AQC107 aq0 + Suricata IPS/Netmap issue after 26.7.3_11

[chr]

Hi all,

I upgraded from OPNsense 26.1.11_10 to 26.7.3_11 yesterday. The upgrade itself completed successfully and the firewall came back online.

This morning internet was down and the OPNsense UI was not reachable. At the console I saw repeated messages that looked like:

  atlantic: FLB> F/W successfully loaded from flash
  aq0: ring 0: __PAGESIZE=4096 MCLBYTES=2048 hw->max_frame_size=2048
  aq0: ring 1: __PAGESIZE=4096 MCLBYTES=2048 hw->max_frame_size=2048
  aq0: ring 2: __PAGESIZE=4096 MCLBYTES=2048 hw->max_frame_size=2048
  aq0: ring 3: __PAGESIZE=4096 MCLBYTES=2048 hw->max_frame_size=2048

I could not log in at the console because the messages were scrolling, so I did a hard reboot. After reboot the system came back up.

Hardware/interface:

  WAN: aq0
  NIC: Aquantia AQtion AQC107 NBase-T / IEEE 802.3an Ethernet Controller
  FreeBSD driver: aq / if_atlantic
  dev.aq.0.fw_ver: 3.1.121
  dev.aq.0.iflib.driver_version: 0.2.0
  Link: 2500Base-T full-duplex

Configuration detail that may matter:

  Services > Intrusion Detection was enabled
  Capture mode: Netmap (IPS)
  Interface: WAN

Zenarmor is also installed, but WAN/aq0 was not selected in Zenarmor.

After disabling OPNsense Intrusion Detection / Suricata, aq0 no longer shows NETMAP in ifconfig options. Before disabling it, aq0 showed NETMAP. Current aq0 counters are clean: errs 0, idrops 0, colls 0.

So my current suspicion is a possible interaction between Suricata IPS/Netmap and the Aquantia AQC107/aq driver after the 26.7 upgrade.

I am leaving Intrusion Detection disabled for now to see if the system remains stable.

Has anyone else seen this with AQC107 / aq0 / Atlantic NICs and Suricata IPS on WAN after upgrading to 26.7.x?

[chr]

Small update:

After disabling Services > Intrusion Detection / Suricata, aq0 no longer shows NETMAP in ifconfig options.

Before disabling IPS on WAN:
  aq0 options included NETMAP

After disabling IPS on WAN:
  options=4802028<VLAN_MTU,JUMBO_MTU,WOL_MAGIC,HWSTATS,MEXTPG>

It has now been stable for several hours with no new aq0 / atlantic / FLB / link reset messages in dmesg.

So this still looks like Suricata IPS/Netmap on the WAN interface triggering the aq/atlantic reinitialization loop after 26.7.3_11. Not sure if this is specific to AQC107 or a broader Netmap/driver interaction.