CB Defense: Will sensors continue to check-in if port 80 is blocked?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

If access is initially allowed to ocsp.godaddy.com and crl.godaddy.com on TCP Port 80 in Firewall/Proxy to ensure successfull sensor install, will sensors continue to check in if access to GoDaddy CRL and OSCP servers are later blocked?

Environment

• CB Defense PSC Web Console: All Versions
• CB Defense Sensor: 3.3 and Higher
• Microsot Windows: All Versions

Resolution

No. Sensor checkins will work for a short while, but when Windows CRL cache expires it will attempt to check the CRL/OSCP server again. If access to ocsp.godaddy.com and crl.godaddy.com on TCP Port 80 is later blocked in the Firewall/Proxy sensor checkins will fail.