topic Re: Vulnerability protection ip exception in General Topics

Vulnerability protection ip exception

lee.curtis — Thu, 17 Sep 2020 22:12:13 GMT

We have our regular penetration tests coming up and we need to allow the IP addresses that are doing the testing to scan our network. Is there a way to create an IP based vulnerability protection exception? I know how to create an exception for a specific threat, but is there a way to allow a specific IP or set of IPs through the vulnerability protection without allowing everyone through?

Re: Vulnerability protection ip exception

Abdul-Fattah — Thu, 17 Sep 2020 23:03:34 GMT

Is there a reason why u do not want to use separate security Policy to allow what you want, for these IPs !?

Re: Vulnerability protection ip exception

BPry — Fri, 18 Sep 2020 04:00:15 GMT

@lee.curtis,

As @Abdul-Fattah alluded to, you're going to want to build a separate security rulebase entry to allow the traffic. You can programmatically add an exception relatively easy, but it is simply just building an IP address exception for each signature. Just build out a new security rulebase entry and remove it when the penetration test is done.

Re: Vulnerability protection ip exception

MP18 — Sun, 20 Sep 2020 23:25:20 GMT

@lee.curtis

We do this regularly in our network where External Vendors do Pen test against our public facing applications.

You will need security rule with source as Vendor Public IP and destination will be your External Interface public IP.

For this security normally we do all security profiles as none and once Pen Testing is done then rule can be removed.

Regards