topic Is there a way to create a vulnerability exception for an IP address for ALL threats? in General Topics

Is there a way to create a vulnerability exception for an IP address for ALL threats?

mrFalcon — Mon, 27 Apr 2015 14:52:58 GMT

We have a server that runs vulnerability scans that I would like to white-list against ALL threats... Is there an easy way to do this?

Thanks

Re: Is there a way to create a vulnerability exception for an IP address for ALL threats?

rsingh — Mon, 27 Apr 2015 15:48:37 GMT

For specific vulnerabilities, you can create an exception.

Add a Vulnerability Exception Specifically Based Upon Source and Destination IP Address

https://live.paloaltonetworks.com/docs/DOC-7907

But if you want to white-list one particular IP against all vulnerabilities, the only way is to create a security policy for that specific IP address without security profiles (keep this policy on TOP)

Regards,

Rahul Singh

Re: Is there a way to create a vulnerability exception for an IP address for ALL threats?

James_Costello — Wed, 29 Apr 2015 13:20:50 GMT

Two options

1. Configure the security profiles for the server's security policy to be alert only on all levels (useful for comparison purposes between the Palo Alto Networks firewall and the server outputs)

2. Configure no security profiles for the server's security policy.

Configuring exceptions for all current signatures would require updating each time that new signatures are released. This is double edged in that it would be more work to keep up to date, but would also create greater familiarity with the current list of signatures on the firewall

Re: Is there a way to create a vulnerability exception for an IP address for ALL threats?

akoios — Sat, 18 Jul 2015 10:59:06 GMT

Try to add a new security policy at the top of your rule base without any Vulnerability Protection, Anti-Spyware and Antivirus profiles. Just use the scanner's IP in the source field of the new rule and add all destination zones and addresses you wish to scan. Ideally you place the VA-scanner in a separate zone without any zone protection enabled.