Upload speeds slower with Apple N1 Wi-Fi chip and SEP 14.x macOS agent

Products

• Endpoint Security Complete
• Endpoint Protection

Issue/Introduction

 Wi-Fi upload throughput collapse (to roughly 10-16 Mbit/s) observed on Apple MacBook with M5 processor and the Apple N1 Wi-Fi chip when SEP's Firewall (Network Filter) is enabled.

Environment

• Symantec Endpoint Protection MacOS Agent: Version 14.3.x and lower
• Apple MacBook: M5 processor with N1 Wi-Fi chip (2026)
• Apple macOS: Version 26.5.x
• Symantec Firewall and IPS features enabled

Cause

This is not related to the SEP agent's own filtering logic and it is in the underlying Apple NetworkExtension.framework code path that any packet-level network filter (from any vendor) must go through when registered on macOS.

Resolution

• RESOLUTION: Upgrade to the SEP 16 macOS agent, which is not expected to be affected by the Apple NetworkExtension.framework code path.
• WORKAROUND: On SEP 14.3 Agents disabling SEP's Firewall (Network Filter) on the affected Wi-Fi configuration while retaining IPS should avoid the throughput collapse, since IPS does not use the affected packet-level registration.

Additional Information

• SEP 16 has moved to a socket-filter-only architecture and no longer registers a packet-level (NEFilterPacketProvider) filter at all, so it should not be exposed to this issue. For those looking for a longer-term path off this limitation, rather than the Firewall/IPS workaround above, should consider upgrading to SEP 16.