[SOLVED] SFP+ Ports Not Working or not seen on Firewall with OPNSense

[RDLsysadmin01]

UPDATE: Please see attached images and update section below original post for additional info.

First off I want to thank anyone ahead of time for any thoughts, assistance or info you can provide to help me solve my small problem.

I recently purchased a no-name firewall appliance for testing purposes at my work and wanted to see how it performed up against something of similar specs like a fortigate or cisco firewall which we have both of as backups/old units no longer in use. I was doing this to figure out the viability of using this firewall in a smaller branch out on the east coast that was going to have no more than 50 employees and maybe 80 devices in total connecting to the internet.

The device I purchased is this one but it was configured with the 16gb RAM and 128gb NVME storage (not that it matters since it came with onboard storage built in to the motherboard as well.

Here is the device - https://www.aliexpress.us/item/3256805052221179.html?spm=a2g0o.order_list.order_list_main.11.7e3a1802ogif1w&gatewayAdapt=glo2usa

Here is a video on said device - https://www.youtube.com/watch?v=a3EMMYTdOYo

Now, here is my "problem" (Not really a huge issue but definitely something I'd like to figure out if possible), I can't get the 2 SFP+ ports on this device to work/show up in the OPNsense GUI and quite frankly I'm not familiar enough with with the CLI and what commands to issue to see if it shows up there either. I would assume it isn't because from what I understand, if it shows up in the CLI it shows up in the GUI???

Now, here's the real doozey of a headscratcher... The GUI does show 6 igc ports (igc0, igc1,igc2, igc3, igc4, igc5) like it should because there are 6 RJ45 ports at 1gb each connected to a 2.5gb processing card for each one. I know this because the guy in the video ran the numbers and figured out that they are 2.5gb nics operating at 1gb speeds each. (NOTE: The SFP+ Ports as indicated in the video as well, do not go through the 2.5gb NICS and rather are directly connected to the CPU which in my case is a Intel(R) Atom(TM) CPU C3758R @ 2.40GHz (8 cores, 8 threads) so there should be no limiting factor on the SFP+ ports in terms of speed other than the processors ability/load)

Now outside of the igc ports I also see 4 ix ports (ix0, ix1, ix2, ix3) listed as well. All the igc and ix ports are listed under the drop down menu on the "interfaces ---> assignments" page in the GUI. See attached picture

So I guess I have 2 problems now that I think of it... 1 being why do I have 4 ix ports that don't do anything or change in terms of up/down status no matter what I do (they are always down) and problem 2 is if the ix ports are not the SFP+ ports broken out (which is one theory of mine - ix0 being SFP+ Port number 1 downlink and ix1 being SFP+ port number 1 uplink - but I honestly have no idea if that's how they work or not I'm just shooting theories out) then where are the ix ports being allocated or seen at/what is making them appear in the GUI?

I hope I've been clear enough on my problem but just in case I've not been, my main question is how do I get my 2 SFP+ ports on this 3rd party cheap china firewall to work or is there a way for me to run a command to figure out what the ports are listed as hardware wise so I can see if they are supported or not and my second less pressing problem is where are the ix ports coming from since I only have 2 SFP+ ports and the system is listing 4 of the ix ports???

It's probably also worth mentioning that this particular firewall has a couple other options like being able to use a cellular card and sim card combo to connect to the internet over cell towers and a few other odd bits as covered in the video BUT on pfsense in the video, he is able to see ix0 and ix1 as the 2 SFP+ ports. Granted that's pfsense not opnsense so I know there are differences there.

I should probably also mention that when I connect a RJ45 cable to the SFP+ port using an adapter (This adapter to be exact - https://www.amazon.com/gp/product/B01KFBFL16/ref=ppx_yo_dt_b_search_asin_title?ie=UTF8&psc=1) I get a link light on the device itself but no matter how long I wait the ix ports in the GUI never turn from red to green.

Again, this isn't a huge issue for me as the 6 igc ports at 1gb is fine for the application this firewall is in/going in but if I can get the 10gb SFP+ ports working, I would be very happy.

Thanks again to anyone for providing feedback, help, thoughts and whatever info you have on this.


-----------------------------------------------------------------------------------------------------------------------------
UPDATE SECTION:

So I was able to finally find out that

Code: [Select]

ifconfig -v was the command I needed in order to list out all my PCI devices, their associated info and what they were classified as. I've attached a image to help clarify. As you can see from that image, ix0 and ix1 are listed as the SFP+ ports so it is in fact seeing them but then why are they not able to be brought online/up when something is plugged into them??? Any help would be greatly appreciated!




UPDATE #2:
So after some playing around with the interfaces and cables I rebooted the machine just to start fresh and what do you know.... The good 'ole "have you turned it off and back on again" method actually worked. Once it was rebooted it would allow me to plug and unplug cables into the SFP+ Ports and it saw them accordingly and let me use them. Curiously enough though, the speeds are horrible on them. Not sure why but I get a much lower (about 1/2) speed on download and extremely low (1/10th) speed on Upload when using the SFP+ Ports. I'm not really sure what happened there. And another issue is when switching the LAN over to that port, the whole network goes down and doesn't come back up. Even after a reboot it still does not connect. It acts like it's disconnected at the port but it's not. So more tweaking and experimentation and I'll post my results here when I get around to it.

Thanks everyone for your help!

[cookiemonster]

seems as I would expect it. igX are your ethernet ports. 4 ixY are your sfp+ ports. All show on the GUI so the hardware is recognised and the drivers are attached to it/them.
The ports will only be going to a state of UP when they are physically connected to "something" and there's electrical signal being exchanged.
In the meantime you can configure them.

[RDLsysadmin01]

Thanks for your reply! What I'm confused about is if they are the SFP+ ports, when I plug them into something like a PC or a network switch I get no UP status no matter how long I wait and why are there 4 ix ports listed if I only have 2 SFP+ ports?

In the video of this unit running on pfsense, there are only 2 ix ports listed. One for each SFP+ port. Not 4 ports like this one is showing.

[RDLsysadmin01]

I have updated the original post with an additional image and more details in the "Update" section.

[Patrick M. Hausen]

First, the link to Aliexpress shows a device with 4 SFP+ ports.

If you got a smaller configuration then possibly the mainboard is just the same for all units featuring 4 10 G interfaces (ix0 - 3) and they simply removed two of the sockets on the outside.

Second the SFP+ module you got might not work with your interface. Frequently these are branded and you need e.g. an "Intel" coded SFP+ module for an Intel card. You could get properly coded ones from FS.com at very reasonable prices.

Third, what do you connect at the other end? The port with that SFP+ you linked might not be capable of communication with a 1 G port, only 10 G on both ends.

And last, using copper for 10 G really is not recommended. Get fiber modules. Copper ones eat a ton of energy, get extremely hot as a consequence, and are notoriously unreliable.

HTH,
Patrick

[RDLsysadmin01]

First, the link to Aliexpress shows a device with 4 SFP+ ports.

Patrick, thank you for the added information and for pointing out the discrepancy in my Aliexpress link. I honestly had not noticed there were 4 ports on that one. I simply went to my order history so I assume they updated it with a 4 port version at some point. I would imagine you are probably right about the board being the same and that's why 4 ports show instead of only 2.

I have a theory I'm chasing down now and will come back and update this entire post accordingly.

[yourfriendarmando]

There might also be tunables like this they can coerce the Intel chip to cooperate with the modules:

hw.ix.unsupported_sfp
Force Intel driver to use unsupported SFP+ modules. Def: 0             
boot-time
Set the value to: 1