1
22.1 Legacy Series / Re: USB installer boot hangs at pflog0: permanently promiscuous mode enabled
« on: May 25, 2022, 10:36:27 am »
OK, thanks. I'll try that.
Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
Pages: [1]
2
22.1 Legacy Series / Re: USB installer boot hangs at pflog0: permanently promiscuous mode enabled
« on: May 24, 2022, 09:22:36 pm »
I agree, it also does shut down with messages when pressing the power off button. But how to solve it? I am a bit out of my league here tbh 
These would indicate the system booted ok but there is no default serial console attached, likely because the serial is not available at the default location.
3
22.1 Legacy Series / Re: USB installer boot hangs at pflog0: permanently promiscuous mode enabled
« on: May 24, 2022, 08:00:25 pm »
Not really, this is a new one. Also tried with another USB stick.
edit: used following command on both USB sticks: sudo dd if=OPNsense-22.1.2-OpenSSL-serial-amd64.img of=/dev/disk2 bs=1M
edit2: found this comment regarding the error: https://github.com/trueos/trueos-core/issues/1435
edit: used following command on both USB sticks: sudo dd if=OPNsense-22.1.2-OpenSSL-serial-amd64.img of=/dev/disk2 bs=1M
edit2: found this comment regarding the error: https://github.com/trueos/trueos-core/issues/1435
Quote
When a USB image is created it's a fixed size and knows nothing about the device it will end up on. It's just a series of bytes be copied bit by bit using dd or a similiar tool to your usb stick.
GPT the partition scheme here expects two headers with partition tables. One at the front of the disk and one at the very end for redundancy. Since the usb stick you are copying to is bigger then the image the gpt header at the end of the image gets put some in the middle of your usb stick. The OS expects to see it at the last LBA (Logical Block Addressing) meaning the end of your usb stick.
As such the host thinks your usb stick is now "damaged" as it can't find the secondary header. This header exists on the usb stick just not where it is looking. You could also have a different gpt secondary header at the end of the usb stick which can cause some different fun behavior.
This is all as is expected and shouldn't affect anything.
The recover command will take the Main gpt header and copy it to the end of the usb stick. Clearing up these and some related error messages. But not everyone burning usb sticks is doing it from a freebsd box with access to gpart and there should be no functional difference of the usb stick.
4
22.1 Legacy Series / Re: USB installer boot hangs at pflog0: permanently promiscuous mode enabled
« on: May 24, 2022, 07:18:26 pm »
So circling back on this issue. Tried a lot of settings in BIOS and boot menu, always with the same result as stated in the post start: the boot does not continue after
Interface is not up on 192.168.1.1 btw. Or should I plug into igb2?
Anyone other ideas?
Code: [Select]
igb2: link state changed to UP
debugnet_any_ifnet_update: Bad dn_init result from igb2 (ifp 0xfffff80001821000), ignoring.
ichsmb0: <Intel Denverton SMBus controller> port 0xe000-0xe01f mem 0xdff16000-0xdff160ff irq 23 at device 31.4 on pci0
smbus0: <System Management Bus> on ichsmb0
lo0: link state changed to UP
pflog0: permanently promiscuous mode enabledInterface is not up on 192.168.1.1 btw. Or should I plug into igb2?
Anyone other ideas?
5
22.1 Legacy Series / Re: USB installer boot hangs at pflog0: permanently promiscuous mode enabled
« on: April 04, 2022, 02:26:38 pm »
Sorry for the confusion, I initially did the install with 22.1.2 with OP as result. I'll try to do a new test coming Friday and play around a bit with serial console settings (using minicom). Could it be during boot the baud rate of the serial console changes?
Btw the hardware works, I installed pfsense without any hickups using the same hardware. Only thing that changed is the OS.
Btw the hardware works, I installed pfsense without any hickups using the same hardware. Only thing that changed is the OS.
6
22.1 Legacy Series / Re: USB installer boot hangs at pflog0: permanently promiscuous mode enabled
« on: April 02, 2022, 08:16:59 pm »
Thanks for the pointer. Using OPNsense-22.1.2-OpenSSL-serial-amd64.img.bz2 tough.
7
22.1 Legacy Series / USB installer boot hangs at pflog0: permanently promiscuous mode enabled
« on: April 02, 2022, 09:29:09 am »
Hi all
Currentely I have pfsense installed on a SSD (Crucial CT275MX300SSD1) on the D33SL motherboard: http://en.hanzsung.com/prod_view.aspx?typeid=88&id=437&fid=t3:88:3
I want to install OPNsense 22.1 (edit: OPNsense-22.1.2-OpenSSL-serial-amd64.img.bz2) on top of it using an USB installer via the serial image (no VGA available) using the DD command on macOS. USB stick is JetFlash Transcend 128GB 1100.
Going for a clean install and documented my current config.
However it seems I can't get into installer mode (using installer/opnsense) due to the boot hangs on the last statement called "pflog0: permanently promiscuous mode enabled".
Tried playing around with UEFI vs legacy but without any luck. Any thoughts how to get this going? Below the full boot screen dump which also shows the detected hardware and the point it hangs.
Currentely I have pfsense installed on a SSD (Crucial CT275MX300SSD1) on the D33SL motherboard: http://en.hanzsung.com/prod_view.aspx?typeid=88&id=437&fid=t3:88:3
I want to install OPNsense 22.1 (edit: OPNsense-22.1.2-OpenSSL-serial-amd64.img.bz2) on top of it using an USB installer via the serial image (no VGA available) using the DD command on macOS. USB stick is JetFlash Transcend 128GB 1100.
Going for a clean install and documented my current config.
However it seems I can't get into installer mode (using installer/opnsense) due to the boot hangs on the last statement called "pflog0: permanently promiscuous mode enabled".
Tried playing around with UEFI vs legacy but without any luck. Any thoughts how to get this going? Below the full boot screen dump which also shows the detected hardware and the point it hangs.
Code: [Select]
Loading kernel...
/boot/kernel/kernel text=0x1876c0 text=0xe90e80 text=0x689c4c data=0x140 data=0x1cb3c8+0x433c38 syms=[0x8+0x19d4c0+0x8+0x1bc662]
Loading configured modules...
/boot/kernel/if_enc.ko size 0x4b58 at 0x235a000
/boot/kernel/if_bridge.ko size 0xe4f0 at 0x235f000
loading required module 'bridgestp'
/boot/kernel/bridgestp.ko size 0x7870 at 0x236e000
/boot/kernel/carp.ko size 0xf460 at 0x2376000
/boot/kernel/pfsync.ko size 0xe318 at 0x2386000
loading required module 'pf'
/boot/kernel/pf.ko size 0x73db0 at 0x2395000
can't find '/etc/hostid'
/boot/entropy size=0x1000
/boot/kernel/pflog.ko size 0x3b18 at 0x240a000
/boot/kernel/if_lagg.ko size 0x181d0 at 0x240e000
loading required module 'if_infiniband'
/boot/kernel/if_infiniband.ko size 0x3538 at 0x2427000
/boot/kernel/if_gre.ko size 0xba48 at 0x242b000
staging 0x71200000 (not copying) tramp 0x711f9000 PT4 0x711f0000
Start @ 0xffffffff80388000 ...
EFI framebuffer information:
addr, size 0x0, 0x0
dimensions 0 x 0
stride 0
masks 0x00000000, 0x00000000, 0x00000000, 0x00000000
KDB: debugger backends: ddb
KDB: current backend: ddb
---<<BOOT>>---
Copyright (c) 1992-2021 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 13.0-STABLE stable/22.1-n248059-267a40127d5 SMP amd64
FreeBSD clang version 13.0.0 (git@github.com:llvm/llvm-project.git llvmorg-13.0.0-0-gd7b669b3a303)
VT(vga): resolution 640x480
CPU: Intel(R) Atom(TM) CPU C3558 @ 2.20GHz (2200.21-MHz K8-class CPU)
Origin="GenuineIntel" Id=0x506f1 Family=0x6 Model=0x5f Stepping=1
Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT>
Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,>
AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
AMD Features2=0x101<LAHF,Prefetch>
Structured Extended Features=0x2294e283<FSGSBASE,TSCADJ,SMEP,ERMS,NFPUSG,MPX,PQE,RDSEED,SMAP,CLFLUSHOPT,PROCTRACE,SHA>
Structured Extended Features3=0xac000400<MD_CLEAR,IBPB,STIBP,ARCH_CAP,SSBD>
XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
IA32_ARCH_CAPS=0x69<RDCL_NO,SKIP_L1DFL_VME,MDS_NO>
VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID,VID,PostIntr
TSC: P-state invariant, performance statistics
real memory = 8589934592 (8192 MB)
avail memory = 8218505216 (7837 MB)
Event timer "LAPIC" quality 600
ACPI APIC Table: <INTEL TIANO >
WARNING: L1 data cache covers fewer APIC IDs than a core (0 < 1)
FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs
FreeBSD/SMP: 1 package(s) x 4 core(s)
random: registering fast source Intel Secure Key RNG
random: fast provider: "Intel Secure Key RNG"
random: unblocking device.
ioapic0 <Version 2.0> irqs 0-23
Launching APs: 1 3 2
wlan: mac acl policy registered
random: entropy device external interface
kbd1 at kbdmux0
WARNING: Device "spkr" is Giant locked and may be deleted before FreeBSD 14.0.
vtvga0: <VT VGA driver>
efirtc0: <EFI Realtime Clock>
efirtc0: registered as a time-of-day clock, resolution 1.000000s
aesni0: <AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS,SHA1,SHA256>
acpi0: <ALASKA A M I >
acpi0: Power Button (fixed)
cpu0: <ACPI CPU> on acpi0
hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
Timecounter "HPET" frequency 24000000 Hz quality 950
Event timer "HPET" frequency 24000000 Hz quality 550
Event timer "HPET1" frequency 24000000 Hz quality 440
Event timer "HPET2" frequency 24000000 Hz quality 440
Event timer "HPET3" frequency 24000000 Hz quality 440
Event timer "HPET4" frequency 24000000 Hz quality 440
atrtc0: <AT realtime clock> port 0x70-0x77 irq 8 on acpi0
atrtc0: Warning: Couldn't map I/O.
atrtc0: registered as a time-of-day clock, resolution 1.000000s
Event timer "RTC" frequency 32768 Hz quality 0
attimer0: <AT timer> port 0x40-0x43,0x50-0x53 irq 0 on acpi0
Timecounter "i8254" frequency 1193182 Hz quality 0
Event timer "i8254" frequency 1193182 Hz quality 100
Timecounter "ACPI-fast" frequency 3579545 Hz quality 900
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x1808-0x180b on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
pcib1: <ACPI PCI-PCI bridge> irq 16 at device 6.0 on pci0
pci1: <ACPI PCI bus> on pcib1
pci1: <processor> at device 0.0 (no driver attached)
pcib2: <ACPI PCI-PCI bridge> mem 0xdfee0000-0xdfefffff irq 16 at device 9.0 on pci0
pci2: <ACPI PCI bus> on pcib2
igb0: <Intel(R) I210 (Fiber)> port 0xd000-0xd01f mem 0xdfc00000-0xdfc7ffff,0xdfc80000-0xdfc83fff irq 16 at device 0.0 on pci2
igb0: EEPROM V3.20-0 eTrack 0x80000558
igb0: Using 1024 TX descriptors and 1024 RX descriptors
igb0: Using 4 RX queues 4 TX queues
igb0: Using MSI-X interrupts with 5 vectors
igb0: Ethernet address: 00:e2:69:11:8c:67
igb0: netmap queues/slots: TX 4/1024, RX 4/1024
pcib3: <ACPI PCI-PCI bridge> mem 0xdfec0000-0xdfedffff irq 17 at device 10.0 on pci0
pci3: <ACPI PCI bus> on pcib3
igb1: <Intel(R) I210 (Fiber)> port 0xc000-0xc01f mem 0xdfb00000-0xdfb7ffff,0xdfb80000-0xdfb83fff irq 17 at device 0.0 on pci3
igb1: EEPROM V3.20-0 eTrack 0x80000558
igb1: Using 1024 TX descriptors and 1024 RX descriptors
igb1: Using 4 RX queues 4 TX queues
igb1: Using MSI-X interrupts with 5 vectors
igb1: Ethernet address: 00:e2:69:11:8c:66
igb1: netmap queues/slots: TX 4/1024, RX 4/1024
pcib4: <ACPI PCI-PCI bridge> mem 0xdfea0000-0xdfebffff irq 18 at device 11.0 on pci0
pci4: <ACPI PCI bus> on pcib4
igb2: <Intel(R) I210 Flashless (Copper)> port 0xb000-0xb01f mem 0xdfa00000-0xdfa1ffff,0xdfa20000-0xdfa23fff irq 18 at device 0.0 on pci4
igb2: NVM V0.6 imgtype6
igb2: Using 1024 TX descriptors and 1024 RX descriptors
igb2: Using 4 RX queues 4 TX queues
igb2: Using MSI-X interrupts with 5 vectors
igb2: Ethernet address: 00:e2:26:91:18:fb
igb2: netmap queues/slots: TX 4/1024, RX 4/1024
pcib5: <ACPI PCI-PCI bridge> mem 0xdfe80000-0xdfe9ffff irq 19 at device 12.0 on pci0
pci5: <ACPI PCI bus> on pcib5
igb3: <Intel(R) I210 Flashless (Copper)> port 0xa000-0xa01f mem 0xdf900000-0xdf91ffff,0xdf920000-0xdf923fff irq 19 at device 0.0 on pci5
igb3: NVM V0.6 imgtype6
igb3: Using 1024 TX descriptors and 1024 RX descriptors
igb3: Using 4 RX queues 4 TX queues
igb3: Using MSI-X interrupts with 5 vectors
igb3: Ethernet address: 00:e2:26:91:18:fc
igb3: netmap queues/slots: TX 4/1024, RX 4/1024
pcib6: <ACPI PCI-PCI bridge> mem 0xdfe60000-0xdfe7ffff irq 20 at device 14.0 on pci0
pci6: <ACPI PCI bus> on pcib6
pcib7: <ACPI PCI-PCI bridge> mem 0xdfe40000-0xdfe5ffff irq 21 at device 15.0 on pci0
pci7: <ACPI PCI bus> on pcib7
pcib8: <ACPI PCI-PCI bridge> mem 0xdfe20000-0xdfe3ffff irq 22 at device 16.0 on pci0
pci8: <ACPI PCI bus> on pcib8
pcib9: <ACPI PCI-PCI bridge> mem 0xdfe00000-0xdfe1ffff irq 23 at device 17.0 on pci0
pci9: <ACPI PCI bus> on pcib9
ahci0: <Intel Denverton AHCI SATA controller> port 0xe050-0xe057,0xe040-0xe043,0xe020-0xe03f mem 0xdff14000-0xdff15fff,0xdff1b000-0xdff0
ahci0: AHCI v1.31 with 3 6Gbps ports, Port Multiplier supported
ahcich0: <AHCI channel> at channel 0 on ahci0
ahcich1: <AHCI channel> at channel 1 on ahci0
ahcich2: <AHCI channel> at channel 2 on ahci0
ahciem0: <AHCI enclosure management bridge> on ahci0
xhci0: <Intel Denverton USB 3.0 controller> mem 0xdff00000-0xdff0ffff irq 19 at device 21.0 on pci0
xhci0: 32 bytes context size, 64-bit DMA
usbus0 on xhci0
usbus0: 5.0Gbps Super Speed USB v3.0
pcib10: <ACPI PCI-PCI bridge> irq 16 at device 22.0 on pci0
pci10: <ACPI PCI bus> on pcib10
ix0: <Intel(R) X553 (1GbE)> mem 0xdf400000-0xdf5fffff,0xdf604000-0xdf607fff irq 16 at device 0.0 on pci10
ix0: Using 2048 TX descriptors and 2048 RX descriptors
ix0: Using 4 RX queues 4 TX queues
ix0: Using MSI-X interrupts with 5 vectors
ix0: allocated for 4 queues
ix0: allocated for 4 rx queues
ix0: Ethernet address: 00:e2:69:11:8c:63
ix0: eTrack 0x80000b52
ix0: netmap queues/slots: TX 4/2048, RX 4/2048
ix1: <Intel(R) X553 (1GbE)> mem 0xdf200000-0xdf3fffff,0xdf600000-0xdf603fff irq 17 at device 0.1 on pci10
ix1: Using 2048 TX descriptors and 2048 RX descriptors
ix1: Using 4 RX queues 4 TX queues
ix1: Using MSI-X interrupts with 5 vectors
ix1: allocated for 4 queues
ix1: allocated for 4 rx queues
ix1: Ethernet address: 00:e2:69:11:8c:62
ix1: eTrack 0x80000b52
ix1: netmap queues/slots: TX 4/2048, RX 4/2048
pcib11: <ACPI PCI-PCI bridge> irq 16 at device 23.0 on pci0
pci11: <ACPI PCI bus> on pcib11
ix2: <Intel(R) X553 L (1GbE)> mem 0xdee00000-0xdeffffff,0xdf004000-0xdf007fff irq 16 at device 0.0 on pci11
ix2: Using 2048 TX descriptors and 2048 RX descriptors
ix2: Using 4 RX queues 4 TX queues
ix2: Using MSI-X interrupts with 5 vectors
ix2: allocated for 4 queues
ix2: allocated for 4 rx queues
ix2: Ethernet address: 00:e2:69:11:8c:61
ix2: eTrack 0x80000b6d
ix2: netmap queues/slots: TX 4/2048, RX 4/2048
ix3: <Intel(R) X553 L (1GbE)> mem 0xdec00000-0xdedfffff,0xdf000000-0xdf003fff irq 17 at device 0.1 on pci11
ix3: Using 2048 TX descriptors and 2048 RX descriptors
ix3: Using 4 RX queues 4 TX queues
ix3: Using MSI-X interrupts with 5 vectors
ix3: allocated for 4 queues
ix3: allocated for 4 rx queues
ix3: Ethernet address: 00:e2:69:11:8c:60
ix3: eTrack 0x80000b6d
ix3: netmap queues/slots: TX 4/2048, RX 4/2048
pci0: <simple comms> at device 24.0 (no driver attached)
sdhci_pci0: <Intel Denverton eMMC 5.0 Controller> mem 0xdff18000-0xdff18fff,0xdff17000-0xdff17fff irq 16 at device 28.0 on pci0
sdhci_pci0: 1 slot(s) allocated
mmc0: <MMC/SD bus> on sdhci_pci0
isab0: <PCI-ISA bridge> at device 31.0 on pci0
isa0: <ISA bus> on isab0
pci0: <memory> at device 31.1 (no driver attached)
pci0: <memory> at device 31.2 (no driver attached)
pci0: <serial bus> at device 31.5 (no driver attached)
apei0: <ACPI Platform Error Interface> on acpi0
uart0: <16550 or compatible> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
uart0: console (115200,n,8,1)
est0: <Enhanced SpeedStep Frequency Control> on cpu0
Timecounter "TSC-low" frequency 1100001099 Hz quality 1000
Timecounters tick every 1.000 msec
ugen0.1: <0x8086 XHCI root HUB> at usbus0
uhub0 on usbus0
uhub0: <0x8086 XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on usbus0
mmcsd0: 16GB <MMCHC AJTD4R 0.6 SN CB5EFE6E MFG 03/2020 by 21 0x0000> at mmc0 200.0MHz/8bit/8192-block
mmcsd0boot0: 4MB partition 1 at mmcsd0
mmcsd0boot1: 4MB partition 2 at mmcsd0
mmcsd0rpmb: 4MB partition 3 at mmcsd0
Trying to mount root from ufs:/dev/ufs/OPNsense_Install [ro,noatime]...
Root mount waiting for: CAM usbus0
uhub0: 8 ports with 8 removable, self powered
Root mount waiting for: CAM usbus0
Root mount waiting for: CAM usbus0
ugen0.2: <JetFlash Mass Storage Device> at usbus0
umass0 on uhub0
umass0: <JetFlash Mass Storage Device, class 0/0, rev 3.20/11.00, addr 1> on usbus0
umass0: SCSI over Bulk-Only; quirks = 0x8100
umass0:4:0: Attached to scbus4
Root mount waiting for: CAM
Root mount waiting for: CAM
Root mount waiting for: CAM
Root mount waiting for: CAM
Root mount waiting for: CAM
Root mount waiting for: CAM
Root mount waiting for: CAM
ses0 at ahciem0 bus 0 scbus3 target 0 lun 0
ses0: <AHCI SGPIO Enclosure 2.00 0001> SEMB S-E-S 2.00 device
ses0: SEMB SES Device
ada0 at ahcich1 bus 0 scbus1 target 0 lun 0
ada0: <Crucial CT275MX300SSD1 M0CR031> ACS-3 ATA SATA 3.x device
ada0: Serial Number 16451497F39B
ada0: 600.000MB/s transfers (SATA 3.x, UDMA6, PIO 8192bytes)
ada0: Command Queueing enabled
ada0: 262321MB (537234768 512 byte sectors)
ses0: pass0,ada0 in 'Slot 01', SATA Slot: scbus1 target 0
da0 at umass-sim0 bus 0 scbus4 target 0 lun 0
da0: <JetFlash Transcend 128GB 1100> Fixed Direct Access SPC-4 SCSI device
da0: Serial Number 08TQL07IE3OAQ9FV
da0: 400.000MB/s transfers
da0: 117987MB (241637376 512 byte sectors)
da0: quirks=0x2<NO_6_BYTE>
GEOM: da0: the secondary GPT header is not in the last LBA.
GEOM: diskid/DISK-08TQL07IE3OAQ9FV: the secondary GPT header is not in the last LBA.
mountroot: waiting for device /dev/ufs/OPNsense_Install...
Mounting filesysGEOM: diskid/DISK-08TQL07IE3OAQ9FV: the secondary GPT header is not in the last LBA.
GEOM: diskid/DISK-08TQL07IE3OAQ9FV: the secondary GPT header is not in the last LBA.
GEOM: diskid/DISK-08TQL07IE3OAQ9FV: the secondary GPT header is not in the last LBA.
igb2: link state changed to UP
debugnet_any_ifnet_update: Bad dn_init result from igb2 (ifp 0xfffff80001821000), ignoring.
ichsmb0: <Intel Denverton SMBus controller> port 0xe000-0xe01f mem 0xdff16000-0xdff160ff irq 23 at device 31.4 on pci0
smbus0: <System Management Bus> on ichsmb0
lo0: link state changed to UP
pflog0: permanently promiscuous mode enabled
8
22.1 Legacy Series / Re: 22.1-RC2 Questions
« on: January 30, 2022, 10:03:50 pm »
Thanks for sharing this. I posted this March 2021: https://forum.opnsense.org/index.php?topic=22233.msg105419#msg105419
I was waiting until the 22.1 release to finally get use of the QAT driver since pfsense only allows this in their own hardware and it "would" come in de CE edition, but not waiting on that anymore. Already decided a while ago to switch to OPNsense as soon as QAT comes available in OPNsense by using at a minimum a tunable. Good to know it is not possible yet, was already planning the migration weekend ;-) So holding my horses off for now.
Could you update your post as soon it is possible to activate the QAT hardware in OPNsense?
I was waiting until the 22.1 release to finally get use of the QAT driver since pfsense only allows this in their own hardware and it "would" come in de CE edition, but not waiting on that anymore. Already decided a while ago to switch to OPNsense as soon as QAT comes available in OPNsense by using at a minimum a tunable. Good to know it is not possible yet, was already planning the migration weekend ;-) So holding my horses off for now.
Could you update your post as soon it is possible to activate the QAT hardware in OPNsense?
9
Hardware and Performance / Re: pfSense will support Intel Quickassist, what about OPNsense?
« on: March 23, 2021, 01:32:11 pm »
Thanks, that is good intel. Looking to the roadmap (https://opnsense.org/about/road-map/), this would be not earlier than the January 2022 release?
10
Hardware and Performance / pfSense will support Intel Quickassist, what about OPNsense?
« on: March 23, 2021, 09:42:38 am »
Hi all
pfSense and OPNsense supports CPUs that have AES-NI as an on-die cryptographic accelerators. On ARM-based systems, the additional load from AES operations will be offloaded to those on-die cryptographic accelerators, such as the one found on our SG-1000. ARM v8 CPUs include instructions like AES-NI that can be used to increase performance of the AES algorithm on these platforms. Information from pfSense: https://www.netgate.com/blog/more-on-aes-ni.html
Besides AES-NI some CPUs, such as the Atom C3xx series, also have Intel QuickAssist as an extra offloading chip for encryption (and compression but not relevant in this context) --> https://www.servethehome.com/intel-quickassist-technology-and-openssl-setup-insights-and-initial-benchmarks/ and https://www.servethehome.com/intel-quickassist-at-40gbe-speeds-ipsec-vpn-testing/
Question: I was wondering if the OPNsense team has any plans that this also will become available in OPNsense? I am unable to find concrete information on this (so not assumptions or rumors).
Somewhere the coming year I will upgrade to 1 gigabit internet. I am also setting up my network with an always-on VPN, routing all internet traffic through an OpenVPN tunnel. I have a firewall appliance with a C3558 board so I can leverage QuickAssist in the future.
Having QuickAssist available to avoid too much load on the CPU will become a requirement at a certain point (AES-NI is sufficient for now). Of course I can still use the CPU but that will stress the hardware and will impact longevity but also more power usage.
More background information:
The QAT driver is available in FreeBSD --> https://www.freebsd.org/cgi/man.cgi?query=qat&apropos=0&sektion=0&manpath=FreeBSD+13.0-current&arch=default&format=html
pfSense Plus also supports this from version 21.02: Support for Intel® QuickAssist Technology, also known as QAT.
pfSense and OPNsense supports CPUs that have AES-NI as an on-die cryptographic accelerators. On ARM-based systems, the additional load from AES operations will be offloaded to those on-die cryptographic accelerators, such as the one found on our SG-1000. ARM v8 CPUs include instructions like AES-NI that can be used to increase performance of the AES algorithm on these platforms. Information from pfSense: https://www.netgate.com/blog/more-on-aes-ni.html
Besides AES-NI some CPUs, such as the Atom C3xx series, also have Intel QuickAssist as an extra offloading chip for encryption (and compression but not relevant in this context) --> https://www.servethehome.com/intel-quickassist-technology-and-openssl-setup-insights-and-initial-benchmarks/ and https://www.servethehome.com/intel-quickassist-at-40gbe-speeds-ipsec-vpn-testing/
Question: I was wondering if the OPNsense team has any plans that this also will become available in OPNsense? I am unable to find concrete information on this (so not assumptions or rumors).
Somewhere the coming year I will upgrade to 1 gigabit internet. I am also setting up my network with an always-on VPN, routing all internet traffic through an OpenVPN tunnel. I have a firewall appliance with a C3558 board so I can leverage QuickAssist in the future.
Having QuickAssist available to avoid too much load on the CPU will become a requirement at a certain point (AES-NI is sufficient for now). Of course I can still use the CPU but that will stress the hardware and will impact longevity but also more power usage.
More background information:
The QAT driver is available in FreeBSD --> https://www.freebsd.org/cgi/man.cgi?query=qat&apropos=0&sektion=0&manpath=FreeBSD+13.0-current&arch=default&format=html
pfSense Plus also supports this from version 21.02: Support for Intel® QuickAssist Technology, also known as QAT.
- QAT accelerates cryptographic and hashing operations on supported hardware, and can be used to accelerate IPsec, OpenVPN, and other OpenCrypto Framework-aware software.
- Supported hardware includes many C3000 and C2000 systems sold by Netgate and some other types of built-in QAT support and add-on cards.
Pages: [1]