From owner-freebsd-pf@FreeBSD.ORG Tue Jun 28 16:25:27 2005 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2441316A41C; Tue, 28 Jun 2005 16:25:27 +0000 (GMT) (envelope-from MGrooms@seton.org) Received: from mx1-out.seton.org (mx1-out.seton.org [207.193.126.171]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7B31543D4C; Tue, 28 Jun 2005 16:25:25 +0000 (GMT) (envelope-from MGrooms@seton.org) Received: from localhost (unknown [127.0.0.1]) by mx1-out.seton.org (Postfix) with ESMTP id B6ADBF00091F; Tue, 28 Jun 2005 11:25:24 -0500 (CDT) Received: from mx1-out.seton.org ([10.21.254.249]) by localhost (mx1 [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 26316-37; Tue, 28 Jun 2005 11:25:24 -0500 (CDT) Received: from ausexfe01.seton.org (unknown [10.20.10.183]) by mx1-out.seton.org (Postfix) with ESMTP id 9C3DCF0008EF; Tue, 28 Jun 2005 11:25:24 -0500 (CDT) Received: from AUSEX2VS1.seton.org ([10.20.10.74]) by ausexfe01.seton.org with Microsoft SMTPSVC(6.0.3790.211); Tue, 28 Jun 2005 11:25:36 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Tue, 28 Jun 2005 11:25:23 -0500 Message-ID: <28FCC7CB4CF6EA43AF83BCA2096E97D013E572@AUSEX2VS1.seton.org> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: pf performance issues ... thread-index: AcV7/fvtGGyIsAFDToG93FXpxH/KrA== From: "Grooms, Matthew" To: X-OriginalArrivalTime: 28 Jun 2005 16:25:36.0951 (UTC) FILETIME=[04089C70:01C57BFE] X-Virus-Scanned: by amavisd-new at seton.org Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: rwatson@freebsd.org, IS-Network Subject: pf performance issues ... X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jun 2005 16:25:27 -0000 I am seeing some pretty severe performance issues with pf+pfsync on = FreeBSD 5.4-REMEASE and would like to get some advice on tuning for a = largish environment. I have had some traffic moving across these = firewalls for a few weeks without issue but had not pointed our default = route to it until this morning. =20 Although processor utilitzation was very low ( 2-5% ), throughput = on the firewall was very very poor. TCP connections were in some cases = taking 15-30 seconds to setup and in other cases never did. We had to = revert our default route to an older firewall to keep operations going. =20 This is a dual 3GHz amd64 box ( UP kernel at the moment ), with 4 = gigs of ram and 6x em interfaces. It is mostly a stock kernel with = pf,pfsync,carp and altq ( but no altq rules ) support compiled in and = ipv6 disabled ( config attached ). =20 Am I running into a limit on some kernel tunable? After a few = minutes of routing traffic to pf setup, the state table had approx 10000 = entries in it. Are there some global pf limits to tweak or should it = scale well out of the box? The internet connection is only 7Mbit so I am = at a loss. Is there a cache or buffer limit somewhere I should watch? = Any ideas? =20 Thanks in advance, =20 Matthew Grooms