In case the scanner is also running the reconnaissance and you want to allow it, please whitelist the scanner IP the reconnaissance protection.Please make sure that when the scanner sends the traffic, this is the first policy that matches. Now place the new Security Policy( in this case allow-for-scanner) above the security policy before the policy for other traffic in that zone.Schedule time: Enable for few hours or enable before running the test.Action tab-> profile settings: You can leave it empty.Destination IP: IP address of the resource.Service/URL Category tab: ANY and Action tab: allow.Source address tab: pen-tester or Scanner's IP address.Source Zone tab: Zone where the scanner belongs to.Name: Please give some useful name such as allow-for-scanner.Now create a new Security Policy allowing the Scanner/tester IP to have access from/to your LAN following.Create a new security policy and a new security profile with a threat, spyware, and anti-virus exceptions. Web servers, application servers or other resources behind the Firewall.ġ.Vulnerability scanners such as Qualys, Rapid 7, Nessus or others.

This document covers the configuration steps to safely allowing the vulnerability scan for the resources behind the firewall for a limited time, and reduce the threat surface by not exposing standard services. Sometimes if you are sending a link in the email, and you have wildfire profile enabled, it is possible the elink is clicked by the wildFire. Second, the pen test will not be successful if the firewall blocks all evasion and attack traffic before it reaches to the server. Vulnerability scanners such as Qualys and Rapid 7 are frequently used to identify vulnerabilities on the resources behind the Firewalls for compliance. These scanners' traffic creates an overwhelming amount of threat logs in the Firewall, which can cause false alerts for the Firewall security administrators. To reduce the interface introduced into pen-testing or vulnerability scanners due to Firewall's security profiles.

How to use nessus scanner 7