Error about misconfigured interfaces

[sy]

Hi,

It could be an insufficient CPU issue. You can check Zenarmor HW requirements for 1Gbps with Zenarmor.

https://www.zenarmor.com/docs/introduction/hardware-requirements

What is your CPU model?

[36thchamber]

Hi
actually the dropped packets just disappeared with the new BSD14 kernel. Wireguard is faster.👍
I've Pentium Gold 8505, 12GB RAM, NVME. Few dozen devices. Should be fine for WAN but I don't use it for anything other than firewall contacting DNS. So i need to accomodate both ZenArmor and Wireguard for 2Gb/s line. The VPN speed gets reduced from 2000Mb/s to 1250Mb/s in netmap mode, it's really hard to guess what CPU could handle the full speed, 100% Wireguard. I wish there was a calculator:)

[sy]

Hi,

For the dropped packest, can you check dev.netmap.buf_num in ""sysctl -a | grep netmap" command if it is 1000000 or not?

To use Zenarmor in mix mode is not possible. Passive mode uses pcap instead of netmap.

[Seimus]

Hi
actually the dropped packets just disappeared with the new BSD14 kernel. Wireguard is faster.👍
I've Pentium Gold 8505, 12GB RAM, NVME. Few dozen devices. Should be fine for WAN but I don't use it for anything other than firewall contacting DNS. So i need to accomodate both ZenArmor and Wireguard for 2Gb/s line. The VPN speed gets reduced from 2000Mb/s to 1250Mb/s in netmap mode, it's really hard to guess what CPU could handle the full speed, 100% Wireguard. I wish there was a calculator:)

For ZA related interface errors and why those happen you can read here >
https://forum.opnsense.org/index.php?topic=41230.msg202594#msg202594
https://forum.opnsense.org/index.php?topic=41230.msg202554#msg202554

In regards of the other question

The VPN speed gets reduced from 2000Mb/s to 1250Mb/s in netmap mode, it's really hard to guess what CPU could handle the full speed, 100% Wireguard.

They have a hardware scaling table.
https://www.zenarmor.com/docs/introduction/hardware-requirements

You would need to keep a certain higher freq constantly in order to achieve such huge throughput. The HW sizing they have I believe is done for pure port-2-port throughput not including WG. But you can do an educated guess. Anyway as long we are still locked to single core/thread operations for ZA, its doesn't matter. It will always bottleneck and create back pressure.

However there is a light on end of the tunnel, ZA finished their SASE product (more or less) and we were told that devs started to work on multicore/thread support for ZA. There is a topic in regard of this on the forum.

Regards,
S.