Throughput Getting Crushed

[fakebizprez]

My download has gone from 5.2Gbps to 3.2Gbps & Upload has gone from 5.1Gbps to 1.4Gbps since installing Zenarmor, and I have OPNsense running on a Dell PowerEdge R730 with on two Intel Xeon E5-2643 v3 @ 3.40GHz (6 cores each). 64GB RAM.


Is this to be expected or have I misconfigured the extension?

[meyergru]

I would have expected that with use of a single thread only for the free tier, but I do not use Zenarmor.

[Seimus]

Yop, this is the expected throughput in regards of your CPU when using ZA.
I would even say you are bit above the expected.

Regards,
S.

[fakebizprez]

Thanks for the replies.

Only the free tier is single-threaded, am I understanding that correctly?

[Seimus]

There is no multicore support yet.

As for when there will be and on which subscription is still not properly communicated by ZA. There is a Major thread about this topic.

Regards,
S.

[fakebizprez]

Thank you for answering

There is a Major thread about this topic.

I read through it. Looks like this has been in progress for an very long time. Unfortunately, I cannot wait while continuing to use the product.

Aside from it being single-threaded, are there any adjustments that can be made to reduce the reduction in throughput? For example, should I use something other than ElasticSearch? Should I not emulate the Netmap driver? Should I not include Wireguard? Anything at all..

[Seimus]

The only way how to improve performance for ZA is to move of the DB to an external one.

Regards,
S.

[sy]

Hi,

Good news regarding multicore support. We have released a test binary. Kindly contact the support team via the "Have Feedback" option located in the bottom right corner of the UI if you wish to try it out.

[fakebizprez]

Hi,

Good news regarding multicore support. We have released a test binary. Kindly contact the support team via the "Have Feedback" option located in the bottom right corner of the UI if you wish to try it out.

Thank you, I will do this now.

[Taunt9930]

Hi,

Good news regarding multicore support. We have released a test binary. Kindly contact the support team via the "Have Feedback" option located in the bottom right corner of the UI if you wish to try it out.

Thank you, I will do this now.

Has it made a difference in your use-case?

[fakebizprez]

Hi,

Good news regarding multicore support. We have released a test binary. Kindly contact the support team via the "Have Feedback" option located in the bottom right corner of the UI if you wish to try it out.

Thank you, I will do this now.

Has it made a difference in your use-case?

I just set it up, per the instructions that were emailed to me, but there seem to be errors. I forwarded the logs to the ZenArmor team.

When they get back to me tomorrow I will troubleshoot and report back.

[Lurick]

Hi,

Good news regarding multicore support. We have released a test binary. Kindly contact the support team via the "Have Feedback" option located in the bottom right corner of the UI if you wish to try it out.

Thank you, I will do this now.

Has it made a difference in your use-case?

I just set it up, per the instructions that were emailed to me, but there seem to be errors. I forwarded the logs to the ZenArmor team.

When they get back to me tomorrow I will troubleshoot and report back.

Similar boat for me. Tons of issues with IPv4 connectivity as well. Hopefully they can get some of this resolved :)

[Seimus]

I actually remembered.

For the time being, You can improve ZA performance by using RSS + Do not pin Engine packet processor to dedicated CPU.

If you set it right you should be in theory able to go bit above. Helped me on a N100 CPU to go from 1Gbit/s to around ~1.8Gbit.

Regards,
S.

[fakebizprez]

I was not using the Pin feature.

Off the top of my head I am not sure what RSS is.

[fakebizprez]

Hi,

Good news regarding multicore support. We have released a test binary. Kindly contact the support team via the "Have Feedback" option located in the bottom right corner of the UI if you wish to try it out.

Thank you, I will do this now.

Has it made a difference in your use-case?

I just set it up, per the instructions that were emailed to me, but there seem to be errors. I forwarded the logs to the ZenArmor team.

When they get back to me tomorrow I will troubleshoot and report back.

Similar boat for me. Tons of issues with IPv4 connectivity as well. Hopefully they can get some of this resolved :)

I don't have the logs available right now, because I'm on my phone, but the multi-threaded throughput was actually lower than single-threaded.

Unfortunately, I had to uninstall the service until they can polish this new feature. My OPNsense server's two CPUs have the highest rates single-threaded performance available for the PowerEdge R730.