Unable to move Linux device Into quarantine

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR

Issue/Introduction

Attempts to move a Linux device into Quarantine fail with no visible indication

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: 2.13 and Higher
  • Endpoint Standard
  • Enterprise EDR
• Linux: All Supported Versions

Cause

•  IPv6 module not enabled and IP6Tables not running on the device

Resolution

Enable IPv6 on the Linux endpoint:

1. To enable IPv6 immediately without a reboot, use the sysctl command. These changes will be lost after a restart.

   #Enable for all interfaces:
   sudo sysctl -w net.ipv6.conf.all.disable_ipv6=0
   
   #Enable for default settings (new interfaces):
   sudo sysctl -w net.ipv6.conf.default.disable_ipv6=0
   
   #Enable on a specific interface (e.g., eth0):
   sudo sysctl -w net.ipv6.conf.eth0.disable_ipv6=0

    

2. To ensure IPv6 remains enabled after a reboot, you must modify the configuration files.
   1. Open the configuration file:

      sudo nano /etc/sysctl.conf
      
      #Add (or modify) the following lines to set them to:
      net.ipv6.conf.all.disable_ipv6 = 0
      net.ipv6.conf.default.disable_ipv6 = 0
      net.ipv6.conf.lo.disable_ipv6 = 0 

   2. Save and exit. Apply the changes immediately:

      sudo sysctl -p

Additional Information

• Quarantine feature makes use of IPTables filter rules to block unwanted network traffic
• It filters both IPv4 and IPv6 traffic and hence ip6tables rules need to be set when enabling quarantine
• IPv6 module disabled on a device leads to failure in setting custom firewall rules for ip6tables command, which results in failure to enable quarantine operation