Questions people ask
Short answers, each with the page that says it in full.
Which appliances does it run on?
The XGS 136 and the XGS 3300 have been run here, and everything on this site was measured on them. Every other model of their two families - the XGS 87, 107, 116, 126 and 138, and the XGS 2100, 2300 and 3100 - installs, and is marked added, untested: its ports come from the vendor's board files, and no such appliance has been here to test on. The larger families have no driver yet. Every model, and what works on each.
What does installing change on the appliance?
Installing erases the appliance's internal disk, and with it the Sophos firmware and its settings; the host then runs OPNsense, and this project's drivers bring up the coprocessor and its front ports. The guide does not go back the other way. Step by step.
Is it made by Sophos, or by OPNsense?
No. This project is independent: it is not affiliated with, endorsed by or sponsored by either, and their names are used only to say what it runs on and works with. No Sophos software or firmware is distributed here. Legal.
What does it cost?
Nothing. The code is under the BSD-2-Clause licence, and everything the guide uses - OPNsense, this project, GitHub's build, the tools to write the stick and open the console - is free.
How stable is it?
It is an alpha: the releases are numbered 0.1.0-alpha, and it comes with no warranty. Try a release on an appliance you can reach before you trust it with a network you depend on. What is not finished, for each appliance, is in its family page's table - ARMADA and OCTEON TX.
What runs in the coprocessor's hardware?
Connections, once the firewall has let them through - the fast path forwards them port to port - and IPsec, whose associations the coprocessor's engine encrypts and decrypts. What has to be seen by the host stays with it: a connection the traffic shaper or the captive portal names is kept on the host, and Suricata sees a connection before it goes into hardware. What works, the shaper, measured, a TLS fingerprint, cut.
How fast is it?
As fast as the links it was measured on allow. On the XGS 3300, 1,024 connections at once filled the 10 Gbit/s link at 9,837 Mbit/s with the CPUs 7.8 % busy, and sixteen IPsec tunnels carried 9,019 Mbit/s from one 10G port. On the XGS 136, its gigabit link stayed full for hours - 945 Mbit/s over two hours of TLS. Every measurement, and how they are taken.
How is it installed, and kept current?
An image built for you by the image builder, written to a USB stick, installed from it - step by step; or the installer, on an OPNsense already there - installing. Releases arrive in the web interface, on the XGS: Updates page - updating.
How do I report a problem, or my appliance?
With problem reports switched on, the plugin files what goes wrong on its own - problem reports. An appliance of a model nobody has reported yet, and what works on it: the compatibility form. Anything else: an issue, or write to the project.
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.