pfSense/ OPNsense help

[tgl]

My recommendation would be to leave mesh off and just configure all AP's with same SSID and password. This works seamless for me.

It depends a lot on the clients you use. If you just have several independent APs broadcasting the same SSID, then it's totally up to the client devices which one to connect to and when to switch. There is a standard called "802.11k/v roaming", as well as various less-standard hacks, that let the APs encourage clients to move to the most appropriate AP (as seen from the APs' measurements rather than the clients'). You won't get any of that with independent APs, but if you enable mesh mode then you should get some form of it. How well that works still depends a lot on the clients, but for some people it makes a significant difference in the smoothness of transitions when a device moves around the house.

I'd say try it both ways and see if you notice a difference with your portable devices. If not, keeping the APs independent is probably the best way: fewer moving parts, less bug surface.

 

[Thomas01]

I have changed plans and I have now decided to get rid of the micro PC and get a custom workstation and use it as my router and install OPNsense on it. I need to know if OPNsense 23.1 is compatible and has driver support for the Intel X710-T2L NIC?

 

[avtella]

Yes it should work out of the box. I’m using one in pfsense.


It had a bug a couple of years back after a faulty Intel driver was included in a FreeBSD update and it wouldn’t do N-BaseT only 1/10 Gbps modes worked. It was fixed by pfsense 2.5 if I recall, I was directed by people on the pfsense forums to reach out to Intel/BSD developers. Intels BSD driver team fixed the issue after I filed a bug report and was included in the next BSD version 12.2 or 12.3 I forget, so it should work fine in OpnSense as well now without issue. I had to compile the latest drivers for a while till the fix was out.

If you have issues with detection you can also compile the latest drivers from Intel if needed using a copy of the FreeBSD version your OPNSense is based on. Unlikely but could happen if you are running the latest firmware on the T2L and the driver included in OpnSense is incompatible. Also can down grade firmware too.

 

[Thomas01]

if you are running the latest firmware

How do I update or downgrade the firmware on the NIC?

 

[avtella]

How do I update or downgrade the firmware on the NIC?

Download the firmware update or downgrade files from Intel’s site. Instructions are in there if you have issues let me know I’ll walk you through. I think 8.20 is the latest, not that I actually needed to upgrade, but that’s what I’m on. My card came with 7.2. No reason to upgrade/downgrade unless you have issues though. I’d install OpnSense first to see if it works out of the box.

 

[ddaenen1]

i can't recall i have ever updated the firmware of my Intel NIC's. The only NIC i ever had issues with was the onboard Realtek on a previous Asus board. Since then, that is a big no-no for me.

 

[coxhaus]

I don't own any of the new Intel NICs yet. I bought a Broadcom 10 gig NIC as there were drivers in the new FreeBSD for it. It seems to work well. I used Broadcom NICs back in my server days. We ran lots of Dell servers with Broadcom. I never had issues using them with Cisco switches.

I would think you could run Intel's update software and it would upgrade the NIC for you if you are running windows.

 

[avtella]

I should have clarified. There’s minimum required firmware versions depending on the driver in use. When compiling newer drivers during the big issue I had to use a newer firmware, after that I had no reason to upgrade anymore. You can see what changes are in each firmware in the upgrade notes. So if something is fixed that’s vital to you, you may be better off upgrading otherwise leaving it alone.

X710-T2L is fairly stable card other than the now fixed NBASE-T issue I personally haven’t run into anything noticeable. As far as I know Intel’s most problematic chips are probably the I225 series and the I226, can’t believe after this many years and multiple revisions there’s still issues. I believe some had to do firmware updates for those due to stability issues.

 

[coxhaus]

My Broadcom NIC is not NBASE-T as it is only 10 gig and 1 gig. I have a 10 gig switch so I figure I don't need it. My only issue is the heat in summer in Texas with 10 gig. The fans run in the switch which you can hear. My SMB switch is not nearly as noisy as the enterprise versions which sound like airplanes. But you can hear the fans in my open closet as it kind of echos. I set one up in her office for my daughter's work and you could not really hear it, so it depends.

 

[avtella]

Some of the newer cards like the X710-T2L and newer 10Gbe switches are a bit more power efficient and run much cooler, my ~$400 Zyxel 10Gbe switch is pretty quiet it’s sitting in my parents office, not even in a closet. I have an older X550 card as well and it runs much hotter. I even recall seeing some older BCM 10Gbe cards with a fan. Probably not with the significant cost for newer stuff though, unless just buying equipment and coming from nothing.

 

[coxhaus]

If you are using the Zyvel xs1930-10 which you have listed the heat generated is

Heat dissipation (BTU/hr) 151.06

My Cisco SG350x-24 generates less heat.

EEE, Energy Detect, Short Reach

110V=32.6W 220V=32.5W

N/A

111.2

Any way the Zyvel is 151.6 vs Cisco 111.2. The Cisco is about a third less heat. I think it is my closet.

It is hard to beat Cisco switches.

 

[avtella]

Could be then or smaller fan on your switch maybe meaning higher RPMs. Mine never hit the max fan speed at which it would be 50 Dbm, mostly around 28-30range I’d guess on stock fan. To be fair the Zyxel has all 10Gbe ports hence the higher max power draw.

Zyxel was pretty nice to work with to get optimal fan speeds, it actually was loud on release (though it never hit max speed) but I got them to put out an update lowering fan speeds as I felt the fan curve was too aggressive on release. The Noctua 40Mm fan I replaced it with is even more silent. I did watch temps to make sure they were reasonable before committing to the Noctua.

 

[coxhaus]

That makes sense if you replaced the fan with a silent one. Cisco usually has the latest technology out so I thought it was strange Zyvel would have newer chips. Cisco really has the more power efficient chips. Cisco outdates its equipment when the technology gets old and discontinues support for its equipment. Cisco wants to have the latest and greatest out there.

 

[avtella]

The Zyxel has 8x Rj45 10Gbe and 2 SFP+ so it’s still pretty efficient or at least not too bad. The Cisco has 4x SFP+ and rest are only 1 Gbe ports so would use less power. The 10Gbe RJ45 ports are always going to be more power hungry compared to SFP+ and of course compared to 1 Gbe ports. So it makes sense why peak power draw would be higher if all ports are linked at 10Gbe.

 

[coxhaus]

24 ports plus 2 extra SFP+ ports vs 8 ports but I hear you. The Zyxel does show a little more switching capability. Not sure of actual 64 byte packets.

Does the Zyxel do layer 3?

 

[avtella]

Yes but probably more basic compared to your Cisco. The Zyxel is listed as “Layer 3 Light”. So no stuff like load balancing etc, and for you more importantly inter VLAN routing.

Features:

XGS1930 Series - 24/48-port GbE Smart Managed Switch with 4 SFP+ Uplink | Zyxel Networks

www.zyxel.com

1930’s L3 features:

• Static route
• Assigned DHCP relay with specific source IP interface

 

[coxhaus]

It seems strange you have static routes but no interVLAN routing. You really need interVLAN routing to use L3 switching. Otherwise, you require a router.

 

[avtella]

Static VLAN routing is supported looks like I was wrong, you are right. I was looking at policy based routing for some reason.

Here’s the updated data sheet with changes from latest firmware.

https://download.zyxel.com/XS1930-10/datasheet/XS1930-10_3.pdf

 

[coxhaus]

Ok, why don't you test it. Use my method to set up L3 switching. Then we will know for sure.
It is posted under one of the pfsense threads. I just posted it a few days ago.

 

[avtella]

I don’t wanna take down the network at my parents place right now. Additionally my understanding of networking is not at the same level as you or some of the others here so I will try it when my father doesn’t have stuff running, using your advice.

Edit: got some time now, stuck at last step from the instructions below as the last page is missing from the XS1930. I only have a couple of days before I leave for my own home so I’ll try to get the testing done before then.

Instructions, supposedly valid for the XS1930:

https://support.zyxel.eu/hc/en-us/articles/6983667185170-How-to-configure-inter-routing-between-different-VLANs

Edit 2:
This may work, seems I don’t need that last step in the other instructions, will try tommorow or day after:

How to configure the switch to route traffic across VLANs

The purpose of VLANs are to isolate one broadcast domain from another.

community.zyxel.com

Edit 3: Seems to have worked.