Endpoint Protection

Hello,

We currently have an issue that we're unable to resolve. Before I call in a support request, I thought I should check here first,

We are starting to stream more and more video within our enterprise and it has been noticed that with the SEP Firewall loaded (NTP), Multicast Video Streams drop back down to Unicast speeds, see below.

If I disable the NTP module, then our Multicast streams flow without issue, see below.

I've tried adding our video server ip to allow all traffic on both the client and SEPM side

I've verified that the "Don't log broadcast and multicast traffic" rule is enabled

I'm not sure what else to try or how to isolate what or where or how the traffic is being affected.

Any thoughts?

-Mike

P.S. Were running RU6 MP2.

Check NTP logs to see if Multicast or anything else is being blocked then you can create a rule for that.

The NTP Traffic and Packet logs are both empty...should I be looking somewhere else?

Should I turn off (disable) the "Don't log broadcast or multicast traffic" on the SEPM as a test?

Check the logs from SEPM console

Traffic, packet and attacks are all blank for the machine I testing on.

Turn off (disable) the "Don't log broadcast or multicast traffic" on the SEPM

So yes...once I got the logs to show that the Multicast IP ranges were still being blocked...I was then able to add a new rule that allowed the Multicast traffic.

Sure enough it works as expected.

Vikram's push, get's the points!

Thanks!

-Mike