Endpoint Protection

We recently upgraded to SEP v14.0 RU1 MP1 build 3876. Our clients have the Cisco Umbrella Client v 2.1.0. Multiple people, including myself, have noticed that SEP doesn't seem to be playing well with the Umbrella client. (SEP 12 did not have any issues.) For me, when I browse the web, CPU use for Chrome & IE both shoot up when I go to a webpage. Even opening blank tab causes it. I am normally playing music in VLC and it stutters something fierce. A couple instances of chrome.exe shoot up to 25 in the Task Manager. Occasionally dnscrypt-proxy.exe, part of the Umbrella client, will also start hogging CPU.

I uninstalled SEP and everything was fine immediately. I reinstalled it and found that the problem started again, though not as bad as before. However, it has gradually gotten worse and is back to where it was.

Has anyone else noticed this kind of behavior or any other conflict between SEP 14 and Cisco Umbrella?

Skip

What about the SEP firewall? If you disable only it does it work? Admitting in the traffic log at the time this occurs?

Thanks for the reply.

The SEP firewall is not enabled.

Skip

What components are enabled? I disable all but AV and see what the result is. Then add each one back at a time until the issue re-appears.

Component isolation and policy isolation will be key here.  Once we figure out what component or policy is causing the issue we can dial into what logs to take a look at.

Thanks for the replies. I will start isolating components and policies and see what happens. Thanks again.

You're welcome.