Scanning with credentials is the best way to get around firewalls, but offers different results. When scanning through firewalls it will take longer, but tuning your settings can ensure more accurate results. Nessus works great for both network scans and credentialed scanning. We also get much more accurate port scan results, as it provides a complete list of open TCP and UDP ports in a fraction of the time. Instead of reporting on vulnerabilities found remotely in the web server, Nessus reports a long list of missing operating system and software patches, equally as important as some of the issues found in the network-based scan. The first step is to configure the number of vulnerability checks to run concurrently for each host: In this example, we do not have credentials on this system, so we must scan across the network. The first scan strategy targets a single Linux host (Fedora Core release 5) running iptables. There are two strategies for dealing with firewalls when using Nessus to perform internal or external vulnerability scans.

Even if you allow the scanner's IP address through the firewall, connection tracking and stateful inspection can interfere with the scan. Scanners can be placed on network segments behind a firewall to avoid these problems, but this may not be feasible in your network, create extra burden moving a scanner around and is ineffective against host-based firewalls.

Host-based firewalls are now common on both Linux and Windows systems. Firewalls are essential for an organization’s perimeter protection and internal network segregation. However, firewalls (or other types of filtering devices) are one of the major causes of slow or inaccurate scans. For the latest guidance on Nessus scans, please read our updated blog, ' 4 Ways to Improve Nessus Scans Through Firewalls' Nessus Scanning Through FirewallsĪ number of factors can inhibit a successful Nessus scan: busy systems, congested networks, hosts with large amounts of listening services and legacy systems with poor performance all contribute to scan failure(s). Note: This 2009 blog includes some outdated information.

How to use nessus to scan an ip