Truenas vm promiscuous mode high cpu during unrelated network activity

das1996

Dabbler
Joined
May 26, 2020
Messages
25
ver: Truenas 12.0-U2

Running as a vm under esxi 7.0u1.

My internet connectivity is symmetrical gigabit fiber.

I notice during high network activity, completely unrelated to the nas (ie running a speed test on a desktop), truenas cpu usage is up to 30% per esxtop. Running top within truenas at the same time shows no processes consuming any significant cpu.

The only truenas services running are NFS, SMB, Smart and SSH. The only common factor is the network activity and the fact that the nas is on the same subnet, portgroup and vswitch as the client running speed test. Other vm's set up similarly (nextcloud/ubuntu, cyberpower powerpanel/centos, freepbx/ubuntu) don't exhibit this behavior.

I have a few vlans set up for iot purposes. Speedtests performed on different vlans also seem to cause this excessive cpu.

On a whim, I tried to isolate truenas to a separate portgroup bound to the same vswitch. Config looks like this.


1615671976520.png


Previously, Truenas.nas was part of the LAN_port(2) portgroup. Repeating the speed tests on the network no longer causes high cpu in truenas.

I don't see any negatives from the updated config but am still puzzled¿? Why this is happening in the first place? Network traffic is still being generated on the same vswitch and everything remains fully accessible.
 

das1996

Dabbler
Joined
May 26, 2020
Messages
25
Discovered that my syncthing jail wasn't pulling an IP.

Tracked it down to esxi's promiscuous mode. When set to rejected, the freenas high cpu isn't present when there's high network activity. However, jails are unable to interact with the network. When promisc mode set to allowed, jails work, but high cpu is also present.

I suppose one other option is to put freenas on its own dedicated vlan and use the firewall to route in between. I was hoping to keep the nas on the local lan and this seems like a sledge hammer approach.

Is there any option in freenas networking to ignore this other traffic?
 

das1996

Dabbler
Joined
May 26, 2020
Messages
25
Truenas jails allow a NAT function. Ran some tests with nat enabled. Configured port forwarding for snycthing ports (22000, 8384). Was still able to get full line speed (gigabit) on transfers via syncthing.

Anyone have ideas on a more eloquent solution? Without nat, esxi promiscuous mode must be enabled for jail's network connectivity to work. Esxi's promiscuous mode is very course. Allowed or rejected. There's no configuration for allowing specific macs only for the vm.
 
Top