Endpoint Protection

Hello!

In past i had often problems with a very slow network. Since this time, i don't install the firewall part of the "network threat protection", only the "intrusion prevention", and the Problems are gone.

But now i have problems when copying VHD files, other files are ok. When copying a VHD, the performance goes down to 10 - 50 MBit on a 1GBit connection. First i thought it's the antivirus part of SEP, but it's not. When i disable the setting "network intrudion prevention" but leave the "browser intrudion prevention" enabled, then magically the speed goes up to 1GB.

When i enable the feature again, the performance will be normal and don't goes down.

Do you have any ideas?

I am using Win 8.1x64 and Server 2012R2 and SEP 12.1.4112.4156.

Thanks!

No, i wait for the german release, should it also remove the problem with the firewall part?

In past i had this problem with the firewall part, but with a much much slower performance than now, and it was not only on VHDs, it was a general problem.

But thanks for the tip, maybe i try the english version.

Thanks, Christoph.

And nice greetings to Jimi! :-)

The fix notes for 12.1.5 are here:

http://www.symantec.com/docs/TECH224706

I did see some firewall changes but not sure if related to your issue, may want to have a look.

:)

Sometimes IPS impacts network bandwidth and latency as it has to cache packets to check them against the IPS signatures. That may happen with large files such as VHD files. See here:

Best Practices for the Intrusion Prevention System component of Symantec Endpoint Protection (SEP) on high-availability/high bandwidth servers.

Since IPS is one of the most efficient features of SEP, it's not recommended to turn it off completely:

Two Reasons why IPS is a "Must Have" for your Network

http://www.symantec.com/connect/articles/two-reasons-why-ips-must-have-your-network

IPS is not usable if there are so big problems.

I don't understand why it is so complicated to fix this Error.

SEP is a high price software, so i can expect it works properly! This annoying long time bug is not a very good reputation for symantec.

There is actually no solution for this, except disabling IPS.

It is frustrating!

I believe it was the firewall, not IPS. Have you tried 12.1.5 yet?

No it could not be the firewall, because of the big performance problems in the last years, we decided not to install the firewall component....

So it must be the IPS, read my first posting.

And yes, its 12.1.5

Then, in that case, open a support case.

Be prepared to provide packet traces as well as advanced debug logs, which they will have you enable and send over.

They will need to review this and determine what the issue is.