City laptops on VPN show Carbon Black Cloud sensors Offline. The split-tunnel include list carries only RFC1918, and a VPN client firewall drops non-tunneled destinations that are not listed. Carbon Black Cloud FQDNs were never added. What should the administrator change?
Select an answer to reveal the explanation.
Short Explanation
Split tunnel is a fork in the road. If CBC's cloud is neither in the tunnel nor allowed on the direct path, the sensor's check-in falls in the ditch. Put those FQDNs on a living path instead of pretending NSX DFW applies to a laptop that is not on the fabric.
Full Explanation
Carbon Black Cloud sensors require outbound connectivity to CBC SaaS. A split-tunnel VPN that includes only RFC1918 can black-hole sensor traffic when a client or VPN firewall still drops non-tunneled destinations and the CBC FQDNs were never listed. NSX-T Distributed Firewall and identity firewall do not apply to off-fabric laptops, and Workspace ONE UEM compliance does not replace CBC sensor check-in. Include the documented CBC destinations in the split-tunnel policy or allow them on the direct Internet path, then confirm sensors return online.