cancel
Showing results for 
Search instead for 
Did you mean: 
snow-munki
Level 7

Since installing HIPs - computer performance poor ?

Hi,

We used to use McAfee Firewall 8.5 with no problems but recently moved to HIP's version 7. However it seems since the install general performance seems to be a lot slower.

So for example in Internet Explorer the whole system would just freeze for a good 3/4 seconds and then continue. This would including just scrolling down sites and also typing in boxes. I have put HIPS in learning mode and no new rules are being asked and I have no blocking rules in place.

Any ideas or is the new software jsut generally more sluggish ? ?

Thanks.
0 Kudos
5 Replies
snow-munki
Level 7

RE: Since installing HIPs - computer performance poor ?

Just been trying to narrow it down and when I untick / disable ' Enable Host IPS' the system is much nippier.

umm.... any ideas ? Have I got it setup wrong ?
0 Kudos
Raja
Level 9

RE: Since installing HIPs - computer performance poor ?

First off, do you have patch 1 installed or did you install the patch 1 repost?
It also depends on how you have the IPS module setup. Are you running with the default block high?

-R-
0 Kudos
snow-munki
Level 7

RE: Since installing HIPs - computer performance poor ?



Thanks very much for the reply. Just to confirm I have installed Patch 1 and also the hotfix.

How do I know if the default is set to block high ??

Under the IPS Policy Tab, there is nothing in the exception box. Enable Host IPS is currently ticked. Also Enable Network IPS is ticked. Automatically block attackers also ticked.
0 Kudos
Raja
Level 9

RE: Since installing HIPs - computer performance poor ?

In the ePO server console, the IPS protection policy will dictate how you are protected.
Basic protection only blocks on HIGH signatures. The only mode lower is Warning.

You might try setting your protection to warning and see if that makes a difference.

-R-
0 Kudos
snow-munki
Level 7

RE: Since installing HIPs - computer performance poor ?

Thanks very much for the reply, I have jsut changed it. On epo version 4 the options are :

ignore / log / prevent.

I have changed it from preent to log, will monitor over the next few days.

Thanks again.
0 Kudos