Hardware Limitations In Home version

C'mon mate, lets imagine that sophos has to pay salaries, developing new solutions, ideas maintain current activities, infrastructure etc etc. We can be glad that sophos is allowing us a home users to using their product just for free with all features. Beside that, for home usage 4 cores and 6 gb is a overkill. With all features on you can gain 1GB/s. look how Fortigate(and other solutions) are expensive, what the are offering etc. With sophos you've got it for free with great community :) appreciate it ^^ and if you wanna use it for commercial just support it - buying it ;)

I understand this logic, but there is no reason to limit hardware if it is proven that the UTM is in a home location.  There are tons of other UTM packages out there that don't have hardware limitations.  I don't mind paying the annual license, but to pay the annual license with a hardware restriction is weak.  I guess I'll just stay on PFsense until they finally decide to remove the limitations.  Thanks

I tried with a set of 250 snort rules and there is not change in performance, so it doesn't matter how much I tune up the rules.

The current version of Snort used by XG is single threading.

Ian

Do you know the commands to enable all the offloading so it's processed on the nic?

l0rdraiden said:

Do you know the commands to enable all the offloading so it's processed on the nic?

Yes, but please don't do this, all offloading is already disabled by the own Sophos developers for a reason, enabling it will only cause issues for you.

Primarily to Snort  with netmap work correctly, all NIC offloading needs to be disabled, and of course there can be more software inside XG that also needs it to be disabled.

Even if you enable all offloading, on a reboot all your changes will be overwritten.

Remember, XG is a firewall, not a router, so there isn't much use for NIC offloading since you want to inspect the packets.

Thanks!

Hi,

just to add some more confusion: :)

SFVH_SO01_SFOS 18.0.1 MR-1.HF050520.2# ethtool --show-offload Port1
Features for Port1:
rx-checksumming: on [fixed]
tx-checksumming: on
tx-checksum-ipv4: off [fixed]
tx-checksum-ip-generic: on
tx-checksum-ipv6: off [fixed]
tx-checksum-fcoe-crc: off [fixed]
tx-checksum-sctp: off [fixed]
scatter-gather: on
tx-scatter-gather: on
tx-scatter-gather-fraglist: off [fixed]
tcp-segmentation-offload: on
tx-tcp-segmentation: on
tx-tcp-ecn-segmentation: on
tx-tcp-mangleid-segmentation: off
tx-tcp6-segmentation: on
udp-fragmentation-offload: off
generic-segmentation-offload: on
generic-receive-offload: off
large-receive-offload: off [fixed]
rx-vlan-offload: off [fixed]
tx-vlan-offload: off [fixed]
ntuple-filters: off [fixed]
receive-hashing: off [fixed]
highdma: on [fixed]
rx-vlan-filter: on [fixed]
vlan-challenged: off [fixed]
tx-lockless: off [fixed]
netns-local: off [fixed]
tx-gso-robust: on [fixed]
tx-fcoe-segmentation: off [fixed]
tx-gre-segmentation: off [fixed]
tx-gre-csum-segmentation: off [fixed]
tx-ipxip4-segmentation: off [fixed]
tx-ipxip6-segmentation: off [fixed]
tx-udp_tnl-segmentation: off [fixed]
tx-udp_tnl-csum-segmentation: off [fixed]
tx-gso-partial: off [fixed]
tx-sctp-segmentation: off [fixed]
tx-esp-segmentation: off [fixed]
fcoe-mtu: off [fixed]
tx-nocache-copy: off
loopback: off [fixed]
rx-fcs: off [fixed]
rx-all: off [fixed]
tx-vlan-stag-hw-insert: off [fixed]
rx-vlan-stag-hw-parse: off [fixed]
rx-vlan-stag-filter: off [fixed]
l2-fwd-offload: off [fixed]
hw-tc-offload: off [fixed]
esp-hw-offload: off [fixed]
esp-tx-csum-hw-offload: off [fixed]
rx-udp_tunnel-port-offload: off [fixed]

I‘m using virtio on Proxmox KVM, no passthrough devices.

Best Regards

Dom

One thing;
Is fastpath enabled and working? You can see if it is by executing: "system firewall-acceleration show" On the console

I believe there's no support for it with the virtio driver.

Thanks!

My network card is passthrough to the VM so maybe these are disable by default becasue the KVM image is intended to run virtualized.

It would be interesting to see how "ethtool --show-offload Port1" looks like in an enterprise hw model of Sophos XG, anyone can post it?

console> system firewall-acceleration show
Firewall Acceleration is Disabled. Fastpath Unload Failed.

This topic was recently discussed here: community.sophos.com/.../questions-about-the-fastpath-feature

FW accel and Fastpath should be disabled for not-ESX hypervisors, see here: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/Architecture.html 

But does it work in physical NICs?

Any news above increase the CPU or RAM limit? CPU is particulary a problem in virtualized environments.

Can something be done in this regard?

Any news above increase the CPU or RAM limit? CPU is particulary a problem in virtualized environments.

Can something be done in this regard?

Hi,

in virtual environments you need to lock CPU and memory resources to the XG otherwise you end with strange performance issues.

Ian

I have them locked to 4 and 6GB, but still you lose performance due to virtualization and CPU for virtualization has many cores and usually run at lower frequencies.

Hi,

really depends on how much slower the CPU is say compared to a 4 cOre celeron or atom?

how much degradation in throughput are you seeing and what is causing the degradation?

ian

I can't compare vs a non virualized environment but I know the HW that some Sophos XG appliaces has and the cores of my CPU should be much more powerfull despite being virtualized.

www.amd.com/.../amd-ryzen-5-2400g

At least I can tell you that the overhead per core due to virtualization is around 10% in my case, comparing htop in host and on VM.

NIC are passthough and everyhing from a KVM perspective (CPU, Storage is in raw format) is optimiced to increase performance.

I have assigned 6gb DRR4 at 3000MHz

NVME samsung evo 970 dedicated

Be honest here, what kind of performance are you expecting on your 2400G? And what throughput you have right now?

I have 600mpbs symetric

If I enable IPS and APPs, it depens but download is around 300 and upload 170 or so.

The thing is that even with a light configuration CPU cores reach 100%. My area will move soon to 1Gbps, so probably I will have problems. I can get a better CPU but that won't help a lot since more than 4 cores can't be assigned and my CPU can reach 3.8Ghz boost to is a lot more compared with atoms and celerons which are usually around 2.5Ghz.

I know that part of the issue is snort but snort will move soon to snort 3 and will work much better with muilticore like suricata. Another thing is how many years will take sophos to implement snort 3 once released.

Ram is usually around 4gb.

I can't see how you're hitting 100% CPU - I was running Sophos G on a Dell Optiplex 3010 with i5-3470, HP 2x port 1Gb card, and the machine had 8GB RAM, 128GB SSD, the CPU with the 500/35 VM Connection here never went about 18%, that was running v18 with IPS, DPI, Web policies, Application policies.

Something is either wrong with your configuration, or the AMD processors just can't and don't perform well - I've seen issues in the past with pfSense and AMD - hence the reason I'm suggesting this as a possibility.

The thing is that even with a light configuration CPU cores reach 100%.

I'll be honest with you, I gave up running Zen 1 Ryzen with Sophos XG, I've had a Ryzen 1700 running KVM, gave it 4vCores and 6GB RAM, and on v18 I couldn't get more than 32MiB/s over a single connection and core, if I enabled TLS Decryption that thing would become unreasonable slow. Same thing happened with a Zen 1+ 2200G, but with software installation.

I went back to a G5400, and I could max out a 1G link over a single core/connection, even with some imix traffic - I would still reach 1GB with NGFW Traffic (IPS+ATP+AppCtrl), and with TLS Decryption the throughput has around 62MiB/s with imix traffic.

Now I'm running with a (Temporary) Ryzen 3300x (Zen 2) and I'm not facing any of the throughput issues I had before with Zen 1. Here's a picture showing the CPU usage on a 1Gbit link HTTP speedtest with IPS+ATP+AppCtrl and AV.

TL;DR: Don't use Zen 1 and Zen 1+ Ryzen CPU's with Sophos XG, if you can stick with Intel.

Thanks a lot for your input regarding zen 1, is your 3300x runing sophos virtualized?

this is sophos VM on iddle

This is sophos VM on load 600mbs but no security attached (IPS, APPS, etc), just plain firewall.

is your 3300x runing sophos virtualized?

I've used it on KVM for a week, but didn't saw any performance slowness on it virtualized.

It's now running XG on bare-metal with the software installation - since there's no need to virtualize anymore. Also looking at the monthly CPU usage, It looks like running a 3300x on XG Home is a waste of money, lol.

But hey, I got it for free, so I'll probably keep using it :)

Also, on your KVM/QEMU setup, what CPU model are you using? QEMU64, or KVM64, EPYC ? Or are you doing a host-passthrough?

On QEMU It's recommended whenever possible to use "host-passthrough", if you use QEMU64/KVM64 as the CPU Model, or any other one, you will see a even worse performance on it.

The only problem on using host-passthrough is with live migration, but since your a home user you shouldn't have to worry about it.