Netgate 1100: Small, Big

The Netgate 1100 is the smallest, least expensive box in the line. This article is about what it really solves in a branch like that, and just as much about where its power ends - because its limit is closer than the spec sheet suggests.

What a small branch actually needs

Break it down, and a branch with a register and an internet line has four needs - none of them about speed:

• Separating the register from everything else. The register, the payment terminal and the security camera should not sit on the same network where an employee connects a personal phone or where a computer someone browses on sits. That separation is what stops one thing from infecting another.
• An encrypted link back to the head office. So inventory, reports and backups move without exposing anything to the internet.
• Seeing and fixing things remotely. When something goes down at the branch at eight in the morning, nobody drives out there.
• It should simply keep working. No fan that seizes up, no filter that clogs, no weekly restart.

What the 1100 does well

Those four needs are exactly what this device answers - and with nothing extra.

Network separation. All three ports are configurable, and the internal network can also be split into several separate networks. You can put the register on a network of its own, the security cameras on another, and keep a guest network that sees neither.

A VPN link to the office. The device supports IPsec, OpenVPN and WireGuard, with no limit on the number of links and no per-user fees. A branch connecting to the head office is exactly what this device was built to do.

No annual licensing fees. pfSense Plus is included with the device; version updates, with no annual renewal and no user limits. In a branch where the device will sit for five years, that is a real difference in cost.

It makes no noise and needs no care. It has no fan, it draws less than four watts, and it is the size of a pocket book. It can hang on a wall or on a DIN rail in the electrical cabinet.

Where its power ends

This is the part worth reading before the order, not after it.

The three ports are not three ports

They sit on an internal switch, and the switch connects to the CPU over a single gigabit line. That means all the traffic that passes through the filtering rules - from the internet inward, from one network to another - shares that same single line. That is why the routing ceiling is 927 Mbit and not double that, and it is also what explains the rest of the numbers.

The number on the spec sheet and what happens in practice

Netgate publishes two measurements for every function. The first, iPerf3, is a continuous download of large files - the test that produces the high number. The second, IMIX, is a mix of small and large packets that simulates real traffic of calls, data and video. The gap between them is significant:

In a branch that browses, runs a register and transfers a backup, the relevant number is the right-hand column. If the branch has a gigabit line and you expect to use all of it with filtering active - this is not the model.

The branch link is limited anyway

Even 90 Mbit over VPN sounds low, but it is worth remembering that a link between two sites will not exceed the upload speed of the weaker side. A branch on a symmetric 100 Mbit line will not reach the device's ceiling in any case. If the head office sits on a fast line and the branches on small ones, the device at the branch is not the bottleneck.

No room to grow

It has one gigabyte of memory and 10.6 GB of storage soldered to the board, with no slot for adding a drive and no expansion slot. What you buy today is what you will have in four years as well. In practice that means two things: an intrusion detection system like Suricata will load it too heavily, and long-term log retention on the device itself is not practical - the logs need to flow to a central server.

To give a sense of the size - this is how it looks placed on an A4 sheet, next to a credit card, at the same scale:

Further readingAssisted-Living Network: Readiness, Security Cameras and Access ControlOne switch was reset and the guard station phone, about 12 cameras, the door controllers and both wireless networks went with it. How the network was rebuilt, and what to have in place first.→

When it fits and when it does not

The specs

What to check before ordering

• What the branch line actually delivers. Not what the contract says, but what the ISP's modem actually puts out. If the line is up to 200 Mbit, the 1100 will not hold you back.
• How many devices connect. If you need more than three network points, you also need a small switch next to it. This is a security gateway, not a switch.
• What runs over the link to the office. If it is files and reports, 90 Mbit is perfectly fine. If it is day-to-day work on a remote server, it is worth looking at a larger model.
• Where the logs go. There is no room on the device itself to keep them for long, so decide in advance where they are sent.

If the answers line up, this is a device that will do the job quietly for years. And if not, better to know that now and not in the busiest month of the year.

The figures in this article were published by Netgate. iPerf3 measurements are TCP traffic with a 1460-byte payload, and IMIX measurements are a mix of 7 packets of 40 bytes, 4 packets of 576 bytes and one packet of 1500 bytes. Both were measured as maximum bidirectional traffic across all ports together, and the firewall measurements were run against 10,000 rules.