Single Board Computer (SBC) for Sophos XG Home Firewall

Question

I apologize because it seems like there are quite a few conversations about Hardware for XG Home, However most seem old (3+ years). 
 A lot of SBC computers are hitting the market and seem to be just as useful for XG Home. That said, I'm hoping someone out there can point toward a trusted SBC that has performed well with XG Home. 
 
 I personally already run an ODYSSEY - X864105 (J4105 Celeron Processor) for a small home server. For that job, it does great. Would another one of those serve well as an XG Home Firewall? 
 I am looking to replace my Meraki MX64, which is up for license renewal at about $700. 
 All suggestions and guidance are welcome

rfcat_vk · Answer

Hi, 
 for home use maximum is 4 Cores (preferably real and very fast) and 6gb of RAM. NICs should not be realtek or intel i219 (not supported) to provide the connection speed you are after. The NUCs took good. 
 Make sure that the bios is not UEFI because that is not supported or has the option of none uefi boot. 
 Ian

Prism · Answer

Throughput on Sophos XG highly depends on three things, 
 
 The processor. 
 What kind of traffic is going through the Firewall. 
 What features you're going to use. 
 
 coolbreeze said: It seems like everybody is unwilling to suggested that a certain CPU/System Combination relates to throughput. 
 A single core of a Ryzen 3300x (The processor I'm currently using.) can do around 2.8Gbit/s of IPS over a single thread . (of traffic generated through Cisco TRex.) 
 With Decrypted TLS + AV It can go down to 960Mbit/s over a single TLS connection. (Single thread) (Also almost line-rate Gigabit.) 
 In comparison a Intel J1900 that I had couldn't go over ~120Mbit/s over a single decrypted TLS Connection; But a Intel G5400 could get to around ~820Mbit/s over the same kind of TLS decrypted traffic. 
 coolbreeze said: If the best I can do is 200 - 400 Mbps 
 You won't be able to get symmetrical gigabit in your home with a potato SBC. ( Unless you get those high-end NUC's ) 
 Also, currently on v18 MR5, Sophos XG doesn't utilize AES-NI for hw crypto acceleration, so you're stuck with your processor raw performance for anything related to cryptography. 
 coolbreeze said: I assume that even though snort is single threaded, each new connection can be started on a new thread 
 A single connection can't be shared over multiple cores/threads, but multiple connections will be shared to all cores/threads as expected. 
 Some things to reminder, Sophos XG doesn't support NVMe for storage, neither the I219 NIC chipset. ( rfcat_vk have more information on this.) 
 Hopefully those answers cover some of your questions.

Single Board Computer (SBC) for Sophos XG Home Firewall

Top Replies