Issue
This issue applies to WatchGuard EPP, EDR, EDR Core, EPDR, and Advanced EPDR. It was resolved in Hotfix WGUA-2152, WGUA-2320.
On WatchGuard Endpoint Security protection software versions v8.00.22.0010 to v8.00.22.0023, there could be performance issues caused by the firewall infrastructure of WatchGuard Endpoint Security products. This issue might occur with any of these protections enabled on the affected endpoint:
Advanced ProtectionWeb protectionFirewall protectionWeb filtering
For information on how to determine the version of your WatchGuard Endpoint Security product, go to Determine the Software Version in Help Center.
Workaround/Solution
A hotfix is available to resolve this issue.To apply a hotfix on the affected endpoint:
Download and save the hotfix file to the endpoint: hf-wgua-2152-2320-nnsstrm-tcpsession.exeDouble-click the downloaded file.The hotfix installation does not require you to restart the computer. However, under certain circumstances, you might be prompted to restart for the hotfix to be fully applied. If you cannot restart the computer immediately, select No when prompted. This postpones the application of the hotfix until the next system restart.
Note: To download an unattended or silent version of the hotfix, click here. The hotfix is applied after the next system restart.
File Details
The hotfix updates these files:
File NameLocationFile VersionModified DateHotfix included in future versions?NNSSTRM.sysC:\Windows\System32\Drivers\NNSStrm.sys7.0.0.41020 December 2023Yes. Future Releases higher than v8.00.22.0023
Verify Hotfix Application
To confirm the correct application of the hotfix, check the file version (in File Details section) or verify the values of these registry keys:
32-Bit Architecture64-Bit ArchitectureRegistry KeyValueRegistry KeyValueHKEY_LOCAL_MACHINE\SOFTWARE\Panda Software\Setup\Hotfix history\HF_NNSSTRM_TCPSessionRevision [REG_DWORD]1HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Panda Software\Setup\Hotfix history\HF_NNSSTRM_TCPSession
Revision[REG_DWORD]
1
HKEY_LOCAL_MACHINE\SOFTWARE\Panda Software\Setup\Hotfix history\HF_NNSSTRM_TCPSession
Result [REG_DWORD]
0 = Success1 = Not Applied2 = Error9 = On Reboot Operation
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Panda Software\Setup\Hotfix history\HF_NNSSTRM_TCPSession
Result[REG_DWORD]
0 = Success1 = Not Applied2 = Error9 = On Reboot Operation
