Extremely slow network performance for SSR 2013 on server with SEP 12.1

[CQ]

Hi all,

I am going to post this question in the Symantec Endpoint forums as well.  I created a support call today with SEP support . Following is the issue:

"We have a Dell 610 Server and Dell 515 Sever both running Windows 2012 Server with Hyper-V Enabled. Both servers are running 3-4 virtual machines with 1 virtual switch on each server. Both machines use Symantec System Recovery 2013 SP1 for Backups. When running SSR  we are getting transfer speeds of 2 Mbs or less! A full backup takes days to complete. If SEP firewall is turned OFF, we see transfer speeds of 500-700 Mbs and full backups complete within 2 hours which is normal. If a large file is copied from these machines over our gigabit network we see speeds of 300-400 Mbs. If firewall is turned OFF we see transfer speed near 1000 Mbs. Basically we have to turn OFF firewall to get backups to complete properly with reasonable time."

The answer I got from support was to turn the firewall off as we don't really need it since we have a firewall at the router.  i.e. a basic install not full    Both of these servers are mission critical and I really want to use the SEP firewall.  We are running 600 times SLOWER when SSR 2013 SP1 runs. I have tried the registry mods that might speed things up with no change.   At times we are under 1 MBs with SSR running on a dedicated network.  I can live with the slower file transfer speeds but the SSR issue is unacceptable.  Is turning off the firewall the only solution to this issue?  We are running the current SEP 12.1 4.

Thanks for any help!

CQ

[TRaj]

Well with SEP what it does is , it also scans all the Symantec products and so disabling the firewall is recommended. However if you need SEP enabled , you can create a Exception of SSR folder under SEP and it should run fine. So when SEP run SSR will not be scanned. Hope this helps!

[criley]

Disabling the firewall should only be considered as a temporary workaround, it should not be considered a 'solution' - that's my opinion anyway.

I would start with making exclusions in SEP for the following folder (including all subfolders):

C:\Program Files\Symantec\Symantec System Recovery

Let us know if this helps at all.

[CQ]

TRaj and Chris,

I guess i need some clarification here.  In SEP you can make an exclusion for a folder not to be scanned by the AV.  I did that for SSR as Chris suggested and that had no effect on network speed of backups.  Were you refering to AV scan exclusion or something else?    I see no way to avoid having the SSR data flow through Network Threat Protection of SEP except by turning off the firewall.

Thanks

[criley]

OK, I think this will require some testing to be done here. I can do this myself but due to the Xmas/New Year break, I probably wont be able to do it until early January.

Do you have an existing support case open? If yes, can you please provide the case #.

[CQ]

Thank you Chris.  The case# is 05704529.

Keep in mind the speed issue goes beyond SSR but in my case is most severe when a SSR backup is running.  In the SEP forums see this link http://www.symantec.com/connect/forums/sep-1214-extremely-poor-firewall-performance      Others are having speed issues and I am beginning to wonder if Hyper-v is the common link to this issue.    The SEP people should be aware of this issue by now I would think.

Thanks!

[criley]

I noticed the following in the case notes:

If a large file is copied from these machines over our gigabit network we see speeds of 300-400 Mbs. If firewall is turned OFF we see transfer speed near 1000 Mbs.

So this would suggest a general (i.e. not specific to SSR) network performance problem when the SEP firewall is enabled. Unless I am missing something?

I think this needs fixing first before you can expect to see an improvement in SSR backup performance. Hopefully the SEP support team can help you with this.

Let us know how things go and if you need anything from me from an SSR perspective.

[CQ]

Thanks Chris.  The slowdown is most dramatic with SSR but you are correct that the problem goes beyond SSR.  Hopefully I will get some answers out of the SEP support people.  Will keep you posted.  For now turning off the firewall fixes the immediate need but obviously is a bandaid approach.

[TRaj]

Has the slow performance improved ?

[CQ · Accepted solution]

The only answer I got out of  SEP support was the firewall should be off on servers for maximum network performance.   You don't see this kind of performance hit on desktop machines running SEP.and  SSR 2013. So, the solution was to turn off the SEP firewall and SSR backup times became normal.  I am not happy with that answer but that is what worked.

[CQ]

I have reluctantly marked "Turn off the SEP firewall" as the solution but it certainly does not get to the root of the problem between the SEP firewall and SSR.

[criley]

All I can suggest is that you ask for the case to be escalated (to get a second opinion from a more senior engineer) if you are not satisfied with their response.

As a reminder (see my earlier comments), this is not a SEP/SSR specific problem - you see a performance hit with basic file copies in Windows when the firewall is enabled.

Hope that helps.