Gang,

 

I am looking to replace three Atoms with one system running esxi, and virtualizing the three current physical systems.  Currently have a D2500 running pfsense, a D2500 running untangle, and a D510 running Sab/SB.  I want to build a super low-power system to handle all three, and have a four-port PCIe (x4) NIC on standby for the system.

 

I have a G550T and a G3220 laying around idle (both are dual cores).  I am also looking at the AMD Kabini and a low-end i3.

 

pfsense handles three VPNs and stays below 14% CPU use 99% of the time, peaking to 50% CPU use during heavy sessions.  Untangle is about the same.  Sab/SB I'm not worried about.

 

Biggest question is time-slicing (ie running three VMs on a dual core and letting each VM have both cores).  I have read that this is a bad idea with pfsense (and, presumably, untangle) as it can affect network throughput.  Hence I'm looking at the Kabini, with four real cores, albeit slower ones.  Then there's the hyperthreaded i3....

 

Can't figure out which system to go with.  The G550T and G3220 (prefer the 550 for lower power consumption) might run fast enough that time-slicing wouldn't be an issue (input here is appreciated).  Boards for them are $50.  The Kabini has four legit cores and draws very little power (plus can be powered with a spare laptop wall wart I have, making it cheaper since I wouldn't have to buy a PSU, not to mention the mb + CPU would set me back less than $70).  The i3 is obviously the best of the bunch but at a much higher price overall.

 

Opinions?

 

Thanks.

Does the i3 even support VT-d?

 

When going ESXi, you do not want to go low end hardware wise.  Spend the money up front and build a system that will not need upgraded, expect for maybe RAM, for the next3+ years at least.

 

 

When I build ESXi machines for customers I usually suggest an intel Xeon E3-1230 or better, 16GB of RAM or more, and a motherboard that has as many PCI-e slots as possible. I almost always use the Supermicro X9SCM-iiF with a single M1015 card going into a Intel Expander.

You did not mention budget, or how urgent this upgrade is, but the upcoming Xeon D hits all the areas you are looking at.  However, it will be pricey, probably not readily available until fall.

 

For a "right now" situation, can't agree more with prostuff1, SM X9scm-iif is a workhorse.  I have a set of 4, stocked with 32g ram, E3-1230 cpus and various HBAs running 24/7 since fall 2012.  The x10 series is newer, a bit faster, slightly more energy-efficient, but is also more expensive and pickier about ram.

 

If you have not already, Kill-A-Watt is great to get objective measures of how much each box is using, and will help with ROI calculations.  I was surprised at how big a role my ancient power supplies played in power use - much greater than motherboard and cpu variations.

Guys... I really appreciate the replies, but I can't justify an 80w $200-250 CPU for firewall duty (home use).  I am going with a $40 Asrock 1155 board (already have two just like it in service and they are awesome) and gonna use the G550T, moving up to an i3-2120 if things get too busy on the Celeron, or even a super low-end i5 if I can find a smokin' deal... With Atoms doing the present heavy lifting, I can't imagine a 2nd or 3rd gen i3 wouldn't be up to the task, worst case scenario, hopefully the Celeron works out instead.  3.5GB RAM for pfsense, 3.5GB RAM for untangle, and 3GB RAM for the linux downloader.  Really, I'm just trying to save some heat and power, make a little more room in my cabinet, and play with esxi.  If I can sell the Atoms and cover the cost of the new parts, its win/win.  I have to read up on how to inject drivers (Realtek, yeah, I know) into the esxi ISO now so I can stand up the board right from the start.

 

Thanks again.

 

Guys... I really appreciate the replies, but I can't justify an 80w $200-250 CPU for firewall duty (home use).  I am going with a $40 Asrock 1155 board (already have two just like it in service and they are awesome) and gonna use the G550T, moving up to an i3-2120 if things get too busy on the Celeron, or even a super low-end i5 if I can find a smokin' deal... With Atoms doing the present heavy lifting, I can't imagine a 2nd or 3rd gen i3 wouldn't be up to the task, worst case scenario, hopefully the Celeron works out instead.  3.5GB RAM for pfsense, 3.5GB RAM for untangle, and 3GB RAM for the linux downloader.  Really, I'm just trying to save some heat and power, make a little more room in my cabinet, and play with esxi.  If I can sell the Atoms and cover the cost of the new parts, its win/win.  I have to read up on how to inject drivers (Realtek, yeah, I know) into the esxi ISO now so I can stand up the board right from the start.

 

Thanks again.

 

 

But I still don't see how it is going to work.  You will need to pass a NIC through to the pfsense VM and if the board and CPU does not support VT-d then your boned.

 

I may be missing something or overlooking something but the Celeron/i3/i5 you have talked about do not support VT-d.

 

 

Spend the money up front and be happy for the forseeable future.  My main ESXi box that I run is Intel 775 based and runs like a top.  I am only now building a new one as I want more than10GB of RAM in the machine as I want to add more than the 4 VM's I have running.  I figure this new ESXi box (Supermicro X9SCM-iiF, E3-1230, 32GB of RAM) should last me a good long time, and I should be able to expand this one more than what I can with my current ESXi box.

I didn't think I needed to pass the NIC ports through?  Can't I virtualize them, or whatever the proper term is?  That is to say, esxi sees four (well hopefully five) NICs and I can assign them as I wish?

 

 

 

ETA referencing this:

 

https://forum.pfsense.org/index.php?topic=74775.0

 

 

I didn't think I needed to pass the NIC ports through?  Can't I virtualize them, or whatever the proper term is?  That is to say, esxi sees four (well hopefully five) NICs and I can assign them as I wish?

 

 

 

ETA referencing this:

 

https://forum.pfsense.org/index.php?topic=74775.0

 

Yes, that can be done and i guess it will work.  Most everything I have read on setting up pfsense or the like recommends passing through a separate NIC just for it.  I guess it is not necessary, but is advised.

Questions...

 

I have two physical NICs on the board.  I want one NIC to connect to my cable modem and be pfsense's WAN port.  Then (as I understand it) I need to create a vswitch and connect pfsense (LAN) and Untangle (WAN) to this switch (not sure how to do that).  Then I need to create a third vswitch to be Untangle's LAN and my management interface, this will talk to my main network switch.  And that has to be a bridged interface (Untangle will run in bridged mode).

 

I have been reading some esxi pdf's but have no idea how to accomplish this.