Global Protect bricks machine with Carbon Black quarantine

[ErinWest]

We have been having an ongoing issue for several months (and we have had monthly Windows updates since as well as moved to GP 6.2.5) where if we use the quarantine function in Carbon Black, that the NIC card gets turned off, the machine is bricked basically and un-quarantine will not work-ie is loses all capability to communicate even if you plug in an ethernet cord. PA gave use an allow list for CB policies but a machine is still bricked off until you remove GP and then magically everything starts working again. 

[BPry]

@ErinWest,

I'm not sure how Carbon Black is handling a quarantine, but you generally won't expect to see an EDR tool actually turn off the NIC. Generally what happens is that the EDR essentially creates essentially NULL routes for anything but it's own communication and not actually disabling the NIC. That way releasing the device from quarantine can actually process properly.

Couple Questions:

• Can you verify exactly what you mean by it disabling the NIC?
• Are you enforcing a GlobalProtect connection for network access?

If you're enforcing a GlobalProtect connection for network access, you'll need to make an exception on the Carbon Black side of things so that quarantined devices can still communicate to your GlobalProtect portal/gateway(s). Otherwise you'll need to setup GlobalProtect enforcement exclusions and hope that you always keep Carbon Blacks requirements updated. In my experience, 10X easier to setup a quarantine exception so that your quarantined clients can still connect to GlobalProtect.

[ErinWest]

Its not the EDR turning off the NIC. GP has been doing that for us in a variety of scenarios; ie the networking card is turned off completely, ethernet, wifi nothing works until GP is removed and the computer rebooted. We already have Carbon Black on exception if GP is not running but since the NIC is turned off, it cannot communicate with anything that we have on exception. Also we have GP and ADEM whitelisting on the CB side as recommended but its still not working.