Throughput Getting Crushed

[Seimus]

Off the top of my head I am not sure what RSS is.

https://docs.opnsense.org/troubleshooting/performance.html#receive-side-scaling

[fakebizprez]

https://docs.opnsense.org/troubleshooting/performance.html#receive-side-scaling

Wow. Interesting..........

So there's three options: RSS, Unpin CPU, & push logs to remote database, correct?

[Seimus]

Correct,

I use RSS + CPU unpin for like 2y without problem and having ~ 1.7G is much better than 1G as I need high throughput for interVLAN communication rather than LAN to WAN.

Moving elastic or other DB type depending what you use to a remote one can lift the performance too cause it will not eat into the FWs resources.

And one last tip, depending on your deployment of ZA, always deploy it on the Parent interface not per interface. Each single interface spans additional eastpect process. Meaning I use a LAGG on which I have dozen of VLANs, I do not run ZA on those VLANs I run it on the LAGG. Thus I have only single eastpect process.

Iperf test --- InterVLAN only = 1668Mbit/s
4 different host, cross InterVLAN combined at the same time. This is post RSS + unpin CPU in ZA

Code Select Expand

[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-60.04  sec  5.57 GBytes   797 Mbits/sec  691            sender
[  5]   0.00-60.00  sec  5.56 GBytes   797 Mbits/sec                  receiver

[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-60.00  sec  6.09 GBytes   871 Mbits/sec  989             sender
[  5]   0.00-60.00  sec  6.08 GBytes   871 Mbits/sec                  receiver

Regards,
S.

[fakebizprez]

OK, that's great information, man, I'm going to have to copy/paste this in my workspace. My company is scattered throughout the globe, and there's zero humans on my LAN, aside from me, so I was considering just putting it on WG0 (wireguard) because I'm hosting a fairly substantial VPN server. They're the ones that need the protection of a NGFW the most.

[Seimus]

so I was considering just putting it on WG0 (wireguard)

You can do that, ZA works on WG tunnels as well if you created it as an Interface and assigned it.

Regards,
S.