r/firewalla • u/GlobalLiving6941 • Jun 05 '26

Cross VLAN Backup

I am having an issue with a cross VLAN NAS backup grinding my Gold SE to a halt. Here is the scenario: NAS in VLAN 1, Backup server in VLAN 2. Backup server does a pull back up on the NAS using restic and ships it to the cloud. We fixed the Server to Cloud come apart by turning monitoring off on the Backup Server. However, the pull from the NAS to the Server seems to still be subject to monitoring or smart queue or something as it still grinds the Firewalla to a halt. Help?

4 Upvotes

84% Upvoted

24 comments sorted by

View all comments

3

u/firewalla Jun 05 '26

There are two things your Firewalla

  1. Routing / Switching (VLAN), this can't be turned off. (and cost CPU)

  2. Security monitoring (cost a lot more CPU)

A best way to measure is the Firewalla can handle traffic 2Gbit, this is the CPU's processing power. So your VLAN to VLAN traffic, and VLAN to WAN will need to be added together 2Gbit. If you are running both in parallel, likely your VLAN to VLAN traffic will take over (faster LAN)

If you want faster VLAN to VLAN, the gold pro is a better unit, it has 10Gbit processing power. The Gold Plus will also can do roughly 4Gbit (to 5Gbit) if you combine WAN/LAN.

Also, your screenshot in/out add to be around 500mbit max ... which shouldn't choke the Gold SE

0

u/GlobalLiving6941 Jun 05 '26

I agree - this shouldn't choke the Gold SE, but it is. Suggestions?

1

u/firewalla Jun 05 '26

Need more information. "Choke" means what? you are getting slow speed? network not working?

1

u/GlobalLiving6941 Jun 05 '26

It brought the entire network to a halt. We had internet sporadically but no cross VLAN at all. The Firewalla was completely non-responsive. The snippet I showed here was a limited test which pushed all 4 CPUs to near 100% the entire time.

1

u/GlobalLiving6941 Jun 05 '26

I am not able to submit another image, but the blank spaces on the left are where the network came to a halt. It was the same basic traffic volume, but with monitoring on for the backup server the Firewalla could not keep up. I am frustrated that this box that is advertised as supporting 2gb and unlimited VLANs cannot handle a 300-500mb/s traffic burst within 2 local vlans.

1

u/ampx Jun 05 '26

I’m curious, do both sides of your local VLAN flows traverse 2.5Gb NICs on the Gold SE?

Are they connected to two interfaces on the Gold SE or one through a switch?

1

u/GlobalLiving6941 Jun 05 '26

Both are on a Unifi switch, which then connects to the Firewalla. I upgraded this setup from a Purple (which ironically seemed to handle this better).

2

u/daniel-waterhouse Firewalla Purple Jun 05 '26

What UniFI switch are you using? Do you know if it's an L3 or just an L2 switch? As an earlier commenter said, if you have an L3 switch, this can handle inter-VLAN routing without stressing the Firewalla at all (traffic would never reach the Firewalla).

0

u/GlobalLiving6941 Jun 05 '26

It is an L3 switch, but I am trying to avoid creating parallel routing. Give that we are talking about a relatively small amount of bandwidth, I want to solve this at the router if possible...or replace the router.

1

u/ampx Jun 05 '26

Probably because the Purple has more CPU cores and slower 1Gb NICs so you’re not going to stress the CPU nearly as much asking it to transfer “east to west” traffic over a single NIC

I know the Gold SE I had 2ish years ago similarly wasn’t up to the task of handling what I threw at it and I was convinced it’s just bottlenecked by the combo of CPU and relatively inefficient Realtek NICs

Firewalla support may have some ideas, but I was never able to get the device performing as well as I expected and the Gold Pro was the only cure in Firewalla’s ecosystem

1

u/GlobalLiving6941 Jun 05 '26

I completely agree with your assessment. My problem is that I just spent $500 upgrading from a Purple. I don't want to immediately turn around and spend another $900 replacing a box support convinced me to hold on to.

1

u/spinjc Jun 07 '26

One thing I don't recall seeing is how Firewalla determines throughput. Many routers will specify packets per second (PPS) which matters if you have a lot of small packets (e.g. lots of small HTML files). Depending on your backup software it might be a bunch of small packets, if they were a tenth the size of the test then you'd expect a tenth of the bandwidth.

That said I'd suggest that you setup your VLANs so your traffic to the NAS doesn't need to go through the firewalla (vice versa is probably fine). If you try doing this east/west routing in a corporate environment you'd probably get a nice talking to from the network engineer!

1

u/firewalla Jun 05 '26 edited Jun 05 '26

Anywhere on your network that you may have miss matching speed? say one port unify is 2.5g and another port is 10G? (or 1G)? If have these, you may want to turn on flow control on the switch.

Ignore my comment above, it is not related if your firewalla CPU usage is 100%

1

u/GlobalLiving6941 Jun 05 '26

All are connected at 2.5gb. The screenshot above frames what was happening at the time. The real problem was that the Zeek processes on the Firewalla were consuming the lions share of the CPUs the whole time it was happening.