City kiosks on a guest VLAN with a walled garden show CB Defense sensors Offline and Intelligent Hub cannot enroll, even though NSX-T identity firewall groups look healthy. What should the security administrator open first?
Select an answer to reveal the explanation.
Short Explanation
A walled garden is a lobby with a locked front door — Hub and the Carbon Black sensor both have to walk out to their SaaS clouds. If the guest VLAN only permits a captive portal, those FQDNs never leave and both products look down even when IDFW groups are perfect. Open the documented outbound destinations first.
Full Explanation
When city kiosks on a guest VLAN with a walled garden show CB Defense sensors Offline and Intelligent Hub cannot enroll even though NSX-T identity firewall groups look healthy, allow the documented Carbon Black Cloud and Workspace ONE SaaS FQDNs out of the walled garden so both agents can reach their clouds. A walled garden that only permits captive-portal destinations starves both CBC and Hub SaaS check-in; healthy IDFW groups do not open those public FQDNs for off-fabric kiosks. Opening the documented SaaS allow list restores civic kiosk management and prevention. Binding the guest VLAN to an NSX-T identity firewall group so kiosk AD users inherit Distributed Firewall allows fails by concept because IDFW inheritance does not replace outbound SaaS FQDN access from a walled garden. Redeploying Guest Introspection on the kiosk cluster so partner SVMs proxy sensor check-in fails by concept because GI partner SVMs do not proxy CBC and Hub SaaS enrollment from guest VLANs. Publishing a Carbon Black Live Response isolate from NSX Manager to force Hub through the overlay fails by concept because Live Response isolate is not an enrollment path and NSX Manager does not force Hub through overlay for guest kiosks. Exam caveat: Offline CBC plus Hub enrollment failure on a walled-garden guest VLAN means open documented SaaS FQDNs first—IDFW, GI, and Live Response are wrong doors. Operational check: add CBC and Workspace ONE SaaS FQDNs/ports to the guest VLAN allow list, confirm sensors Online and Hub enrolls, keep IDFW unchanged unless separately required, and record the guest SaaS exceptions in the city kiosk network standard for municipal public-access security.