This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Hardware Limitations In Home version

Is it possible to get the hardware limitations removed for the home version?  Or have they been removed in V18?



This thread was automatically locked due to age.
  • I tried with a set of 250 snort rules and there is not change in performance, so it doesn't matter how much I tune up the rules.

  • The current version of Snort used by XG is single threading.

     

    Ian

  • Do you know the commands to enable all the offloading so it's processed on the nic?

  • l0rdraiden said:
    Do you know the commands to enable all the offloading so it's processed on the nic?

    Yes, but please don't do this, all offloading is already disabled by the own Sophos developers for a reason, enabling it will only cause issues for you.

    Primarily to Snort  with netmap work correctly, all NIC offloading needs to be disabled, and of course there can be more software inside XG that also needs it to be disabled.

     

    Even if you enable all offloading, on a reboot all your changes will be overwritten.

     

    Remember, XG is a firewall, not a router, so there isn't much use for NIC offloading since you want to inspect the packets.

     

    Thanks!

  • Hi,

    just to add some more confusion: :)

    SFVH_SO01_SFOS 18.0.1 MR-1.HF050520.2# ethtool --show-offload Port1
    Features for Port1:
    rx-checksumming: on [fixed]
    tx-checksumming: on
    tx-checksum-ipv4: off [fixed]
    tx-checksum-ip-generic: on
    tx-checksum-ipv6: off [fixed]
    tx-checksum-fcoe-crc: off [fixed]
    tx-checksum-sctp: off [fixed]
    scatter-gather: on
    tx-scatter-gather: on
    tx-scatter-gather-fraglist: off [fixed]
    tcp-segmentation-offload: on
    tx-tcp-segmentation: on
    tx-tcp-ecn-segmentation: on
    tx-tcp-mangleid-segmentation: off
    tx-tcp6-segmentation: on
    udp-fragmentation-offload: off
    generic-segmentation-offload: on
    generic-receive-offload: off
    large-receive-offload: off [fixed]
    rx-vlan-offload: off [fixed]
    tx-vlan-offload: off [fixed]
    ntuple-filters: off [fixed]
    receive-hashing: off [fixed]
    highdma: on [fixed]
    rx-vlan-filter: on [fixed]
    vlan-challenged: off [fixed]
    tx-lockless: off [fixed]
    netns-local: off [fixed]
    tx-gso-robust: on [fixed]
    tx-fcoe-segmentation: off [fixed]
    tx-gre-segmentation: off [fixed]
    tx-gre-csum-segmentation: off [fixed]
    tx-ipxip4-segmentation: off [fixed]
    tx-ipxip6-segmentation: off [fixed]
    tx-udp_tnl-segmentation: off [fixed]
    tx-udp_tnl-csum-segmentation: off [fixed]
    tx-gso-partial: off [fixed]
    tx-sctp-segmentation: off [fixed]
    tx-esp-segmentation: off [fixed]
    fcoe-mtu: off [fixed]
    tx-nocache-copy: off
    loopback: off [fixed]
    rx-fcs: off [fixed]
    rx-all: off [fixed]
    tx-vlan-stag-hw-insert: off [fixed]
    rx-vlan-stag-hw-parse: off [fixed]
    rx-vlan-stag-filter: off [fixed]
    l2-fwd-offload: off [fixed]
    hw-tc-offload: off [fixed]
    esp-hw-offload: off [fixed]
    esp-tx-csum-hw-offload: off [fixed]
    rx-udp_tunnel-port-offload: off [fixed]

     

    I‘m using virtio on Proxmox KVM, no passthrough devices.

    Best Regards

    Dom

  • One thing;
    Is fastpath enabled and working? You can see if it is by executing: "system firewall-acceleration show" On the console

    I believe there's no support for it with the virtio driver.

     

    Thanks!

  • My network card is passthrough to the VM so maybe these are disable by default becasue the KVM image is intended to run virtualized.

    It would be interesting to see how "ethtool --show-offload Port1" looks like in an enterprise hw model of Sophos XG, anyone can post it?

  • console> system firewall-acceleration show
    Firewall Acceleration is Disabled. Fastpath Unload Failed.

    This topic was recently discussed here: community.sophos.com/.../questions-about-the-fastpath-feature

    FW accel and Fastpath should be disabled for not-ESX hypervisors, see here: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/Architecture.html 

  • But does it work in physical NICs?

  • Any news above increase the CPU or RAM limit? CPU is particulary a problem in virtualized environments.

    Can something be done in this regard?