Carbon Black Cloud: How to Troubleshoot Sensor Connection Issues

[#1]

Environment

Carbon Black Cloud Sensor: All Versions

Objective

 How to Troubleshoot Sensor Connection Issues

Resolution

Please open up a case with VMware Carbon Black Support, the case will start with collecting information:

1. Has the sensor ever connected before? If so was anything changed since then?
2. What is the device sensor version?
3. What is the device operating system?
4. Is the device a cloned image or VDI?
5. Are any devices in the same network/subnet connected?
6. Please verify the correct ports/firewall rules are in place: 
7. Screen Shots of the below connectivity test to the CBC Cloud, KB's for different OS's.
   • Test Client Connectivity to the Backend (Windows)
   • Test Client Connectivity to CBC Backend (Mac/Linux)
8. Please collect Sensor logs: 
   • Windows
   • MAC
   • Linux
9. Please collect a Wireshark and CAPI2 logs noting the IP of the sensor:
10. Please take screen shots using the below KB to verify the correct SSL Ciphers Suites are installed:
    • What do you look for with WireShark for TLS issues?
11. Please take screen shots using the below KB to verify no SSL Inspection or Content filter are involved. 
    • How to confirm content filtering or SSL Inspection is involved with Communication.

 

Related Content

https://community.carbonblack.com/t5/Knowledge-Base/CB-Defense-How-to-Verify-Connection-to-PSC-Cloud...
Carbon Black Cloud: How to Test Client Connectivity to the Backend (Windows)
Carbon Black Cloud: How to Test Client Connectivity to CBC Backend (Mac/Linux)
Carbon Black Cloud: How To Collect Sensor Logs Locally (Windows)
How to Collect a Wireshark Capture
Carbon Black Cloud: What do you look for with WireShark for TLS issues?
Carbon Black Cloud: How to confirm content filtering or SSL Inspection is involved with Communicatio... 
All Products: Enable CAPI 2 Logging