topic Re: Tenable Scan on Palo Alto firewall / Panorama in General Topics

Tenable Scan on Palo Alto firewall / Panorama

Ben-Price — Thu, 07 Apr 2022 05:03:37 GMT

Hi All,

Are Tenable vulnerability scans (see below) on Palo Alto firewalls / Panorama resource intensive for the PA devices? Does this cause high DP or MP issues?

https://community.tenable.com/s/article/How-to-perform-a-compliance-scan-on-a-Palo-Alto-Firewall

Thanks in advance.

Re: Tenable Scan on Palo Alto firewall / Panorama

Ben-Price — Sun, 10 Apr 2022 23:39:14 GMT

@BPry @kiwi @S.Cantwell Has anyone had any experience with this?

Re: Tenable Scan on Palo Alto firewall / Panorama

kiwi — Mon, 11 Apr 2022 10:05:10 GMT

Hi @Ben-Price ,

I have no experience with Tenable vulnerability scans but I'm pretty sure it depends on how you configure the scanning options.

I'm guessing that just a simple compliance check shouldn't be too bad ... that said, some scan plugins can cause a denial of service.

Cheers,

-Kiwi.

Re: Tenable Scan on Palo Alto firewall / Panorama

OtakarKlier — Mon, 11 Apr 2022 18:09:16 GMT

Hello,

I have never had an issue where a tenable scan caused issues with PAN operation or resource limits.

Regards,

Re: Tenable Scan on Palo Alto firewall / Panorama

BPry — Mon, 11 Apr 2022 21:14:13 GMT

@Ben-Price,

Same as @OtakarKlier, I've never had a Tenable scan cause any issues with operations. I've never done a configuration scan with Tenable however, and from your linked article that is what you are setting up in this instance? If that's the case, I wouldn't expect the scan to really cause any issues. It'll likely just pull a copy of the configuration for rulebase analysis and do any setting checks via simple CLI/API access.

Re: Tenable Scan on Palo Alto firewall / Panorama

Ben-Price — Mon, 11 Apr 2022 23:24:01 GMT

@BPry @OtakarKlier @kiwi Thanks for your feedback here.

I will clarify with the customer exactly which scan they are planning on using.

Re: Tenable Scan on Palo Alto firewall / Panorama

Adrian_Jensen — Tue, 12 Apr 2022 00:09:57 GMT

I have been dealing with Tenable and Forescout scans from our Infosec team and they have been rather brutal on a PA 3020, not so much in scanning the PA itself, but scanning through the PA to other networks (Trust to DMZ/VPN/etc.). The Tenable servers tend to generate thousands of connections per second (seeing 20k+ cps with 3-4 scanning servers) which hammers the DP CPU.