This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

New Home-based UTM build

Hey guys/gals, I'd like to build a home UTM to support my 60D/4U connection. I'd like to have all services, most importantly IDS/IPS and Gateway AV enabled.

I'm curious to see what has or has not worked for you guys and if you could give me a few suggestions for possible builds that would support my needs.
I've read through the hardware requirements, but I want to be sure that I'm getting the most bang for my buck when purchasing equipment.

Thanks!

This thread was automatically locked due to age.

0 BarryG over 10 years ago

Hi,

Users have reported that the new Intel Atoms (Silvermont and Rangely) can handle about 100mbps through the IPS.

Personally, I like to use Intel Haswell i3 CPUs.

You need at least 2 NICs, preferably Intel or Broadcom, and 4-8GB RAM.

A system I built for home is described at
https://community.sophos.com/products/unified-threat-management/astaroorg/f/52/t/29162
although smaller systems are possible; this one is the size of a large shoebox.
Note the Atheros NIC is still unsupported.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 wsnp over 10 years ago

Much appreciated Barry! I've got an old 1155 system that I could put a Sandy Bridge in, but I'll consider the Haswell build as well.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 10 years ago

Sandy Bridge is fine.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 wsnp over 10 years ago

Do you know if Sophos will support a hexa-core CPU (like an X5650)? Or is it just limited to 4 cores?

Thanks!
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 10 years ago

It can support many CPU cores, but the way the IPS (and possibly the VPNs) work is that one network stream cannot run on more than one Snort process, so you have to have many simultaneous streams (connections) to take advantage of many CPUs.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 TheDrew over 10 years ago

And also, unless you can turn it off in the bios, Intel's power saving technology in multi-core systems will adjust the CPU's core speed in relation to overall load. So a quad-core i7 could actually perform worse overall then a dual-core i3/i5 if the UTM isn't loading the cores enough.
Cancel
Vote Up 0 Vote Down

Cancel
0 wsnp over 10 years ago

Thanks for the input Barry and Drew!

Do you guys recommend SSD's over HDD's? If so, what is the importance?
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 10 years ago

hdd will be fine in your use case.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 10 years ago

I recommend NOT using SSDs unless you're willing to spend a lot more money for an enterprise grade one, as heavy writes (logging, etc.) wear out consumer SSDs quickly.

Also, there is no benefit in using an SSD, except possibly if you're doing massive web caching for hundreds of users.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 darrellr_01 over 10 years ago

I did not think even the consumer SSDs were nearly as susceptible as previously thought. I know the enterprise drives (SLC?) are better, but I was thinking the consumer SSDs are still thought to outlast most mechanical drives at this point. I definitely could be wrong...wouldn't be the first|last time.
Cancel
Vote Up 0 Vote Down

Cancel

New Home-based UTM build

Submitted a Tech Support Case lately from the Support Portal?