so I did a hard reboot. After reboot the system came back up.
Hardware/interface:
WAN: aq0
NIC: Aquantia AQtion AQC107 NBase-T / IEEE 802.3an Ethernet Controller
FreeBSD driver: aq / if_atlantic
dev.aq.0.fw_ver: 3.1.121
dev.aq.0.iflib.driver_version: 0.2.0
Link: 2500Base-T full-duplex
Configuration detail that may matter:
Services > Intrusion Detection was enabled
Capture mode: Netmap (IPS)
Interface: WAN
Zenarmor is also installed, but WAN/aq0 was not selected in Zenarmor.
After disabling OPNsense Intrusion Detection / Suricata, aq0 no longer shows NETMAP in ifconfig options. Before disabling it, aq0 showed NETMAP. Current aq0 counters are clean: errs 0, idrops 0, colls 0.
So my current suspicion is a possible interaction between Suricata IPS/Netmap and the Aquantia AQC107/aq driver after the 26.7 upgrade.
I am leaving Intrusion Detection disabled for now to see if the system remains stable.
Has anyone else seen this with AQC107 / aq0 / Atlantic NICs and Suricata IPS on WAN after upgrading to 26.7.x?
Small update:
After disabling Services > Intrusion Detection / Suricata, aq0 no longer shows NETMAP in ifconfig options.
Before disabling IPS on WAN:
aq0 options included NETMAP
After disabling IPS on WAN:
options=4802028<VLAN_MTU,JUMBO_MTU,WOL_MAGIC,HWSTATS,MEXTPG>
It has now been stable for several hours with no new aq0 / atlantic / FLB / link reset messages in dmesg.
So this still looks like Suricata IPS/Netmap on the WAN interface triggering the aq/atlantic reinitialization loop after 26.7.3_11. Not sure if this is specific to AQC107 or a broader Netmap/driver interaction.