Sensor is Unable to Communicate with 0x80cc006e or 0x80072F8F Errors

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Sensors is showing offline or unable to register with the EDR server. The sensorcomms.log shows HRESULT: 0x80cc006e or 0x80072F8F

Environment

• Carbon Black EDR Server: All Versions
• Carbon Black EDR Sensor: All Versions
• Linux: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

The firewall configuration or SSL inspection is preventing the sensor from contacting the sever.

Resolution

• Firewall configuration changes must be made to allow the sensor to communication with unaltered certificates including
  • The default sensor communication port, 443.
  • The IP address or FQDN of the back-end server
• These messages can also happen with SSL Inspection. Applications such as Zscaler could be striping the headers, causing the cert pinning to fail. 

Additional Information

• 443 is the default port for sensor communication. If the port was changed in nginx and the sensor group's server URL, the firewall will need to be updated to allow that custom port.