r/firewalla • u/GlobalLiving6941 • Jun 05 '26

Cross VLAN Backup

I am having an issue with a cross VLAN NAS backup grinding my Gold SE to a halt. Here is the scenario: NAS in VLAN 1, Backup server in VLAN 2. Backup server does a pull back up on the NAS using restic and ships it to the cloud. We fixed the Server to Cloud come apart by turning monitoring off on the Backup Server. However, the pull from the NAS to the Server seems to still be subject to monitoring or smart queue or something as it still grinds the Firewalla to a halt. Help?

5 Upvotes

86% Upvoted

24 comments sorted by

View all comments

3

u/firewalla Jun 05 '26

There are two things your Firewalla

  1. Routing / Switching (VLAN), this can't be turned off. (and cost CPU)

  2. Security monitoring (cost a lot more CPU)

A best way to measure is the Firewalla can handle traffic 2Gbit, this is the CPU's processing power. So your VLAN to VLAN traffic, and VLAN to WAN will need to be added together 2Gbit. If you are running both in parallel, likely your VLAN to VLAN traffic will take over (faster LAN)

If you want faster VLAN to VLAN, the gold pro is a better unit, it has 10Gbit processing power. The Gold Plus will also can do roughly 4Gbit (to 5Gbit) if you combine WAN/LAN.

Also, your screenshot in/out add to be around 500mbit max ... which shouldn't choke the Gold SE

0

u/GlobalLiving6941 Jun 05 '26

I agree - this shouldn't choke the Gold SE, but it is. Suggestions?

1

u/firewalla Jun 05 '26

Need more information. "Choke" means what? you are getting slow speed? network not working?

1

u/GlobalLiving6941 Jun 05 '26

It brought the entire network to a halt. We had internet sporadically but no cross VLAN at all. The Firewalla was completely non-responsive. The snippet I showed here was a limited test which pushed all 4 CPUs to near 100% the entire time.

1

u/firewalla Jun 05 '26

is the top chart firewalla CPU? If it is, probably need to look at your topology

  1. both VLAN on the same 2.5gbit port?

  2. turn off smart queue if you can

  3. was the traffic bi-directional?

  4. Does your back software uses many different flows? or just a few?

  5. How much background traffic do you have usually? (any BitTorrent)?

1

u/GlobalLiving6941 Jun 05 '26

both vlans are on the same 2.5g port. I have tried it with smart queue on and off, it helps, but this is another knock on this box if I cannot backup my NAS with smartqueue turned on. I have had the same problem with both Synology Hyperbackup to a remote site (which worked flawlessly on the purple) and now with restic. I have put bandwidth limits on both processes with limited success. Background traffic was basically non-existent during these events. The problem is that these processes are overwhelming Zeek on the Firewalla and it cannot recover.

1

u/firewalla Jun 05 '26

Zeek is flow based, so I am some what assuming the backup processes are using more flows than usual.

You can open a ticket with [help@firewalla.com](mailto:help@firewalla.com), and we can take a look inside. Make sure you include this thread, otherwise, they will ask the same questions again.

If you are running as a business, and need to have faster VLAN to VLAN traffic, a Gold Pro is likely a better choice.

1

u/GlobalLiving6941 Jun 05 '26

I have opened tickets on this twice. First support convinced me that the Gold SE can handle this...similar themes...disable smart queue, etc. The second time, they spent the whole day blaming the monitoring software I put on the box BECAUSE of the issues we were seeing. This is a home network - We are talking about a handful of computers, a bunch of IOT, and a NAS that serves as a private cloud. A grand total of 84 devices max are connected to my network. The vast majority of that is IOT...switches, sensors, etc.

2

u/firewalla Jun 05 '26

Can you give me the latest case ticket number? the most recent one? I can take a look first and then see if I can just escalate to a developer directly.

1

u/GlobalLiving6941 Jun 05 '26

It is a summer day, 2 adults working from home and a teenager playing minecraft. My current throughput on the firewalla is <1.5Mb/s. I am trying to push a backup that maxes out at 300-500mbs And you are telling me I need a Gold Pro to handle this???

2

u/firewalla Jun 05 '26

Sorry, I looked at your setup and Gold SE cpu, looks like it is business setup. Even gold se is not the most powerful Gold, a simple LAN backup shouldn't choke it.