10-23-2017 06:58 AM
I have a known external Nessus scanner that scans my external network every weekend. Every Monday morning, I've got hundreds of alerts due to these scans. I do not want to disable the scan alerting in general because if anyone else scans me, I want to know, but how can I whitelist these few specific IP addresses so I won't get all these alerts? Anyone figured out how to do this?
I am running a pair of PA-3050s with PanOS8.0.4
Thank you for the help
10-23-2017 10:21 AM
You could create a security policy above others that would scan for threats. Add the IP addresses (you'll probably want to create an address group) and set the action to Allow. As long as it has no security profiles, you shouldn't see anything trigger from those IPs.
10-23-2017 10:21 AM
You could create a security policy above others that would scan for threats. Add the IP addresses (you'll probably want to create an address group) and set the action to Allow. As long as it has no security profiles, you shouldn't see anything trigger from those IPs.
10-31-2017 04:17 AM
Perfect. Thank you for your help
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
