Endpoint Protection

Hello,
Due to my company structure (thousands of small agency with low bandwith link to a datacenter, I am very interested by the GUP feature (especially MR5 release)
Is there a technical limitation/best practice for the number of  GUP that could be managed by one SEPM or a recommanded "GUP/SEPM" or "GUP/Number of endpoints" ratio ? I did not find any information about this value ?

Thanks for your answers

As per my knowledge such a ratio is not present.But if you are using Embedded database maximum no. of recommended endpoint clients is 5000/database and if you are using SQL database it is 50000/database..

When you are talking about endpoints, do you include GUP & non-GUP endpoints ?
A great number of GUP implies a large "globallist.xml" file. Isn't there any impact on performance ?

You can also refer below docs
How To Optimize Endpoint Protection for Branch Offices using GUPs, Load Balancing, and Location Awareness 
Best Practices with Symantec Endpoint Protection (SEP) Group Update Providers (GUP)
Configuring the Group Update Provider (GUP) in Symantec Endpoint Protection 11.0 RU5

There is no limitation on how many GUP 's  you may have.
You can have as many GUP as you want , but in that case the GUP will loose it objective.

For example you have  100 Client in you newtork , you configure all as GUP , so all 100 Clients will come to the SEPM asking for update. But if you configure 5 clients as GUP only 5 clients will come to the SEPM to take upadte and then distribute the same to the other Clients . This will save the network bandwidth.

A GUP can handle 10000 Clients


Title: 'Best Practices with Symantec Endpoint Protection (SEP) Group Update Providers (GUP)'
Document ID: 2009050510573148
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2009050510573148?Open&seg=ent

Thanks Prachand & AravindKM for your answer

The last question:
The document "How To Optimize Endpoint Protection for Branch Offices using GUPs, Load Balancing, and Location Awareness" mentions different load for package size/Network traffic. I do not see anything about "engine update" . Does this kind of updates exists in SEP 11 (like other AV tools) ? If yes, do you know an approximate load and frequency for this kind of update.

Hi,
You dont need to worry about the size of globallist.xml. We have a file called as globalindex.xml. That file contains the hash value of globallist.xml.

So, the clients will always download the globalindex.xml first. If they see that the hash vaue is different than what they had before [ some new gups have been added to the list ] , only then they will download the globallist.xml again.

Cheers,
Aniket

The updates can either be for the product, or they can be the virus definitions. Viruts defs can be distributed locally to each Branch Office using GUPs.

If you want to provide the product updates, they can be distributed only from SEPM. And heir size may be in a few MBs.

But product updates are'nt supposed to be distributed much often.  Could be 1 time in 3 months.

Aniket

Thanks for this infos

When product are updated, will signature definition file from previous version be kept or does a product update trigger a full download of every signature definition.

Hi,

Product updates do not trigger a definition update as they are different entities. However, if the client does not have latest definitions, in that case virus definitions are provided as well.

Aniket