Carbon Black Cloud: Sensor fails to install after setting up Proxy/Firewall Permission for CB Cloud and shows 'Error 0x80004005: Failed to register' error in msi.log

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Carbon Black Cloud sensor fails to install on device behind firewall
• Firewall/proxy is already set up to allow connection to backend through port 443/54443
• This error message can be found in msi log

  CA:InstallPreCheck: Register failed. Please make sure your network is connected and provide a correct register code. 
  CA:InstallPreCheck: Error 0x80004005: Failed to register.

 

Environment

• Carbon Black Cloud sensor: All supported versions

Cause

Firewall/proxy is configured with SSL inspection which tries to decrypt CB Defense traffic, CB Defense communication will stop connecting and avoid potential man-in-the-middle attack.

Resolution

1. Follow the instruction provided in this KB: https://community.carbonblack.com/t5/Knowledge-Base/CB-Defense-What-Ports-must-be-opened-on-the-Firewall-and-Proxy/ta-p/36295
2. Disable any possible traffic inspection on CB Defense, like SSL inspection to make sure the communication from sensor to backend is stable.

Additional Information

Carbon Black Cloud connection test provided in this KB may not be able to detect this issue:
https://community.carbonblack.com/t5/Knowledge-Base/CB-Defense-How-to-Verify-Connection-to-PSC-Cloud/ta-p/67452
More investigations on customer's firewall settings will be required.