Sophos

[Ericloewe]

http://www.servethehome.com/dell-silicom-peg6i-port-gigabit-gige-intel-82571eb-network-adapter/

That picture looks completely unlike the one from amazon, but it does clearly show what looks like a PCI-e switch chip right next to the edge connector.

 

[jgreco]

could be. I am on mobile, so I am not looking at pictures.

 

[Ericloewe]

Well, PCIe bifurcation can be used to separate up PCIe lanes, so I'm going to spitball here and suggest that yes you could jam four PCIe X4 onto an X16. I can definitely give you the part number of a card to split X16 into two X8 for the Supermicro C2750 board....

Maybe I have stuff confused a little bit, but what I do know for sure is that the PCI-e root controller can only talk to a limited number of devices (for whatever reason).
Assuming you can split the clock and misc. signals, adapters like the one you quote probably work on motherboards where the PCI-e root still has "positions" available.
Kinda like the ASRock C2x50 boards - they had enough bandwidth for the two i210s, the Marvells and the PCI-e slot, but needed a switch because C2000 SoCs only support a handful of devices.
Supermicro's boards probably have little else connected to PCI-e, hence why they can have their 16x slot split in two.

 

[rogerh]

That picture looks completely unlike the one from amazon, but it does clearly show what looks like a PCI-e switch chip right next to the edge connector.

Silicom themselves seem to reckon it should look like the servethehome one, not much like the amazon.com one.

http://www.silicom-usa.com/Networki...net_PCI_Express_Server_Adapter_Intel_based_50

 

[jgreco]

Ok, well, judging from

http://www.ebay.com/itm/Silicom-PEG...abit-PCI-E-server-Adapter-YK537-/171619226479

it does appear to be a PLX PEX8517 PCIe 16-lane 5-port switch. See, this is why I hate carrying on discussions on tapatalk. So much easier to do this stuff on a PC. So next time have the damn decency to wait until I'm on a laptop, eh! :)

 

[zoomzoom]

Will a mini-ITX board (SuperMicro A1SRi-2758F) fit inside of a thin mini-ITX chassis (is it even wise to do so)?

 

[jgreco]

Probably, but it really depends on the specifics. It may not be a wise idea. Usually if you want stuff to work well in the long run, trying to shoehorn it into a too-small package is a good way to screw up something like cooling.

 

[zoomzoom]

That was my concern since they're only ~40mm in height

 

[jgreco]

Well, get a board, a case, put it together, and run it for a few hours at full load, monitoring temps at various points with an infrared temperature gun. I mean, not to put too fine a point on it, but half of it is using common sense to reject obviously-going-to-fail scenarios and the other half is putting together a potentially viable system and seeing if it actually IS viable. Then repeat tests assuming a fan stalls or fails. The ideal chassis for what you're describing would probably be a chunk of aluminum capable of passively dissipating lots of heat. The silent PC / HTPC guys have some of that sort of stuff going on, so you might be wise to look around at what's worked for them.

 

[Ericloewe]

Ok, well, judging from

http://www.ebay.com/itm/Silicom-PEG...abit-PCI-E-server-Adapter-YK537-/171619226479

it does appear to be a PLX PEX8517 PCIe 16-lane 5-port switch. See, this is why I hate carrying on discussions on tapatalk. So much easier to do this stuff on a PC. So next time have the damn decency to wait until I'm on a laptop, eh! :)

If it makes you feel better, I was also on my phone. :p

Well, get a board, a case, put it together, and run it for a few hours at full load, monitoring temps at various points with an infrared temperature gun. I mean, not to put too fine a point on it, but half of it is using common sense to reject obviously-going-to-fail scenarios and the other half is putting together a potentially viable system and seeing if it actually IS viable. Then repeat tests assuming a fan stalls or fails. The ideal chassis for what you're describing would probably be a chunk of aluminum capable of passively dissipating lots of heat. The silent PC / HTPC guys have some of that sort of stuff going on, so you might be wise to look around at what's worked for them.

You'd have to void the warranty on an Avoton board, but the cool thing right now are chassis doubling as CPU heatsinks.
Silly as it sounds, it might be easier to find an ultra-small chassis for a Xeon E3 system than for (non-integrated) Avoton.

 

[Jailer]

Will a mini-ITX board (SuperMicro A1SRi-2758F) fit inside of a thin mini-ITX chassis

No, the rear I/O panel is too tall. I imagine the heatsink is too but I wouldn't know without checking the actual specs.

 

[joeschmuck]

Will a mini-ITX board (SuperMicro A1SRi-2758F) fit inside of a thin mini-ITX chassis (is it even wise to do so)?

That is a pricey board for a router/firewall for home use. What are you finding the cost is with this thing?

Also, when it comes to case cooling, you need to decide on a MB and then choose a case. Your talking about this build has me so damn interested in building one myself but first I need to find out if there are any new hardware requirements expected for Sophos V10. I'm off to ask that now.

 

[Jailer]

That is a pricey board for a router/firewall for home use.

But necessary if you are on a very fast connection and want full line speed, especially if you run any other goodies on top of it such as IDS/IPS software. Basically (very basically) the faster your connection the more hardware you need to pass all those packets.

 

[joeschmuck]

But necessary if you are on a very fast connection and want full line speed, especially if you run any other goodies on top of it such as IDS/IPS software. Basically (very basically) the faster your connection the more hardware you need to pass all those packets.

So what is the maximum throughput this board can support while having IDS/IPS turned on? I think it's important to rate components like this on throughput and longevity. If you know that information I would certainly be interested in it, and I'm not bashing your comment, I am truly interested. Right now I'm looking at an i3-4160 CPU and ITX MB with a RealTek NIC but a PCI-e 16 slot for my dual port NIC card. Also I can use my current DDR3 RAM (which I have a lot of). I understand that this CPU can handle 400Mbps throughput however I'm not sure how accurate that is. I do understand that it handles 110Mbps while running a .6% CPU load. I may be able to select a lesser CPU but should I is the question.

 

[Jailer]

Generally a modern CPU of 2Ghz or faster is recommended on the pfsense forums for 1Gb internet. I know that has nothing to so with Sophos but it should give you a good ballpark figure to go from since getting solid numbers from anyone seems to be tricky because there are so many variables involved. That i3-4160 shouldn't have any trouble at all doing anything you ask of it for a gateway device.

I have yet to see anyone post or report what the maximum throughput is with these Rangeley boards. I would love to know that as much as you do.

Having said that if the size of the build isn't an issue then you can do it cheaper with regular server/desktop hardware. The only thing the Rangeley bring to the table is quick assist and even that isn't supported in pfsense or Sophos.

 

[joeschmuck]

The issues with Sophos of a struggling CPU start when IPS is turned on as you stated above, it's a real killer of the bandwidth. I have asked for information about the new version (still in beta) called Copernicus and so far I found out the RAM will be limited to 6GB for the Home version, which is what most of us would be running. I'm waiting on further details such as if snort will be multi-threaded (something I heard) which will allow IPS to work much better.

EDIT: This link discusses potential hardware limitations such as 4 CPU Cores and 6GB RAM. So if you are going to purchase a new system for Sophos, don't go too crazy on the hardware, I'd recommend right now a strong Intel i3 like the 4160 or similar. Do not base a purchase off of this FreeNAS Off Topic Page, go to the Sophos Forums but share what you find out.

 

[zoomzoom]

That is a pricey board for a router/firewall for home use. What are you finding the cost is with this thing?

Also, when it comes to case cooling, you need to decide on a MB and then choose a case. Your talking about this build has me so damn interested in building one myself but first I need to find out if there are any new hardware requirements expected for Sophos V10. I'm off to ask that now.

Newegg sells the A1SRi-2878F for $330 (with a free 2 port USB3.1 A PCIe card)/SuperBiz $325, while the X10SBA is $166 ($10 off til 10/5) at SuperBiz (Newegg doesn't carry it directly).

I originally was going to go with the X10SBA, however I'd prefer to have 4 1gbit out ports, and since a quad LAN PCIe running Intel's i35x series controller is around $200, it made more sense to me to go with the A1SRi-2758F since it's a quad LAN board, includes an extra IPMI port, and runs Intel's i354 controller on everything but the IPMI port. The 2578 (octa core) is only $75 more than the 2558 (quad core), with only a 6 TDP difference at 20 TDP (2x that of the X10SBA however).

• The C2758 also provides me the option to run a server alongside Sophos in a VM in the future, so I chose it with a long term plan in mind.
• Again looking ahead, I figured it best to buy two 8GB chips vs two 4GB chips, even though it was just shy of twice the price of two 4GB ones ($120 vs $65).
• All three (X10SBA, A1SRi-2758/2558) have a 7 year product life

The only problem I experienced was trying to find a mini-itx case that I liked aesthetically, was within 7.6" x 7.6" x 2.68" (195mm x 195mm x 68mm) - 9.6 x 9.6 x 3.3 (244mm x 244m x 84mm), and was all metal (to aid with heat dissipation).

• I ended up buying a mini-itx by Habey (EMC-800BL) that has a brushed aluminum surround that matches my SilverStone DS380. The model wasn't perfect to my exact liking though, so I'm going to be customizing it (removing the heinous white facade over the ODD slot, adding a filler that will house two USB3 ports (possibly an eSATA as well), adding two additional cutouts on the rear for at least 1 molex power and a few other ports I'll come up with between now and then, and adding LEDs to the front of the unit for each LAN port)

However, as soon as the In Win Chopin BQ696 is released (should be sometime soon), I'll be replacing the Habey with it

• Although I've never owned a desktop, for those of you that do, and also like art, you'll probably love the In Win H-Tower; however, the pictures from Computex 2015 really do it justice... an exquisite piece of art

 

[Ericloewe]

I originally was going to go with the X10SBA, however I'd prefer to have 4 1gbit out ports, and since a quad LAN PCIe running Intel's i35x series controller is around $200, it made more sense to me to go with the A1SRi-2758F since it's a quad LAN board, includes an extra IPMI port, and runs Intel's i354 controller on everything but the IPMI port. The 2578 (octa core) is only $75 more than the 2558 (quad core), with only a 6 TDP difference at 20 TDP (2x that of the X10SBA however).

There's also the X10SLM+-LN4F. Regular LGA1150 X10 board, but with four i210s.

 

[zoomzoom]

There's also the X10SLM+-LN4F. Regular LGA1150 X10 board, but with four i210s.

I didn't realize that =]

Due to aesthetics I wouldn't have been able to go with anything larger than a mini-itx board, as the space I want it to be in only has a 9.6" width clearance. This greatly hindered my box choices as well, since I really like SilverStone Tek's product design, but they unfortunately don't make any small mini-itx cases. I thought about buying the Milo ML05 and cutting off the 1/3 of width that's dedicated to the PSU until I found the In Win Chopin.

 

[TheDubiousDubber]

I know building it is a big part of the fun, but if you're looking to save money, buying used boxes can be cheaper. I actually bought myself a Sophos 110/120 for under $200. Took a little while for me to figure out how to load the Home license on to it, but it's working great and a lot cheaper than I could have built one for.