OPNsense® DEC3960 – 19-inch 1U rack appliance with two SFP28 at 25 Gbps and 36.8 Gbps
Two SFP28 ports at 25 Gbps, two SFP+ at 10 Gbps and four 2.5-gigabit ports, 36.8 Gbps firewall throughput, 22 Gbps port to port, 32 GB DDR5 and a redundant power supply.
The DEC3960 is the flagship of the DEC3900 series: the Netboard A20 Gen2 with a dual power supply, 32 GB DDR5, 512 GB storage and two additional SFP28 ports at 25 Gbps. Deciso states 22 Gbps port to port for this model instead of 9 Gbps. OPNsense® is preinstalled and one year of the Business Edition is included. The appliance is developed, manufactured and shipped by Deciso in the Netherlands.
Six reasons for the DEC3960
36.8 Gbps firewall throughput
3.07 million packets per second, 22 Gbps port to port, 67 µs average latency.
Two SFP28 ports at 25 Gbps
In addition to two SFP+ at 10 Gbps and four RJ45 ports at 100/1000/2500 Mbps.
7.93 Gbps threat protection
700 kpps, measured with 25,000 ET Open malware rules and 1500-byte packets.
WireGuard and OpenVPN DCO measured
4.23 Gbps over WireGuard and 2.81 Gbps over OpenVPN DCO – Deciso lists both separately.
Dual power supply at 36 watts
Two power supplies for redundant deployments. Around 70 to 95 euros of electricity per year with one active supply.
Made in EU, two-year warranty
Carry-in and return warranty direct from Deciso, including one year of OPNsense® Business Edition.
Typical applications
- Firewall and routing on connections up to 10 gigabit
- Central firewall with IDS/IPS at several gigabit of payload
- VPN concentrator with WireGuard or IPsec across multiple tunnels
- Uplink over SFP28 at 25 gigabit or SFP+ at 10 gigabit
- Rack mounting in a server cabinet at 259 mm depth without the front panel
- Redundant operation with state synchronisation, two units required
Application scenarios are recommendations by inett based on the performance data, not statements by the manufacturer.
Full specifications
| Preinstalled software | OPNsense®, Open Source + 1 year Business Edition |
| Typical applications | Firewall / routing, VPN, IDPS |
| Board | Netboard A20 Gen2 |
| CPU cores | 8 |
| Memory | 32 GB DDR5 |
| Internal storage | 512 GB M.2 solid state flash |
| SFP28 ports (25 Gbps) | 2 |
| SFP+ ports (10 Gbps) | 2 |
| 2.5 GbE ports (100/1000/2500 Mbps) | 4 |
| USB-C | 1 |
| Console port | 1 |
| VLANs (802.1q) | 4,093 |
| Firewall throughput | 36.8 Gbps |
| Firewall packets per second | 3.07 million pps |
| Port-to-port throughput | 22 Gbps |
| IPsec VPN throughput (single / multiple tunnels) | 5.4 Gbps / 12.5 Gbps |
| IPsec VPN packets per second (single / multiple tunnels) | 527 kpps / 1,190 kpps |
| OpenVPN DCO throughput | 2.81 Gbps |
| OpenVPN DCO packets per second | 272 kpps |
| WireGuard throughput | 4.23 Gbps |
| WireGuard packets per second | 410 kpps |
| Threat protection (IDS/IPS) | 7.93 Gbps (700 kpps) |
| Concurrent sessions | 31 million |
| Firewall latency (average) | 67 µs |
| Firewall rules (recommended maximum) | 10,000 |
| High availability | with state synchronisation, two units required |
| Power supply unit | dual, redundant |
| Form factor | 19-inch rack mountable, 1U |
| Dimensions (H × W × D) | 43.65 × 482.6 × 287 mm (259 mm without front panel) |
| Weight (appliance only) | 3.29 kg |
| Power input | 100–240 V AC, 50–60 Hz |
| Maximum current (per power supply) | 1.52 A |
| Power consumption (typical, single power supply) | 36 W |
| Heat dissipation | 122.8 BTU/h |
| Operating temperature | 0 to +45 °C |
| Storage temperature | −20 to +70 °C |
| Humidity | 10–90 %, non-condensing |
| Certifications | CE, FCC part 15 Class A, RoHS, REACH |
Package contents
- 19-inch 1U rack appliance
- Matching power cord
- Configuration cable
- Quick start guide
Warranty and support
Two-year carry-in and return warranty from Deciso, including one year of the OPNsense® Business Edition with the commercial firmware repository, integrated GeoIP database, the free professional features and the e-learning course. Deciso lists the package contents uniformly for its rack appliances. inett supports sizing, commissioning and day-to-day operation, with monitoring and maintenance on request.
Frequently asked questions
Which internet connection can the DEC3960 serve?
Deciso states 36.8 Gbps firewall throughput at 3.07 million packets per second and 22 Gbps port to port. IPsec reaches 5.4 Gbps in a single tunnel and 12.5 Gbps across multiple tunnels, threat protection 7.93 Gbps.
How do the DEC3920, DEC3940 and DEC3960 differ?
Deciso positions them as follows: the DEC3920 has a single power supply and no SFP28 ports, the DEC3940 a dual power supply without SFP28, the DEC3960 a dual power supply with two SFP28 ports. In addition the DEC3920 has 16 GB DDR5 and 256 GB storage, the other two 32 GB and 512 GB.
Is OPNsense already installed?
Yes. OPNsense® is preinstalled and one year of the Business Edition is included. That covers the commercial firmware repository, the integrated GeoIP database, the free professional features and an e-learning course.
May 2.5 and 10 gigabit modules be mixed?
No. Deciso explicitly notes that 2.5/5 Gbps and 10 Gbps link speeds must not be mixed, because the hardware does not support it due to the different frequencies.
Shall we check the sizing together?
We compare line speed, number of users, VPN load and planned services against the performance data. A short message is enough.
More 10-gigabit ports needed?
All measurements refer to TCP traffic unless stated otherwise. Total firewall throughput is calculated from the maximum packet rate and 1500-byte packets. The maximum packet rate was measured with 500-byte packets. IPS performance was measured with 25,000 ET Open malware rules and 1500-byte packets. VPN was measured with AES256GCM16. Concurrent sessions follow from the available memory, where one state occupies 1 KB and 1 GB is reserved for system tasks. Latency is an average over 60 seconds. Source of all technical data: Deciso product page.