Endpoint Standard: Sensor Will Not Register Or Receive Updates When Behind Proxy Or Firewall

[#1]

Environment

• Endpoint Standard (formerly Cb Defense) Sensor: All Versions
• Microsoft Windows: All Supported Versions
• Apple macOS: All Supported Versions

Symptoms

• System has a valid internet connection and meets installation requirements set forth in the User Guide
• Sensor does not register at time of installation
• Sensor does not receive signature update
• Firewall logs show outbound connections to "*.conferdeploy.net" (using various IPs) over port 443 and then immediately followed by attempts to communicate over port 54443.

Cause

Some proxy and or firewall devices break the SSL communication path or require proxy authentication between sensors and the cloud backend. These symptoms may occur even if a firewall rule is in place to allow traffic to the destination "*.conferdeploy.net".

Resolution

1. Create an SSL whitelist (no decryption) exception to any proxy and or firewall devices inline of the communication path to "*.conferdeploy.net".
2. If the environment is using proxy authentication follow the steps outlined here: Cb Defense: Does the sensor support proxy server authentication?

Additional Notes

• The sensor by design always initiates communication. When an agent action is performed in the Carbon Black Cloud Console the action does not occur until the agent has checked in and accepted the change.
• Here are a few links to common firewall appliance SSL settings:
  List of Domains and Applications Excluded from SSL Decryption
  Websites that have difficulty transiting Content Gateway

Related Content

Carbon Black Cloud: What Ports must be opened on the Firewall and Proxy Servers?
Cb Defense: What’s the static IP address or hostname used by Cb Defense?
Cb Defense: Proxy Settings Detection Algorithm
Cb Defense: Does the sensor support proxy server authentication?
Cb Defense: Barracuda Web Filter blocking Carbon Black Updates