Tenable Scan on Palo Alto firewall / Panorama

[Ben-Price]

Hi All,

Are Tenable vulnerability scans (see below) on Palo Alto firewalls / Panorama resource intensive for the PA devices? Does this cause high DP or MP issues?

https://community.tenable.com/s/article/How-to-perform-a-compliance-scan-on-a-Palo-Alto-Firewall

Thanks in advance.

[Ben-Price]

@BPry @kiwi @S.Cantwell Has anyone had any experience with this?

[kiwi]

Hi @Ben-Price ,

I have no experience with Tenable vulnerability scans but I'm pretty sure it depends on how you configure the scanning options.

I'm guessing that just a simple compliance check shouldn't be too bad ... that said, some scan plugins can cause a denial of service.

Cheers,

-Kiwi.

[OtakarKlier]

Hello,

I have never had an issue where a tenable scan caused issues with PAN operation or resource limits.

Regards,

[BPry]

@Ben-Price,

Same as @OtakarKlier, I've never had a Tenable scan cause any issues with operations. I've never done a configuration scan with Tenable however, and from your linked article that is what you are setting up in this instance? If that's the case, I wouldn't expect the scan to really cause any issues. It'll likely just pull a copy of the configuration for rulebase analysis and do any setting checks via simple CLI/API access. 

[Ben-Price]

@BPry @OtakarKlier @kiwi Thanks for your feedback here. 

I will clarify with the customer exactly which scan they are planning on using.

[Adrian_Jensen]

 I have been dealing with Tenable and Forescout scans from our Infosec team and they have been rather brutal on a PA 3020, not so much in scanning the PA itself, but scanning through the PA to other networks (Trust to DMZ/VPN/etc.). The Tenable servers tend to generate thousands of connections per second (seeing 20k+ cps with 3-4 scanning servers) which hammers the DP CPU.