Re: 10GBit OpenBSD Firewall

2013-09-13 Thread Henning Brauer
* Andy a...@brandwatch.com [2013-09-02 15:55]: Also I'm very willing to beta test the new ALTQ code? I was chatting to Theo briefly a few weeks back and he said I should ask for the code but I cannot remember who in the team he said I should message for this? c'est moi. diff at

Re: 10GBit OpenBSD Firewall

2013-09-13 Thread noah pugsley
On Fri, Sep 13, 2013 at 12:02 AM, Henning Brauer lists-open...@bsws.dewrote: * Andy a...@brandwatch.com [2013-09-02 15:55]: Also I'm very willing to beta test the new ALTQ code? I was chatting to Theo briefly a few weeks back and he said I should ask for the code but I cannot remember who

Re: 10GBit OpenBSD Firewall

2013-09-13 Thread Janne Johansson
If you queue your http traffic, downloading those pics are not that bad on the links. ;) 2013/9/13 noah pugsley noah.pugs...@gmail.com On Fri, Sep 13, 2013 at 12:02 AM, Henning Brauer lists-open...@bsws.de wrote: * Andy a...@brandwatch.com [2013-09-02 15:55]: Also I'm very willing to

Re: 10GBit OpenBSD Firewall

2013-09-13 Thread Henning Brauer
* noah pugsley noah.pugs...@gmail.com [2013-09-13 09:12]: Gosh darn you Henning and your gigantic bavarian slides! Gosh darn you to heck. I'm not barb... erm, bavarian. -- Henning Brauer, h...@bsws.de, henn...@openbsd.org BS Web Services GmbH, http://bsws.de, Full-Service ISP Secure Hosting,

Re: 10GBit OpenBSD Firewall

2013-09-04 Thread andy
On Mon, 02 Sep 2013 09:56:46 -0400, John Jasen jja...@realityfailure.org wrote: Please forgive the top posting. If you have enough systems, can you hit the performance goals with carp and active load balancing? I did think about that but these boxes will also be running OpenOSPFd and

Re: 10GBit OpenBSD Firewall

2013-09-04 Thread Janne Johansson
Our ospfd boxes didn't like having PF on during failovers, while having ospf redundancy upwards and carp redundancy downwards, since PF normally doesn't like when it can't see the whole flow. Perhaps doing sloppy-states could have fixed it, perhaps no-state could have done it, but in the end, we

Re: 10GBit OpenBSD Firewall

2013-09-04 Thread Janne Johansson
Might have been PF reassemble that had issues with fragments coming in to different hosts, where at least one of the active PFs would be waiting forever for the missing pieces to arrive also. The solution was to not PF on routers anyhow, and that is good separation of duties in any case.

Re: 10GBit OpenBSD Firewall

2013-09-04 Thread andy
On Wed, 4 Sep 2013 15:19:07 +0200, Janne Johansson icepic...@gmail.com wrote: Our ospfd boxes didn't like having PF on during failovers, while having ospf redundancy upwards and carp redundancy downwards, since PF normally doesn't like when it can't see the whole flow. Perhaps doing

10GBit OpenBSD Firewall

2013-09-02 Thread Andy
Hi everyone, I know this gets discussed a lot and I don't want to re-tread old ground, but I am in the process of specifying firewall hardware for 10Gbit and would like to check the rules-of-thumb I am using.. We would like to reach 1 Million pps, and would like to forward at least up-to the

Re: 10GBit OpenBSD Firewall

2013-09-02 Thread Mike Belopuhov
On 2 September 2013 12:26, Andy a...@brandwatch.com wrote: Hi everyone, I know this gets discussed a lot and I don't want to re-tread old ground, but I am in the process of specifying firewall hardware for 10Gbit and would like to check the rules-of-thumb I am using.. We would like to reach

Re: 10GBit OpenBSD Firewall

2013-09-02 Thread Denis Fondras
Hi Mike, Le 02/09/2013 13:21, Mike Belopuhov a écrit : We are trying to address problems with MP networking right now, but due to the lack of manpower the progress is slow. What would you need to accelerate ? Developpers, testers, time, money, hardware, something else ? Denis

Re: 10GBit OpenBSD Firewall

2013-09-02 Thread Kenneth R Westerback
On Mon, Sep 02, 2013 at 01:41:58PM +0200, Denis Fondras wrote: Hi Mike, Le 02/09/2013 13:21, Mike Belopuhov a ?crit : We are trying to address problems with MP networking right now, but due to the lack of manpower the progress is slow. What would you need to accelerate ? Developpers,

Re: 10GBit OpenBSD Firewall

2013-09-02 Thread Andy
If only you could 'buy' more time or make days longer.. ;) Because I know the OpenBSD developers are working hard on this and take it very seriously, we have decided that we are going to continue to use OpenBSD for these new 10G firewalls because the initial load is only going to be around

Re: 10GBit OpenBSD Firewall

2013-09-02 Thread John Jasen
Please forgive the top posting. If you have enough systems, can you hit the performance goals with carp and active load balancing? On 09/02/2013 09:53 AM, Andy wrote: If only you could 'buy' more time or make days longer.. ;) Because I know the OpenBSD developers are working hard on this