DEC3920 Quick Review

[dirtyfreebooter]

Picked up a DEC3920 from OPNsense Shop. US customs held it for 7+ days, after two docusign attempts with Fedex international customer service, they finally released it.

The hardware itself is very well made. Almost a work of art. There is fan noise, though its minor, not like a 1U Dell / Supermicro. You can hear the fan noise go up and down. AMD V3C18 CPU, comes with hyperthreads disabled.

Not sure how much more lab testing I will do before it replaces my Protectli VP2440. I only have 1 Gbps fiber, upgrading to 2 Gbps, so kept the testing simple to WAN on 2.5g interface and LAN on 10g. I didn't have a chance to setup and test wireguard, but since the VP2440 with N150 can handle ~2Gbps wireguard, this should have no problem with my use case.

Pleasantly surprised this thing idles less than the Protectli VP2440 (which is 12w with Coreboot 0.9.1-rc3 with ASPM enabled). Out of the box without having to mess with any settings or tuneables.

Total Cost
DEC3920: $2,721.69
Shipping: $81.24
Tariff fee: $33.58
Fedex fee: $15.00
Total: $2,851.51

CPU
AMD Ryzen Embedded V3C18 8-Core Processor

BIOS
Version: 025.05.01
Release Date: 03/13/2026

Memory
1x 16gb DDR5 Micron Technology CT16G56C46U5.C8H
Speed: 5600 MT/s

NVMe
Transcend TS256GMTE712A 256gb
NVMe PCIe Gen 4 x4
NAND Flash Type,112-layer 3D NAND (TLC)
Sequential Read Speed "Up to 3,800 MB/s"
Sequential Write Speed "Up to 3,200 MB/s"
Random Read / Write "Up to 350,000 IOPS / Up to 330,000 IOPS"
Endurance "Up to 4,000 TBW (Terabytes Written) / 1.84 DWPD"
MTBF "3,000,000 hours"

Network
igc i226-V nics ship with v2.25 firmware
ax 10g nics with 19.118.48

Power and iperf tests
All power measured at wall outlet of 110v using PN2000 power meter.

reboot - 57.64s

idle - wan igc1, lan igc0 (first boot) - 8.78w
iperf upload  - 18.75w - 2.35 Gbit/s
iperf download - 18.60w - 2.35 Gbit/s

idle - zenarmor, wan igc0, lan ax0 - 9.92w
iperf upload  - 21.53w - 2.35 Gbit/s
iperf download - 22.04w - 2.35 Gbit/s

Zenarmor with SQLite database with default policy with more than 50% policy blocks turned on. adds about 1w to idle. ~5w to routing 2.5g.

Real World
Connected to home network on 1 Gbps fiber, ZenArmor home, wireguard, AdGuard Home DNS, vlans. No problems maxing out 946 Mbps in both directions with plenty of spare CPU. ZenArmor's single core engine takes 1 of the 8 CPUs to about 59%. Given that, if using ZenArmor, DEC3920 can probably do 2.5 gbps, but not much more. 842 Mbps iperf with over wireguard + zenarmor. The client is on a network that requires MTU = 1280 for wireguard to work, so 842 Mbps is basically line speed for 1 Gbps link with 1280 mtu + wireguard.

Photos

[OPNenthu]

This chassis design really is beautiful.

US customs held it for 7+ days, after two docusign attempts with Fedex international customer service, they finally released it.

Maybe they were trying to figure out if it's a prohibited item under the new policy :P

https://protectli.com/news/statement-fcc-covered-list-update-to-ban-foreign-routers-in-the-us/

Not sure how much more lab testing I will do before it replaces my Protectli VP2440. I only have 1 Gbps fiber, upgrading to 2 Gbps, so kept the testing simple to WAN on 2.5g interface and LAN on 10g. I didn't have a chance to setup and test wireguard, but since the VP2440 with N150 can handle ~2Gbps wireguard, this should have no problem with my use case.

I'm just curious: if the VP2440 already does 2Gbps on WAN, where did it fall short?  Is it just ZenArmor, or did you see bottlenecks in VLAN routing as well?

Pleasantly surprised this thing idles less than the Protectli VP2440 (which is 12w with Coreboot 0.9.1-rc3 with ASPM enabled).

I wish coreboot had an option to disable the iGPU as that could be contributing a little to the power draw.

[dirtyfreebooter]

the vp2440 i think is pretty great. x710 is rock solid. the fanless design of the vp2440 is also well engineered.

i always wanted to support this project more. i do pay for business license for example.  i always wanted to get some opnsense hardware but frankly the previous gen cpus were kinda lame. especially with zenarmor.

i just really appreciate this project and want it to stay around and prosper.

[cookiemonster]

Would you consider using another image hoster? imgur is not available in the UK. I would have liked to see those.
https://help.imgur.com/hc/en-us/articles/41592665292443-Imgur-access-in-the-United-Kingdom

[dirtyfreebooter]

Would you consider using another image hoster? imgur is not available in the UK. I would have liked to see those.
https://help.imgur.com/hc/en-us/articles/41592665292443-Imgur-access-in-the-United-Kingdom

oh didn't realize that. i switched them over to imgchest.com

[Seimus]

Great review. Thanks for the benchmarks, it provides a good baseline.

It looks beautiful, I can only imagine how it will be a cherry in a rack.

In regards of noise.
Does it contribute to the ovetall noise in the room?
Or does it blend in?
Or does it stick out?

Basicaly how do you percieve the noise generated by this DEC in your normal enviroment.

Regards,
S.

[dirtyfreebooter]

In regards of noise.
Does it contribute to the ovetall noise in the room?
Or does it blend in?
Or does it stick out?

Basicaly how do you percieve the noise generated by this DEC in your normal enviroment.

its quiet for 1U. its certainly not like supermicro 40mm x 25mm @ 15,000 RPM fan. its not as quiet as Noctua 40mm x 20mm. if i run stress-ng cpu test, it pushes a decent amount of air, but doesn't have the super high pitched sound. to me, its similar to my unifi unvr or unifi poe 48 switch. if you are standing right in front of it, you can hear a faint sound and you can hear the fan change speed. network rack is in a utility room in the basement, so noise not too much of a problem, but i certainly wouldn't want a bunch of enterprise servers running. this is certainly not that.

[Seimus]

Perfect, thank you!

Regards,
S.

[dirtyfreebooter]

having a bit of trouble with the 2.5g interfaces. seems like after a decent amount of traffic passes through, i lose the WAN connection on igc0. there are no messages in dmesg or system log.

Code Select Expand

# ping google.com
PING google.com (142.251.46.142): 56 data bytes
ping: sendto: Host is down
ping: sendto: Host is down
ping: sendto: Host is down
ping: sendto: Host is down
ping: sendto: Host is down
ping: sendto: Host is down
^C
--- google.com ping statistics ---
6 packets transmitted, 0 packets received, 100.0% packet loss

if i pull the ethernet cable and plug it back in, instant fix.

Code Select Expand

ping google.com
PING google.com (142.251.46.142): 56 data bytes
64 bytes from 142.251.46.142: icmp_seq=0 ttl=119 time=3.047 ms
64 bytes from 142.251.46.142: icmp_seq=1 ttl=119 time=2.780 ms
64 bytes from 142.251.46.142: icmp_seq=2 ttl=119 time=2.550 ms
^C
--- google.com ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 2.550/2.793/3.047/0.203 ms

all i did was swap out the VP2440 for the DEC3920. otherwise my network has been stable for years. i guess i might have to pull it out and do longer stress tests? seems to occur once WAN on igc0 hits around 100GB of traffic.

the confusing part is there is zero feedback from kernel/dmesg.

this now happened twice since moving DEC3920 from lab test to my main firewall

[dirtyfreebooter]

A1 seems have some ideas.

Your issue is a well-documented hardware/driver bug with the Intel I226-V and the FreeBSD igc driver. The root cause is a TX hang quirk in the I226 hardware that the Linux driver handles via automatic recovery, but the FreeBSD driver does not — causing the NIC to silently freeze while the OS thinks the link is still up.

Looking at your specific sysctl output, there are several clear indicators and actionable fixes:

What Your sysctl Reveals
dev.igc.0.eee_control: 1 — Energy Efficient Ethernet (EEE) is enabled. This is a primary known trigger for I226-V link hangs.

dev.igc.0.fc: 3 — Flow control is set to bidirectional (TX+RX both on). This has been associated with link drops under traffic on this NIC family.

dev.igc.0.watchdog_timeouts: 0 — The FreeBSD driver's watchdog never fires, confirming it lacks the TX hang detection/reset logic that Linux's igc_main.c has at line ~3150. Traffic stops silently.

dev.igc.0.link_irq: 8 — 8 link state interrupts over the session; the hang doesn't necessarily show as a link-down event.

dev.igc.0.mac_stats.missed_packets: 297 — Minor but consistent with the NIC entering a degraded state over time.

fw_version: EEPROM V2.25-0 — You're on the latest

A1 seems to be stupid here and dev.igc.0.eee_control=1 means energy efficient ethernet is DISABLED already...

i226 on FreeBSD is annoying.

ASPM L1 is enabled for igc NICs from pciconf, Disabled for ax (10g) NICs. I am going to try some of these, as i tried to leave everything as it shipped / defaults.

seems like all the sysctls around energy where set correctly already. setting hw.pci.enable_aspm=0 and rebooting did not do anything, igc still has ASPM enabled. there seems to be a global ASPM on/off in the BIOS. this happens so quickly and frequently, i am questioning how Deciso did not already discover this.. in their testing...

[cookiemonster]

Would you consider using another image hoster? imgur is not available in the UK. I would have liked to see those.
https://help.imgur.com/hc/en-us/articles/41592665292443-Imgur-access-in-the-United-Kingdom

oh didn't realize that. i switched them over to imgchest.com

Thank you

[Patrick M. Hausen]

Please attach images to your posts directly on this forum and do not use "image hosters" at all. These are not image hosting services but personal data harvesting services. Or why do you think they're free to use as in "no cost"?

[dirtyfreebooter]

Please attach images to your posts directly on this forum and do not use "image hosters" at all. These are not image hosting services but personal data harvesting services. Or why do you think they're free to use as in "no cost"?

i tried attaching them, the limit is 256KiB for the entire post. so that doesn't really work.