Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 99 replies
  • Answers 2 answers
  • Subscribers 37 subscribers
  • Views 72547 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Hardware Limitations In Home version

Flyncalpoly

Is it possible to get the hardware limitations removed for the home version?  Or have they been removed in V18?



This thread was automatically locked due to age.
  • 0 in reply to l0rdraiden

    Hi,

    in virtual environments you need to lock CPU and memory resources to the XG otherwise you end with strange performance issues.

    Ian

  • 0 in reply to rfcat_vk

    I have them locked to 4 and 6GB, but still you lose performance due to virtualization and CPU for virtualization has many cores and usually run at lower frequencies.

  • 0 in reply to l0rdraiden

    Hi,

    really depends on how much slower the CPU is say compared to a 4 cOre celeron or atom?

    how much degradation in throughput are you seeing and what is causing the degradation?

    ian

  • 0 in reply to rfcat_vk

    I can't compare vs a non virualized environment but I know the HW that some Sophos XG appliaces has and the cores of my CPU should be much more powerfull despite being virtualized.

    www.amd.com/.../amd-ryzen-5-2400g

    At least I can tell you that the overhead per core due to virtualization is around 10% in my case, comparing htop in host and on VM.

    NIC are passthough and everyhing from a KVM perspective (CPU, Storage is in raw format) is optimiced to increase performance.

    I have assigned 6gb DRR4 at 3000MHz

    NVME samsung evo 970 dedicated

  • 0 in reply to l0rdraiden

    Be honest here, what kind of performance are you expecting on your 2400G? And what throughput you have right now?

  • 0 in reply to Prism

    I have 600mpbs symetric

    If I enable IPS and APPs, it depens but download is around 300 and upload 170 or so.

    The thing is that even with a light configuration CPU cores reach 100%. My area will move soon to 1Gbps, so probably I will have problems. I can get a better CPU but that won't help a lot since more than 4 cores can't be assigned and my CPU can reach 3.8Ghz boost to is a lot more compared with atoms and celerons which are usually around 2.5Ghz.

    I know that part of the issue is snort but snort will move soon to snort 3 and will work much better with muilticore like suricata. Another thing is how many years will take sophos to implement snort 3 once released.

    Ram is usually around 4gb.

  • 0 in reply to l0rdraiden

    I can't see how you're hitting 100% CPU - I was running Sophos G on a Dell Optiplex 3010 with i5-3470, HP 2x port 1Gb card, and the machine had 8GB RAM, 128GB SSD, the CPU with the 500/35 VM Connection here never went about 18%, that was running v18 with IPS, DPI, Web policies, Application policies.

     

    Something is either wrong with your configuration, or the AMD processors just can't and don't perform well - I've seen issues in the past with pfSense and AMD - hence the reason I'm suggesting this as a possibility.

  • 0 in reply to l0rdraiden

    The thing is that even with a light configuration CPU cores reach 100%.

    I'll be honest with you, I gave up running Zen 1 Ryzen with Sophos XG, I've had a Ryzen 1700 running KVM, gave it 4vCores and 6GB RAM, and on v18 I couldn't get more than 32MiB/s over a single connection and core, if I enabled TLS Decryption that thing would become unreasonable slow. Same thing happened with a Zen 1+ 2200G, but with software installation.

    I went back to a G5400, and I could max out a 1G link over a single core/connection, even with some imix traffic - I would still reach 1GB with NGFW Traffic (IPS+ATP+AppCtrl), and with TLS Decryption the throughput has around 62MiB/s with imix traffic.

     

    Now I'm running with a (Temporary) Ryzen 3300x (Zen 2) and I'm not facing any of the throughput issues I had before with Zen 1. Here's a picture showing the CPU usage on a 1Gbit link HTTP speedtest with IPS+ATP+AppCtrl and AV.

     

    TL;DR: Don't use Zen 1 and Zen 1+ Ryzen CPU's with Sophos XG, if you can stick with Intel.

  • 0 in reply to Prism

    Thanks a lot for your input regarding zen 1, is your 3300x runing sophos virtualized?

     

    this is sophos VM on iddle

    This is sophos VM on load 600mbs but no security attached (IPS, APPS, etc), just plain firewall.

  • 0 in reply to l0rdraiden

    is your 3300x runing sophos virtualized?

    I've used it on KVM for a week, but didn't saw any performance slowness on it virtualized.

    It's now running XG on bare-metal with the software installation - since there's no need to virtualize anymore. Also looking at the monthly CPU usage, It looks like running a 3300x on XG Home is a waste of money, lol.

    But hey, I got it for free, so I'll probably keep using it :)

     

    Also, on your KVM/QEMU setup, what CPU model are you using? QEMU64, or KVM64, EPYC ? Or are you doing a host-passthrough?

    On QEMU It's recommended whenever possible to use "host-passthrough", if you use QEMU64/KVM64 as the CPU Model, or any other one, you will see a even worse performance on it.

    The only problem on using host-passthrough is with live migration, but since your a home user you shouldn't have to worry about it.