Endpoint Protection

After upgrading from 12.1.2 to 12.1.3 to fix a known issue, droves of out users are saying files being opened are very slow. Disabling the firewall is unacceptable. So now we have a new issue, and it seems 12.1.4 doesn't fix it.

Is it possible to create an exception for SEP to not scan opening files from a specific server?

So you confirmed it is the firewall causing the problem?

In the AV policy there is also an option to Scan files on remote computers (AV policy >> Auto-Protect >> Network Settings)

Yes. We did several tests for each component of SEP which ended up being the firewall. Then we tested the rules within the firewall, but weren't able to pinpoint the rule causing the issue.

I looked and we have "Scan files on remote computers" unchecked.

update...

My manager created an exception to the drive mappings for SONAR (antivirus). We're not sure if that could work, but giving it a test on a few computers.

I'm thinking adding a SONAR exclusion won't apply if it is the firewall.

Try adding a new rule to allow traffic to that server, see if this fixes it.

My fear is this could be more of a bug, in which case supoprt will need to be contacted, you will need to provide packet traces and enable some advanced logging for support. I've already been thru this in the past with them.

Ok. I'll add that and see what happens.

Thanks Brian

Sounds good. keep me posted.

Ok, one last thing. Would it matter (I don't think it would) if the server has SEP installed with Feature Set of Full Protection for Clients, or should it be Basic/Full Protection for Servers?

All features are supported on servers so it shouldn't matter. However, in my personal, I would start with only AV and add features as you go. We don't run the firewall on some servers for reasons like this. They are just too important/HA for problems like this to occur.

Here's a good article on the subject:

Best Practices for Installing Symantec Endpoint Protection (SEP) on Windows Servers

SEP has not worked correctly for me on a 2008 R2 since 12.1.2 MP1.  12.1.3 and 12.1.4 don't work either.  Network speeds are ridiculously slow.  Un-installing any of the newer versions, and re-installing 12.1.2 always resolves the issue.

Call support. Be prepared to provide advanced logging from the client as well as packet traces

Have you tried opening the files on a workstation without SEP installed? You could also try deploying custom packages with certain components removed (firewall, IPS, etc).

Another thing to try would be to import the legacy SEP package into your SEP server:

%SEPM Installation files%\SEPM\AdditionalPackages

This should be on the original ISO you downloaded from FileConnect. SEP 11.x seems to work better on file shares.

Same issue here, new SEP 12.1.3 and 12.1.4.

Transfer file is so slow compare to 12.1.2

Open file from Network is also slow

attache file to email is the same.

Anyone find best practice and solutions

You'll need to put in a support call. This sounds more like a "bug" than something best practice will rectify.

It's clearly a bug.  I had a case open with Symantec, they were no help.

Thanks for the update. We've been banging our heads here and no luck lol, plus we're being pushed to go to the newer version.

Thanks, but unfortunately we're quite prone to picking up anything that looks our way and can't disable anything until a fix arrives.

We thought about downgrading, but corporate is pushing us to upgrade to newest version to be in sync with them.

Not sure why they can't help. I had the same issue in ru2 mp1 and got them on and gave them packet traces and advanced logs. Heard back within 2 days with confirmation it was a bug. If you have an SE I wuold suggest having it escalated

Have you tried reducing the auto protect scanning on files? to only scan when modified then they won't get scanned when accessed improving responce times. Virus and Spyware Protection > Auto-Protect > Advanced Scanning and Monitoring.

GeoGeo,

I have tried that but it's very much the same. Created the case with Symantec.

Hi

Can you try "enabling" network scan. I know this sounds a bit contradicting, but I have  a support case open where we actually experienced a 3,5Gb/s increase on our 10Gbs NICs after enabling this option.

I believe their might be a bug in this feature and that off=on or something like that.

Torb

Which setting are you referring to?

Thanks

If you see GeoGeo screenshot, there is an option called "Scan files on remote computers" under Network scanning. Even though it makes no sense that this should improve performance, try enabling that and see if you see any difference. (Disabling Download Protection will also increase file transfer).

I already had "Scan files on remtoe computers" enabled.  I believe I tried disabling thsi during my original troubleshooting.

Thanks

GeoGeo, we'll give this a try. Thanks.

(excuse for my english...i'm french)

We have the same issue when upgrading from 12.1.1 to 12.1.4

not on all workstation just for some specific models (but they share the same policies)

Finally after downgrading to 12.1.1 a lot off the worksation affected with this problem we identified the problem

It's a specific option in the firewall policy : it is not a firewall policy rule

it is a "Traffic and stealth" option in the firewall policy" : ### Enable TCP resequencing ###

 when disable "Enable TCP resequencing"  the client 12.1.4 works fine without downgrading

but for the moment no official response from symantec why this option is no more or correctly supported for some computers when upgrading to last version

May be it could help you ....or not...

Very helpful, thank you for posting this.

Thanks for the info Opus. I've looked at our settings and ours is unchecked.