Network transfer speed decreases after installing Endpoint Protection

Products

• Endpoint Protection

Issue/Introduction

In some scenarios, with Symantec Endpoint Protection (SEP) installed on a system, the network throughput appears to decrease significantly.
If SEP's Firewall component is uninstalled, the issue no longer occurs.

Cause

Performance degradation in user mode space.

Resolution

There are changes in newer builds of SEP with introduction of "kernel mode" caching mechanism to improve performance. 

In order for it to work, the following "user mode" features of SEP must be disabled to prevent the traffic from entering the "user mode space".

1. In the SEPM console, browse under Policies > Firewall > Edit the applicable Firewall policy > Click on Protection and Stealth under "Windows Settings".
2. Uncheck the options for:
   • Enable denial of service detection
   • Enable Stealth mode Web browsing
   • Enable TCP resequencing
   • Enable OS fingerprint masquerading
3. On the left side, click on Peer-to-peer Authentication Settings.
4. Uncheck the option "Enable peer-to-peer authentication.
5. Click Ok to save the changes.

Additionally, it may not be effective if:

• • packet logging is configured for any firewall rule or
  • if custom signatures are enabled for IPS. 

Note :

• • It is advisable to update/upgrade the Network driver to the latest version before proceeding.
  • The fix supports Windows Vista and later platforms.

Additional Information

BSOD with DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) with Realtek Network adapter and Teefer.sys