Qotom Core i7 mini computer - too good to be true?

Dear Doug

you can install ESXI VMware  on your pc and make a virtual machine SOPHOS UTM 9 

No, that is not what I'm interested in doing.  It's possible to remove an entire VM from an ESXi implementation.  I'm looking for a bare iron installation not VM.
Note: I'm running a VM on ESXi at the present time.  This is not secure enough for me.

Hi,

try the vm installation to see if vm recognises all the nics.

Also the issue might be something simple as not enabled in the bios.

Ian

It turns out I'm the victim of a very old Astaro/Sophos bug.  The OS doesn't recognize the NICs in the correct order.
I'm seeing the following:
Nic #1:  Eth0
Nic #2:  Eth 2
Nic #3:  Eth 3

Nic #4  Eth 1

I love the formatting here too.

Now that I know how Sophos has scrambled the NIC's I think I can proceed.

Thanks for the help.

Mini PC-Features-Q370G4.pdf

and did you succeed in resolving this problem?

Yes.
Once I realized that Sophos OS was scrambling the order of the NIC's as reported many years ago, it was trivial to configure the device correctly.
Thanks.

I don't think it's sophos that's scrambled things.  I have the same box based on a i5 5250u cpu.  Same nic issue. Similar results in windows too.  My guess is little attention was paid when they designed the circuit traces for each port to keep them in order.  I made a small table after some testing.

Physical ports ---- os named ports ETHx or VMNICx, (or if the OS starts the count at 1 instead of 0), respectively.

1 ---> 0 (1)

2 ---> 2 (3)

3 ---> 3 (4)

4 ---> 1 (2)

Wan is plugged into the first physical port, and lan into the second.  Esxi identifies as follows:

I don't think it's sophos that's scrambled things.  I have the same box based on a i5 5250u cpu.  Same nic issue. Similar results in windows too.  My guess is little attention was paid when they designed the circuit traces for each port to keep them in order.  I made a small table after some testing.

Physical ports ---- os named ports ETHx or VMNICx, (or if the OS starts the count at 1 instead of 0), respectively.

1 ---> 0 (1)

2 ---> 2 (3)

3 ---> 3 (4)

4 ---> 1 (2)

Wan is plugged into the first physical port, and lan into the second.  Esxi identifies as follows:

ordered the same device, are you happy with its performance on sophos utm? not sure if ill virtualize or not, was planning on baremetal for now.

It seems to be fine.  The processor is a bit slow relative to others on the market which I assume is a function of choosing to manage heat. 

I suspect the new 8th generation Intels that are coming out in the coming month will be significantly lower power and cooler which should allow much better performance.

Having said that my CPU graph putters around 1-2% so this may not really be a factor for home use.

Ben said:

ordered the same device, are you happy with its performance on sophos utm? not sure if ill virtualize or not, was planning on baremetal for now.

I can't complain.  UTM runs relatively well under esxi.  Enough to get full 350mbps on downloads with all the protections enabled in the home version.  I did set the vm at 4 cores - broken down as 2 processors with 2 cores each.  Some articles I read about vm and hyperthreading cpu's suggested to not set vm's at more than the physical number of cores.  Doing this resulted in about 2/3's bandwidth on single streams (like speed tests).  With the vm configured to use 4 cores, full bandwidth was attained.  Note, this box uses the i5 5250u cpu, which is dual core w/ hyperthreading.

You are correct.  The BIOS configuration allows me to blink the led on each NIc and the problem is with the hardware manufacturer.
Thanks for the information.

 Hey Ben,
I'm interested in your performance.

What I'm seeing is a minor but significant slowdown in download speeds, though I'm not seeing much of an impact with CPU usage.
I only have a 40Mb/s and I'm seeing something like 32Mb/s when I use the UTM.  This is not a concern to me but I'm curious what others see with much larger pipes.

finally got my box from china;

getting the full 500/100 here, testing vpn next.

Performance is great, this is the best device <12Watt with 4 Intel NICs in such packets.

That is very very encouraging to hear.
Do you have all the bells and whistles turned on: specifically Intrusion Detection, Virus Scan et al...?

with all bells and whistles tailored to my needs (IPS, advanced thread etc.) i get about 180-200Mbit/s per snort process per core throughput. 

Might just order a second box as spare (or HA? :-))) ) and use that to test machine to machine throughput via ipsec & aes-ni :) 

I don't think the number of snort processes is configurable.  Did you figure out how to do that?

Glad you're happy with the little gem.  I am so glad I'm not listening to the damn fan any more and not paying for all the power.

I had it's predecessor installed on an old VMWare Hypervisor which had a very old Intel Q6600 Quad Core.  I think it was pulling 250 watts.

well snort isn't multi threaded so 1 transfer = 1 snort process (as far as i know), i think there can be more than 1 snort process if multiple sources/destinations are called.