Carbon Black Cloud: Network connection issues with more than one MDM Profile when Network Extension enabled

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Network performance and connections degraded
• System Preferences > Network shows more than one "Carbon Black Cloud Network Filter" listed

  Carbon Black Cloud Network Filter
  Carbon Black Cloud Network Filter 1

• Network Filters alternate which one is running/not running
• Disabling Carbon Black Cloud Network Filter brings back normal network operation

Environment

• Carbon Black Cloud Sensor: v3.5.1.31
• Apple macOS: Big Sur (11.x) and Higher
• Workspace One used for MDM Profiles

Cause

Workstation is assigned to both Main profile and an individual profile, adding duplicate Network extension and causing routing issues

Resolution

Modify Workspace One configuration so workstations only get one profile assigned

Additional Information

• Best practice is to add devices into appropriate smart group during enrollment to avoid assignment into overlapping groups