Poor performance with Office files on SMB shares caused by Safeguard File Encryption

Question

Hi, 
 This is a follow-up of this case: 
 https://community.sophos.com/sophos-xg-firewall/f/discussions/125718/ssl-vpn-poor-performance-with-office-files-on-smb-shares-probably-because-of-mtu-issues 
 We have the issue that MS Office Files (Office 2016 Standard) open extremely slow when connected via SSL VPN (through Sophos XG Firewall). 
 100KB .xlsx 134 Sec 8KB blank .xlsx 29 Sec 12KB blank .docx 25 Sec 
 31KB blank .pptx 45 Sec 
 
 Finally after lots of testing hours wasted, we've ruled the issue out. It is caused by Safeguard File Encryption. 
 This is happening on many of our corporate Windows 10 machines. Latest testings were with Win10 1809 and 20H2. 
 Before Safeguard is installed or after it has been uninstalled, the performance of the Office files is very good. The small files open in 3-6 Seconds, and the 100KB test file in 7-9 Seconds (over VPN WAN). 
 Safeguard is used for working with encrypted files on the file server share. There are some folders with encrypted files and most folders contain unencyrpted files. The performance is bad regardless of opening encrypted or unencrypted files.

Also there is the latest version of Sophos Intercept-X Client installed but the issue is also happening if the client is removed from the client and the server hosting the SMB share. So we do not neet to struggle any further with AV exclusions or whatever. 
 I'm asking for suggestions about the cause and how to fix this.

FormerMember · Answer

If you have File encryption going through a vpn to a remote location - there will be a performance hit. 
 The way FE works is that its a filter. It will check every file access attempt. If the file is encrypted (it has the FE headers) the filter will then either decrypt for a read action or encrypt for a write action. The filter is always there, since it has to check every access even to unencrypted files because it doesn't know, before hand, which files are encrypted or not. 
 Now that you have a VPN (which means other networking in between the client and the target file) you will have a multiplicative effect on the action times. 
 Now, how can it be optimized? 
 I would need more information about the network structure and the VPN solution used to give any sort of advice. 
 However, the performance is never going to be exceptional - since FE is a per file bulk encryption action it does increase the size of the files involved.

FormerMember · Answer

I have been talking with development about this and they confirmed that the FE filter doesn't treat docx formats differently than any other file type. 
 also, they suggested that you implement Mitigation #3 in this article: https://support.sophos.com/support/s/article/KB-000038386?language=en_US 
 This should help. 
 They also suggested Mitigation #1 just in general. 
 I hope that helps.

Poor performance with Office files on SMB shares caused by Safeguard File Encryption

Top Replies