City kiosks on a guest VLAN with a walled garden show CB Defense se…

Question

City kiosks on a guest VLAN with a walled garden show CB Defense sensors Offline and Intelligent Hub cannot enroll, even though NSX-T identity firewall groups look healthy. What should the security administrator open first?

Accepted Answer

Allow the documented Carbon Black Cloud and Workspace ONE SaaS FQDNs out of the walled garden so both agents can reach their clouds — A walled garden is a lobby with a locked front door — Hub and the Carbon Black sensor both have to walk out to their SaaS clouds. If the guest VLAN only permits a captive portal, those FQDNs never leave and both products look down even when IDFW groups are perfect. Open the documented outbound destinations first.

Answer

Bind the guest VLAN to an NSX-T identity firewall group so kiosk AD users inherit Distributed Firewall allows

Answer

Redeploy Guest Introspection on the kiosk cluster so partner SVMs proxy sensor check-in

Answer

Publish a Carbon Black Live Response isolate from NSX Manager to force Hub through the overlay

City kiosks on a guest VLAN with a walled garden show CB Defense sensors Offline and Intelligent Hub cannot enroll, even though NSX-T identity firewall groups look healthy. What should the security administrator open first?

Short Explanation

Full Explanation