4 ms·

What are some alternatives?

by thayne 4y ago

70rd 4y ago
https://www.crowdsupply.com/traverse-technologies/ten64 https://www.crowdsupply.com/traverse-technologies/ten64 Those boxes are at higher price point, but far exceed the apu lineup in features/compute.
- transpute 4y ago
  All firmware component source code (e.g., ARM Trusted Firmware and U-Boot) Do you know if they allow customization of the Trusted Firmware, e.g. with owner-signed TrustZone? The most recent project update was July 2021? https://www.crowdsupply.com/traverse-technologies/ten64/updates https://www.crowdsupply.com/traverse-technologies/ten64/upda... https://forums.servethehome.com/index.php?threads/article-youtube-suggestion-traverse-ten64.38236/ https://forums.servethehome.com/index.php?threads/article-yo... > [Ten64] platform (Layerscape) is somewhat interesting but sadly has been so slow to appear in reasonable products that it has been surpassed by basic Celeron-based systems ... seems to me that the Layerscape platform will go the same route as the Marvell (Armada 385 I think) ones did; one or two revisions and then radio silence where only highly integrated partners still keep using it ... it's not powerful enough as a CPU, and the hardware acceleration suffers from the same problems that basic Broadcom SoCs and higher-end ASIC-accelerators do: they get outdated and useless rather quickly
  - mcbridematt 4y ago
    Hi, I'm the person behind the Ten64. Ten64's have been shipping for a while now, though you are best to ask in our support forum: https://forum.traverse.com.au/ https://forum.traverse.com.au/ . We haven't posted much on Crowd Supply as it's a very manual process to get stuff up on there. I'm not too familiar with TrustZone, but I'm not aware of any limitations in the secure world. I haven't tried OP-TEE or any similar secure world firmware' simply as no one has asked for it. You can see all our firmware components here: https://gitlab.com/traversetech/ls1088firmware https://gitlab.com/traversetech/ls1088firmware
    - pietrushnic 4y ago
      When we did the research for our network appliance customers, we were very interested in NXP. Have you tried to buy Application Solutions Kit from NXP? We faced the problem of not achieving spec performance using NXP reference boards. After reaching NXP, support informed us that we should buy ASK, which would solve our problems. Unfortunately, it was beyond our research budget.
      - mcbridematt 4y ago
        No, we haven't bought any ASKs. We have worked with them on a DPDK project and they were quite helpful when it came to debugging difficult bugs with it. Improving the routing performance in Linux is near the top of my TODO list, however. XDP is one candidate (see https://forum.traverse.com.au/t/vyos-build-my-repo/181/5 https://forum.traverse.com.au/t/vyos-build-my-repo/181/5 for some results) and using the LS1088's AIOP is another possibility.
        pietrushnic 4y ago
        Linux is important but FreeBSD is the key to heart of majority of DYI firewall builders. I'm huge fan of your project and looking for opportunities to get hands on experience with it. I see that support for FreeBSD going in good direction: https://forum.traverse.com.au/t/freebsd-preview-for-ten64/173 https://forum.traverse.com.au/t/freebsd-preview-for-ten64/17... Are there any performance reports for FreeBSD? Especially VPN/wireguard bandwidth would be interesting.
        mcbridematt 4y ago
        dsl (Dmitry) is the main developer behind the DPAA2 drivers for FreeBSD and he's done a fantastic effort so far. Myself and Bjoern (bz) have also written bits of it. The performance has improved compared to how it was a year ago (e.g struggling to get 400mbps throughput) but there are some severe issues in -CURRENT :( I believe dsl is trying to get them fixed by 14.0-RELEASE.
    - transpute 4y ago
zootboy 4y ago
I have no personal experience with either of these, but I was considering them when looking for options to handle router duties for my 10 Gbit fiber link: https://protectli.com/product-comparison/ https://protectli.com/product-comparison/ https://shop.opnsense.com/product-categorie/hardware-appliances/?PageSpeed=noscript https://shop.opnsense.com/product-categorie/hardware-applian...
- nazgulsenpai 4y ago
  I've used Protecli in several small office NGFW builds (<20 people, ~5 remote VPN users, 1 dedicated VPN tunnel to home office) and they have been great over the past 4-5 years. Can recommend.
- transpute 4y ago
  Protectli includes coreboot. The i7 model has TPM and DRTM features matching the $200 APU2, but costs ~$1000 USD, https://protectli.com/product/vp4670/ https://protectli.com/product/vp4670/
cheeseprocedure 4y ago
A prior employer shipped a lot of systems based on Lanner and Portwell equipment: https://www.lannerinc.com/products/network-appliances https://www.lannerinc.com/products/network-appliances https://portwell.com/products/ca-b.php https://portwell.com/products/ca-b.php
- donmcronald 4y ago
  I’d be shocked if companies that won’t even publish their prices come close to the value of the PcEngines stuff.
tesseract 4y ago
No personal experience with it, but the Compulab Fitlet2/Fitlet3 looks interesting.
donmcronald 4y ago
Maybe Netgate [1] for anyone using PcEngines + pfSense CE. It’s less hardware, but functionally close (for throughput) and gets you onto pfSense Plus. I know they’re not liked here, but I doubt there are going to be many (or any) sub $200 firewall appliances that I’d be willing to rely on once the PcEngines supply runs out. I’ve configured ~150 pfSense CE setups on APU2s. It’s a sad day for small businesses. Hopefully Netgate doesn’t increase prices on that low end appliance. I’d love to be proven wrong, but it’s the only pragmatic option now for small businesses. 1. https://shop.netgate.com/collections/desktop-appliances/products/1100-pfsense https://shop.netgate.com/collections/desktop-appliances/prod...
- m463 4y ago
  I don't like that pfsense phones home.

What are some alternatives?

by thayne 4y ago

What are some alternatives?

70rd 4y ago

https://www.crowdsupply.com/traverse-technologies/ten64 https://www.crowdsupply.com/traverse-technologies/ten64 Those boxes are at higher price point, but far exceed the apu lineup in features/compute.

transpute 4y ago
All firmware component source code (e.g., ARM Trusted Firmware and U-Boot) Do you know if they allow customization of the Trusted Firmware, e.g. with owner-signed TrustZone? The most recent project update was July 2021? https://www.crowdsupply.com/traverse-technologies/ten64/updates https://www.crowdsupply.com/traverse-technologies/ten64/upda... https://forums.servethehome.com/index.php?threads/article-youtube-suggestion-traverse-ten64.38236/ https://forums.servethehome.com/index.php?threads/article-yo... > [Ten64] platform (Layerscape) is somewhat interesting but sadly has been so slow to appear in reasonable products that it has been surpassed by basic Celeron-based systems ... seems to me that the Layerscape platform will go the same route as the Marvell (Armada 385 I think) ones did; one or two revisions and then radio silence where only highly integrated partners still keep using it ... it's not powerful enough as a CPU, and the hardware acceleration suffers from the same problems that basic Broadcom SoCs and higher-end ASIC-accelerators do: they get outdated and useless rather quickly
- mcbridematt 4y ago
  Hi, I'm the person behind the Ten64. Ten64's have been shipping for a while now, though you are best to ask in our support forum: https://forum.traverse.com.au/ https://forum.traverse.com.au/ . We haven't posted much on Crowd Supply as it's a very manual process to get stuff up on there. I'm not too familiar with TrustZone, but I'm not aware of any limitations in the secure world. I haven't tried OP-TEE or any similar secure world firmware' simply as no one has asked for it. You can see all our firmware components here: https://gitlab.com/traversetech/ls1088firmware https://gitlab.com/traversetech/ls1088firmware
  - pietrushnic 4y ago
    When we did the research for our network appliance customers, we were very interested in NXP. Have you tried to buy Application Solutions Kit from NXP? We faced the problem of not achieving spec performance using NXP reference boards. After reaching NXP, support informed us that we should buy ASK, which would solve our problems. Unfortunately, it was beyond our research budget.
    - mcbridematt 4y ago
      No, we haven't bought any ASKs. We have worked with them on a DPDK project and they were quite helpful when it came to debugging difficult bugs with it. Improving the routing performance in Linux is near the top of my TODO list, however. XDP is one candidate (see https://forum.traverse.com.au/t/vyos-build-my-repo/181/5 https://forum.traverse.com.au/t/vyos-build-my-repo/181/5 for some results) and using the LS1088's AIOP is another possibility.
      - pietrushnic 4y ago
        Linux is important but FreeBSD is the key to heart of majority of DYI firewall builders. I'm huge fan of your project and looking for opportunities to get hands on experience with it. I see that support for FreeBSD going in good direction: https://forum.traverse.com.au/t/freebsd-preview-for-ten64/173 https://forum.traverse.com.au/t/freebsd-preview-for-ten64/17... Are there any performance reports for FreeBSD? Especially VPN/wireguard bandwidth would be interesting.
        mcbridematt 4y ago
        dsl (Dmitry) is the main developer behind the DPAA2 drivers for FreeBSD and he's done a fantastic effort so far. Myself and Bjoern (bz) have also written bits of it. The performance has improved compared to how it was a year ago (e.g struggling to get 400mbps throughput) but there are some severe issues in -CURRENT :( I believe dsl is trying to get them fixed by 14.0-RELEASE.
  - transpute 4y ago

zootboy 4y ago

I have no personal experience with either of these, but I was considering them when looking for options to handle router duties for my 10 Gbit fiber link: https://protectli.com/product-comparison/ https://protectli.com/product-comparison/ https://shop.opnsense.com/product-categorie/hardware-appliances/?PageSpeed=noscript https://shop.opnsense.com/product-categorie/hardware-applian...

nazgulsenpai 4y ago
I've used Protecli in several small office NGFW builds (<20 people, ~5 remote VPN users, 1 dedicated VPN tunnel to home office) and they have been great over the past 4-5 years. Can recommend.
transpute 4y ago
Protectli includes coreboot. The i7 model has TPM and DRTM features matching the $200 APU2, but costs ~$1000 USD, https://protectli.com/product/vp4670/ https://protectli.com/product/vp4670/

cheeseprocedure 4y ago

A prior employer shipped a lot of systems based on Lanner and Portwell equipment: https://www.lannerinc.com/products/network-appliances https://www.lannerinc.com/products/network-appliances https://portwell.com/products/ca-b.php https://portwell.com/products/ca-b.php

donmcronald 4y ago
I’d be shocked if companies that won’t even publish their prices come close to the value of the PcEngines stuff.

tesseract 4y ago

No personal experience with it, but the Compulab Fitlet2/Fitlet3 looks interesting.

donmcronald 4y ago

Maybe Netgate [1] for anyone using PcEngines + pfSense CE. It’s less hardware, but functionally close (for throughput) and gets you onto pfSense Plus. I know they’re not liked here, but I doubt there are going to be many (or any) sub $200 firewall appliances that I’d be willing to rely on once the PcEngines supply runs out. I’ve configured ~150 pfSense CE setups on APU2s. It’s a sad day for small businesses. Hopefully Netgate doesn’t increase prices on that low end appliance. I’d love to be proven wrong, but it’s the only pragmatic option now for small businesses. 1. https://shop.netgate.com/collections/desktop-appliances/products/1100-pfsense https://shop.netgate.com/collections/desktop-appliances/prod...

m463 4y ago
I don't like that pfsense phones home.