Review Request: Protectli Vault Pro 6600 series

[madowl]

Yesterday I got an email from Protectli that they have finally launched a series with onboard sfp+ interfaces and would really like to see what your take is on them compared to the other similar devices you've reviewed recently (like the GoWin 1U and the Minisforum MS-01 for example).

Home - Protectli CA

Please note: Due to the strike at Canada Post, all orders with Free Shipping will be shipped via UPS unless otherwise specified. The Vault One Platform. Endless Solutions. Learn More Buy Now CA-Based Support | Free Shipping in Canada on orders over $99 CAD I 30-Day Money Back Guarantee Meet the...

protectli.com

Looking at the specs on paper compared to my Protectli 4-ports it really looks to me like the newer processor is overkill for just running PFSense. I'm curious though as to how much processing power is actually needed to push a decent amount of traffic through the interfaces and whether having IDS or other tools running on it justify the additional cost and cpu bump.

Look forward to seeing this reviewed if you can make it happen.

 

[elvisimprsntr]

Glad they kept the RJ45 COM port so I can connect my GPS receiver as a stratum 0 NTP source.

GitHub - elvisimprsntr/pfsense-ntp-gps: pfSense NTP GPS Server

pfSense NTP GPS Server. Contribute to elvisimprsntr/pfsense-ntp-gps development by creating an account on GitHub.

github.com

I'll likely wait for the previous generation to show up on evilBay at a substantial discount.

 

[louie1961]

Seems like a lot of money for what it is. You are paying a premium for a small sized PC. You could easily build yourself an 8L PC with all the same features for about half the money. Probably less if you step up to an ITX sized motherboard.

 

[madowl]

Seems like a lot of money for what it is. You are paying a premium for a small sized PC. You could easily build yourself an 8L PC with all the same features for about half the money. Probably less if you step up to an ITX sized motherboard.

I'm also curious as this compares to the Minisforum MS-01 that was reviewed a few weeks back, which is cheaper then the Vault Pro (even with the most expensive MS-01 processor option). For example I can't tell whether the VP6650 has a fan or not which would be a factor between purchasing the two for me. But I'm also interested in packet performance as well between the two because I haven't seen anything to show how processor speed is impacting network performance running something like PFSense or OPNSense. Not sure if the STH team is setup for doing line rate testing with iperf and similar tools but would really like to know what the difference is between these two little systems and what the minimal processor is these days for a configuration like this. I see a lot of celeron configurations for 4x1GB which seem to be just fine (unless you really load them up with IDS/IPS), but what is the config for 2x10GB + 2x2.5GB?

 

[elvisimprsntr]

@madowl

1. The VP6600 models look like they have two fans based on board photos.



2. Looks like it comes with a passive heat sink for a M.2 2280 SSD/NVMe



3. Protectli posts their own benchmarks, although the new VP6600 models have not been added yet.

pfSense® IPSec VPN Performance – Protectli Knowledge Base

kb.protectli.com

4. I would be curious how well the VP6600 models would be as a Proxmox hypervisor so one could run pfSense and others (i.e. web server) virtualized.

How to Install pfSense® CE as a VM on Proxmox VE – Protectli Knowledge Base

kb.protectli.com

 

[tfboy]

I decided to invest in a VP6650.
Delivery was fast and the feature set is impressive for such a small box.
I bought it with the aim of running pfSense so only got a 8GB DDR5 RAM and 250GB M2 drive, all supplied pre-configured by Protectli.

I really like it. The only issue is that the 10Gb SFP+ ports only seem to work with 10Gb SFP+ SFPs. 1Gb SFPs don't seem to work despite Intel saying the X710 chipset supports 1Gb data rates.

I have an ongoing ticket with their support and they are responsive, so I just hope we can sort out that problem. Otherwise, they have suggested they would take the box back and issue a full refund so they seem genuinely helpful and keen to fix the problem.

In that sense, yes, you pay more for the box, but the support they provide is certainly proving worthwhile.

Edit: yes, there are a couple of fans that are on the top of the box, hidden by the H-shaped plate with the Protectli branding. With the massive extruded aluminium heatsink design of the box, the fans never come on at low power / idle and the case is warm but not hot to the touch.

 

[tfboy]

Some photos







Cover has a a holder for a 2.5" HDD/SSD


Top:


Top with cover fan cover removed:

 

[tfboy]

I've had my unit running pfSense for a month or so now.

Their support team were great in helping me get to the bottom of my SFP issue. TLDR: you need an Intel-branded SFP or it just won't work. I used an FS.com one and rebranded it for Intel and as soon as I did that, the link came up!

I know I'm barely tickling the unit running just a 1Gb FTTP internet with pfSense. I've now also had an IPsec tunnel set up and it's working fine. The bottleneck is at the other end.

I did have a look at installing VMware on it. It will run but you need to customise the boot parameters to avoid a kernel panic. Protectli's website details what needs to be done.

So far, I'm very happy with it. The fans never kick in so it's silent and rather frugal on power consumption (it consumes less than my ISP-provided crippled router that was making a racket with its fans).

 

[pf740]

Thanks for the info. My isp provides 8gb/8gb via rj45 and my lan is mostly 10gb again over rj45 so I need to use 2 x 10gb to rj45 modules.

I emailed protect cli about sfp to rj45 10gb modules and they replied saying any modules should work which clearly isn't the case.

Would you mind sharing info on the fs modules? Are they very hot??

Thanks

 

[tfboy]

I'm assuming you're runnign pfSense or OPNsense or Proxmox or VMware ESXi 8.0 (those are the OSes I've tried).

If you need 10GBase-T then I think it's less picky than the fibre SFPs.
Whilst I was trying to get to the bottom of my issue, I tried several SFPs.
1Gb Cisco branded RJ45 - link came up
10Gb FS branded RJ45 - link came up (but I was only able to run at 1Gb as my PC on the other end only had a 1Gb NIC)
10Gb Cisco branded 10Gb-LR - no link.

So from my limited experience, it seems that it's most picky for Intel-branded SFPs when using fibre. The default FS or Cisco-configured FS RJ45 SFPs seemed to bring the link up without any issue.

My recommendation would be go get a 10Gb RJ45 SFP+ from FS but ensure it's coded Intel. That way, you're pretty much guaranteed not to have any problem. Something like this: https://www.fs.com/products/66613.html?now_cid=63

Edit: My fibre SFP is currently reporting:
vendor: FS PN: SFP-GE-BX SN: S2307479033 DATE: 2021-11-24
module temperature: 45.82 C voltage: 3.23 Volts
lane 1: RX power: 0.07 mW (-11.36 dBm) TX bias: 12.60 mA

 

[pf740]

Thanks for your reply. I'm using pfsense/opnsense installed directly. I noticed that they sell this on their site so I would probably get these.... Protectli 10G Base-T SFP+ - Protectli its a shame as I have 2x10gtek ones but I'm doubtful they would work.

Are you uk?, if so did you get stung for vat etc on import? Online calculator shows another £170 approx for taxs so I'm torn between this and an ms01...

Thanks

 

[tfboy]

Yes, I'm in the UK (Reading). I bought it for my business and as I'm UK VAT registered, I put in my VAT number and they didn't charge me any VAT. I could have had it shipped to an EU address which would have saved on the shipping costs, but the VAT was a far higher value so I went for a UK delivery and paid the shipping.
I haven't received any other customs bill (maybe I was just lucky).

I wouldn't bother buying SFPs from Protectli if you have some gtek ones. I'd try your gtek ones first and if they don't work, then maybe get some others. You can get FS ones at a similar price. Cost from FS would be under £85 inc VAT and delivery to a UK address.

 

[tfboy]

I also paid in Euros as I have a EUR account which minimised losses due to banks taking a cut with the echange rate.
Not cheap, but at least I'm future-proof!

 

[pf740]

Cheers for that info. I can pay in euros but it's the import tax that's likely to sting... the ms01 is a lot cheaper and faster cpu wise but I'm more drawn to the protect unit at the moment.... decisions...decisions...

 

[n00b]

What sort of speed are you able to get with Wireguard or IPSec VPN? thanks