Supermicro A1SRi-2558F

Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.
C

canta

Well-Known Member
Nov 26, 2014
1,012
216
63
43
RTM said:
While I am not generally fond of buying stuff with the hope that something "might" be implemented in the future, the rangeley platform has some serious potential for becoming an awesome VPN box. As Patrick mentioned, Rangeley (c2558/c2358/c2758) supports QuickAssist, which is a separate crypto engine that should be many times more efficient than using AES-NI.

I do not consider these numbers very accurate (they change a little for every blog post), but if they hold up somewhat, the QA in a C2758 should be able to do 7/8Gbps IPSEC (src 1, 2) and a "fast quad core Xeon" should be able to do about 2 Gbps IPSEC (src 2).

Apparently QA in C2558 is slower than C2758, but even half of 7/8 Gbps is pretty awesome for such as small box.
Click to expand...
we will see for QA...

I am talking openVPN not ipsec in general..
in general speaking, i3 or e3 still the best working solution for vpn
AES is still common to support vpn..

I doubtly QA would be major due on non long term proof

I remember, VIA has AES that help processing directly, just load the kernel module and work as intended.
poor VIA... this did not pickup by many users.

hopefully, QA would be not proof of concept to work on.
AES has been used many years back in 1990 and works!
and I am glad intel put AES to N series SoC processor..
 
C

canta

Well-Known Member
Nov 26, 2014
1,012
216
63
43
spyrule said:
I have the A1SAi version of this board, and I run Sophos UTM 9 on it, and its rock solid, and performs awesome. Highest CPU so far is about 9% when I was doing a major version upgrade a few months past.

Only thing to be aware of, these boards DO NOT support ANY non ECC memory. So just make sure you plan for that when ordering hardware (my supplier told me my ram was ECC, when in fact it wasn't, and I had to wait an extra 2 weeks to get my ram... grrrr).
Click to expand...
try to act as vpn client or serve vpn server. openvpn is very common ..

you will see when 1 connection with fully data transfer will eat cpu processing ...

I am running J1800 (without AES). average is 10% with two other VMs of debian.
this will hit to 80-90% when running openvpn client when transfering data...m but still no slowdown or reduce performance.
idling with openvpn client running just take around 10&-12%....

I think QA has been around in discussion, intel submitted the patch in 2014 and pfsense is porting from linux to their code :D.
my understanding, I see no real result instead of simple testing with ipsec.
imagine when connecting to site with openvpn and should running 24/7 without a glictch..
 
Last edited:
P

PnoT

Active Member
Mar 1, 2015
650
162
43
Texas
I have this boards bigger brother the A1SRi-2758F and use openVPN a lot. The unit is hosting 1 server and 4 clients to route my traffic accordingly and @ 185Mbps, through the various tunnels, it sits at 13% CPU. These boards are pretty sweet.
 
C

canta

Well-Known Member
Nov 26, 2014
1,012
216
63
43
PnoT said:
I have this boards bigger brother the A1SRi-2758F and use openVPN a lot. The unit is hosting 1 server and 4 clients to route my traffic accordingly and @ 185Mbps, through the various tunnels, it sits at 13% CPU. These boards are pretty sweet.
Click to expand...
Running fully busy with vpn tunneling?...
Check on htop..
That could be one core is processing..

My baytrail d is running proxmox and 3 vms..


Are you using qa ? Since it has been patched in Linux.

Having a big brother model will help.
 
P

PnoT

Active Member
Mar 1, 2015
650
162
43
Texas
canta said:
Running fully busy with vpn tunneling?...
Check on htop..
That could be one core is processing..
Click to expand...
Yes, I typically max out my connection over tunnels but have no looked at if one proc is processing it all or not because I'm lazy and just check the pFsense gui =)
 
  • Like
Reactions: canta
C

canta

Well-Known Member
Nov 26, 2014
1,012
216
63
43
abstractalgebra said:
While the AES Encryption Standard competition took over 5 years with multiple rounds and many reviews, the AES Standard was not finalized until Nov 2001. Perhaps in 1990 you were using 3DES or another algorithm :)
Click to expand...
I think 90... , read many paper on AES and was studying in university before move to us in late 90.. to continue my study and stuck in US after graduation..
haha, you are correct, need more coffee morning:D...
I started with via miniitx that has aes on the cpu, 2000- is the correct answer..
I was freak-out at that time, AES supported in CPU, nice!!!

thanks for correction.
 
C

canta

Well-Known Member
Nov 26, 2014
1,012
216
63
43
PnoT said:
Yes, I typically max out my connection over tunnels but have no looked at if one proc is processing it all or not because I'm lazy and just check the pFsense gui =)
Click to expand...
thanks.
very interesting mini-itx board of big brother.
I would put in my future upgrade list..

I am a hardcore cli :p hahahah.

my issue on openvpn is
remote node <-> HQ center.
when moviong many small files between those two site, openvpn client and server will suck up cpu cycle very much.
transfering big data is ok.
my understanding: due on smal files and more overheads, openvpn need extra works with addition with ency/decrypt

side notes:
I was skeptikal with Intel bay trail D that is very cheap!!. I got one for $35 new.
and was surprised when I can load 2 heavy VMs (router and openvpnclient) and a ligh debian vm.
the consumption is pretty good for 10W(mostly)-15W(max), compared with my old Celeron 847 that eats 20W idle.
waiting Xeon D to drop in price :D....
 
A

Aluminum

Active Member
Sep 7, 2012
431
46
28
I wouldn't count on openvpn getting QA speedups anytime soon...maybe never. (snort was dropped by intel for example) Some of the other vpn stuff loves it though, ipsec for example.

Openvpn is oldschool single threaded userspace (last I checked) so you want oldschool true cpu grunt, aka the mainstream cores (ivy/hasw/broad/sky etc) and reasonably high clockspeed. The most bang/$ to get this is the cheap dual cores, they tend to be higher clocked than their desktop quad core equivs too, much higher than most high core count server cpus. Make sure you run a recent config too, pfsense took awhile to enable aes-ni properly for example.
 
P

PnoT

Active Member
Mar 1, 2015
650
162
43
Texas
Aluminum said:
Make sure you run a recent config too, pfsense took awhile to enable aes-ni properly for example.
Click to expand...
As far as I now you simply set it up under System > Advanced settings > Miscellaneous > Cryptographic hardware and then in your OpenVPN profile set Encryption algorithm to match the server side while leaving Hardware Crypto to No hardware Crypto Acceleration.

This document describes it unless I've missed something.

Are cryptographic accelerators supported - PFSenseDocs
 
JimPhreak

JimPhreak

Active Member
Oct 10, 2013
553
55
28
Anyone know where I can get a backplate for one of these MB's? Didn't realize the seller wouldn't be sending the MB with one even though the listing said no accessories included. I just figured that was one accessory that would always come with it.

There are ones for sale on eBay for 1U or 2U rack chassis' but I'm using a mini-itx micro case for the time being so I need the backplate that normally ships with the board.
 
K

Keljian

Active Member
Sep 9, 2015
428
71
28
Melbourne Australia
Having worked in a different product based company (in marketing) I know that if someone asked for a part, which we didn't ordinarily sell; we would either give it to them for free or at minimal cost
 
You must log in or register to reply here.
Top Bottom