Zone protection question

[shirishkulkarni]

Hi Team,

I’d like to add an IP to be exempted from zone protection. Is this possible on the firewall?

How we can achive this please suggest

[Raido_Rattameister]

Do you mean exclusion from reconnaissance protection?

[shirishkulkarni]

During an internal vulnerability scan, we discovered that the scanner detects all ports as open on networks where the firewall is installed.

I suspect this issue is caused by the zone protection feature, specifically the flood protection for SYN packets.

Rather than disabling the protection entirely, can we create an exception that allows the scanner to run scans without restrictions

[Raido_Rattameister]

Are you saying that scan was done from one network zone to another and firewall rules are in between?

Do you have application and service both set correctly?

Let's assume you have following policy to permit incoming email and your email server public IP is 5.5.5.5.

This is very insecure rule because it permits anyone on the internet to perform port scan against your email server (because service is not set).

Initial TCP 3way handshake is permitted through on any port and only after 3way handshake is completed firewall can identify application based on signature to identify if application is actually SMTP or not.

So as a first step look at your traffic logs and check maybe some rule actually permitted scanner traffic through it unintentionally.

[OtakarKlier]

Hello,

You can create a security policy that has the source IP and zone as your scanners and destination zone/IP what you are scanning and just dont apply any Actions. Then you have to throttle the scan so it doesnt trigger your zone protection:

Regards,

[shirishkulkarni]

The core issue is that during a port scan on a device within the LAN, it appears that the firewall, rather than the actual device, is responding. This results in the scanner falsely indicating that all ports on the device are open, leading to incorrect vulnerability reports.

If we create the policy by default, we have to add action as allowed. The problem is firewall is responding and say all ports are open. Do you have any solution on it

[Raido_Rattameister]

What is you SYN Cookie activation rate in Zone Protection profile?

Can security scanner be calmed down to keep new session count (together with existing traffic) below that threshold?