Tenable Scan on Palo Alto firewall / Panorama

[Ben-Price]

Hi All,

Are Tenable vulnerability scans (see below) on Palo Alto firewalls / Panorama resource intensive for the PA devices? Does this cause high DP or MP issues?

https://community.tenable.com/s/article/How-to-perform-a-compliance-scan-on-a-Palo-Alto-Firewall

Thanks in advance.

[Ben-Price]

@BPry @kiwi @SteveCantwell Has anyone had any experience with this?

[kiwi]

Hi @Ben-Price ,

I have no experience with Tenable vulnerability scans but I'm pretty sure it depends on how you configure the scanning options.

I'm guessing that just a simple compliance check shouldn't be too bad ... that said, some scan plugins can cause a denial of service.

Cheers,

-Kiwi.

[OtakarKlier]

Hello,

I have never had an issue where a tenable scan caused issues with PAN operation or resource limits.

Regards,

[BPry]

@Ben-Price,

Same as @OtakarKlier, I've never had a Tenable scan cause any issues with operations. I've never done a configuration scan with Tenable however, and from your linked article that is what you are setting up in this instance? If that's the case, I wouldn't expect the scan to really cause any issues. It'll likely just pull a copy of the configuration for rulebase analysis and do any setting checks via simple CLI/API access.