Bandwidth control for Endpoint Protection client communication

book

Article ID: 157516

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

You need to adjust the network bandwidth that is consumed by communication between Symantec Endpoint Protection (SEP) clients and the Symantec Endpoint Protection Manager (SEPM).

Resolution

Symantec Endpoint Protection Manager now includes an Apache module, mod_bw, that can be enabled and configured to let you control network bandwidth.

CAUTION: If you installed and configured mod_bw in an earlier version of the SEPM Apache server, be aware that when you upgrade to SEPM 12.1.5 (12.1 RU5), your configuration file is backed up and then replaced by the configuration file provided by the upgrade. This configuration disables mod_bw by default.

To retain any previous settings, you must edit the configuration file manually. To ensure version compatibility, edit the new configuration file, rather than replacing it with an older version.


WARNING: Edit the configuration file carefully. Any directives that the server cannot understand could result in server failure. If your SEPM Apache server fails after you enable mod_bw, check the config file for errors and restart the server. 


Throttling bandwidth using a large value will increase CPU utilization as well.

The configuration file for mod_bw can be found in the following location on the management server:

%SEPM%/apache/conf/bw/bw.conf

By default, bandwidth control is disabled. To enable it, remove the comment tag ('#' character) from the following line in bw.conf:

#LoadModule bw_module modules/mod_bw.so

For any changes to take effect (including enabling the module), you must restart the Apache web server. This is the Symantec Endpoint Protection Manager Webserver service (semwebsrv).

The default configuration provides separate settings for client downloads of content deltas, full content, and client packages. See also the comments in bw.conf.

Download type Default settings Description
Content deltas MaxConnection all 100
BandWidth all 1048576
Connections are allowed from all clients (origins).
The maximum number of simultaneous connections is 100.
The maximum download speed is 1 MB/second (expressed in bytes/second).
Full content MaxConnection all 50
BandWidth all 1048576
Connections are allowed from all clients (origins).
The maximum number of simultaneous connections is 50.
The maximum download speed is 1 MB/second (expressed in bytes/second).
Client package MaxConnection all 50
BandWidth all 1048576 
Connections are allowed from all clients (origins).
The maximum number of simultaneous connections is 50.
The maximum download speed is 1 MB/second (expressed in bytes/second).

If you deploy a large number of client packages that do not include virus definitions, consider temporarily adjusting these options to prioritize full content downloads (../InetPub/content/*.zip). This makes sure that clients are fully protected as quickly as possible. Example:

<Files “*.zip”>
         # Consider using “MinBandWidth [From] [bytes/s]” to provide custom bandwidth to the subnet where the new clients are being deployed
         MinBandWidth 192.168.1.0/255.255.255.0 1048576
         # would reserve a minimum of 10 Mbps for full content going to the 192.168.1.0 subnet.
         # After the clients are deployed and updated, comment out this rule.
</Files>

Note: The module also supports CIDR format to specify a range of subnet addresses.

For a detailed explanation of all available settings in bw_conf, see the mod_bw documentation at http://svn.apache.org/repos/asf/httpd/sandbox/mod_bw/mod_bw.txt

Applies To

This version of bandwidth control is available for Symantec Endpoint Protection Manager 12.1.5 and later.