Linux installs fail due to Network Rules (Palo Alto Firewall)

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Sensor installs fail with frequency
• Checks for IP Addresses used for Registration show regular changes 

Environment

• Enterprise EDR Sensor: All Versions
• Linux: All Supported Versions
• Network Firewall: Palo Alto (PAN-OS)

Cause

Palo Alto Firewall can be configured to block URL-based connections if the IP Address changes.

Resolution

Refer to Palo Alto's guide on configuring URL filtering

Additional Information

• Refer to What Ports Must Be Opened On the Firewall And Proxy to allow normal Sensor communication