Tenable Scan on Palo Alto firewall / Panorama

[Ben-Price]

Hi All,

Are Tenable vulnerability scans (see below) on Palo Alto firewalls / Panorama resource intensive for the PA devices? Does this cause high DP or MP issues?

https://community.tenable.com/s/article/How-to-perform-a-compliance-scan-on-a-Palo-Alto-Firewall

Thanks in advance.

[Ben-Price]

@BPry @OtakarKlier @kiwi Thanks for your feedback here. 

I will clarify with the customer exactly which scan they are planning on using.

[Adrian_Jensen]

 I have been dealing with Tenable and Forescout scans from our Infosec team and they have been rather brutal on a PA 3020, not so much in scanning the PA itself, but scanning through the PA to other networks (Trust to DMZ/VPN/etc.). The Tenable servers tend to generate thousands of connections per second (seeing 20k+ cps with 3-4 scanning servers) which hammers the DP CPU.