topic Re: Palo Alto scanning with Nessus in General Topics

Palo Alto scanning with Nessus

OtakarKlier — Fri, 28 Aug 2015 20:30:00 GMT

Hello,

Does anyone else out there scan their firewalls with Nessus? Just curious if you have some other definitions defined other than what tenable has listed on their support site. I've tried google but its not helping much.

Thanks in advance!

Re: Palo Alto scanning with Nessus

jdprovine — Fri, 28 Aug 2015 21:00:09 GMT

why are you scanning your firewall with nessus? are you getting useful information?

Re: Palo Alto scanning with Nessus

OtakarKlier — Fri, 28 Aug 2015 21:06:49 GMT

Compliance requirements from our customers. As for unseful info, not for me with the baked in plugins and compliance checks they have. It looks for some best practices stuff that could be useful to someone that has not configured everything or just a quick check to see if things are configured.

Re: Palo Alto scanning with Nessus

jdprovine — Fri, 28 Aug 2015 21:09:53 GMT

Very interesting - I would never have thought of scanning a firewall with nessus not sure that it would be much good

Re: Palo Alto scanning with Nessus

OtakarKlier — Fri, 28 Aug 2015 21:28:19 GMT

Yeah it can be handy to just make sure best practices are followed, etc.

Re: Palo Alto scanning with Nessus

mmmccorkle — Sat, 29 Aug 2015 00:55:23 GMT

Hey,

I wanted to share my one case with Nessus.

https://discussions.tenable.com/message/32299#32299

Plugin ID 83875.

This is a false positiveand Nessus is working to fix this.

Thanks!

Re: Palo Alto scanning with Nessus

HITSSEC — Tue, 01 Sep 2015 23:23:08 GMT

This document https://www.sans.org/reading-room/whitepapers/auditing/palo-alto-firewall-security-configuration-benchmark-35777 will help guide you through all the basics to help ensue you are not missing anything obvious. Taking a more agressive response with your IPS responses (default actions of reset and drop) and using an exception response of block-ip will reduce the effectiveness of a scanning tool.

Hope this helps,

Phil

Re: Palo Alto scanning with Nessus

OtakarKlier — Wed, 02 Sep 2015 21:40:17 GMT

Doing more digging I also found the following its still beta however...

http://iase.disa.mil/stigs/Pages/index.aspx