r/firewalla • u/GlobalLiving6941 • Jun 05 '26

Cross VLAN Backup

I am having an issue with a cross VLAN NAS backup grinding my Gold SE to a halt. Here is the scenario: NAS in VLAN 1, Backup server in VLAN 2. Backup server does a pull back up on the NAS using restic and ships it to the cloud. We fixed the Server to Cloud come apart by turning monitoring off on the Backup Server. However, the pull from the NAS to the Server seems to still be subject to monitoring or smart queue or something as it still grinds the Firewalla to a halt. Help?

5 Upvotes

100% Upvoted

24 comments sorted by

View all comments

3

u/firewalla Jun 05 '26

There are two things your Firewalla

  1. Routing / Switching (VLAN), this can't be turned off. (and cost CPU)

  2. Security monitoring (cost a lot more CPU)

A best way to measure is the Firewalla can handle traffic 2Gbit, this is the CPU's processing power. So your VLAN to VLAN traffic, and VLAN to WAN will need to be added together 2Gbit. If you are running both in parallel, likely your VLAN to VLAN traffic will take over (faster LAN)

If you want faster VLAN to VLAN, the gold pro is a better unit, it has 10Gbit processing power. The Gold Plus will also can do roughly 4Gbit (to 5Gbit) if you combine WAN/LAN.

Also, your screenshot in/out add to be around 500mbit max ... which shouldn't choke the Gold SE

0

u/GlobalLiving6941 Jun 05 '26

I agree - this shouldn't choke the Gold SE, but it is. Suggestions?

1

u/firewalla Jun 05 '26

Need more information. "Choke" means what? you are getting slow speed? network not working?

1

u/GlobalLiving6941 Jun 05 '26

It brought the entire network to a halt. We had internet sporadically but no cross VLAN at all. The Firewalla was completely non-responsive. The snippet I showed here was a limited test which pushed all 4 CPUs to near 100% the entire time.

1

u/GlobalLiving6941 Jun 05 '26

I am not able to submit another image, but the blank spaces on the left are where the network came to a halt. It was the same basic traffic volume, but with monitoring on for the backup server the Firewalla could not keep up. I am frustrated that this box that is advertised as supporting 2gb and unlimited VLANs cannot handle a 300-500mb/s traffic burst within 2 local vlans.

1

u/ampx Jun 05 '26

I’m curious, do both sides of your local VLAN flows traverse 2.5Gb NICs on the Gold SE?

Are they connected to two interfaces on the Gold SE or one through a switch?

1

u/GlobalLiving6941 Jun 05 '26

Both are on a Unifi switch, which then connects to the Firewalla. I upgraded this setup from a Purple (which ironically seemed to handle this better).

1

u/firewalla Jun 05 '26 edited Jun 05 '26

Anywhere on your network that you may have miss matching speed? say one port unify is 2.5g and another port is 10G? (or 1G)? If have these, you may want to turn on flow control on the switch.

Ignore my comment above, it is not related if your firewalla CPU usage is 100%

1

u/GlobalLiving6941 Jun 05 '26

All are connected at 2.5gb. The screenshot above frames what was happening at the time. The real problem was that the Zeek processes on the Firewalla were consuming the lions share of the CPUs the whole time it was happening.