Whitelist Vendor IP range from Paloalto IPS

[mnadeem]

Hi All, I am looking for more effective way to whitelist a vendor on IPS without whitelisting at the FW as well.

I am looking for traffic from vendore ip range to be completely exempted from Vulnerability / antivirus / Anti-spyware without creating any firewall rule and security profile.

Is it possible ?

[OtakarKlier]

Hello,

Not without other potential complications, but a Policy is the best approach. Create a policy with the vendor IP's as the source and then do not perform any scanning on it. 

Its simple and effectve. It's how I allow these actions.

Regards,

[mhowsmon]

We have a scheduled security scan coming up and I need to perform this step as well. However I do not want to introduce openings to the scanner that are not open to the Internet. If I were to use this method, I believe I would have to mirror each policy with the source IP of scanner and have same destination rules / ports and not do scanning. Does that sound right?

[Kris.Waddle]

I've had this same question.  Building several shadow rules to exempt an ASV from IPS only is not a road I want to start down.  Allowing a separation between IPS and Host/Port would be 100% Helpful.   

[OtakarKlier]

Hello,

Sorry for the late response, but the answer is no, you would not need a shadow policy for every one you have. Just one before the others that has source of the vendor, destination, your IPs, and the rest allow any/any. This will only open the firewall to the vendors. We do this but internally, datacenter A scans data center B it doesnt report on every port and application because a full tcp handshake was not established. 

Example:

Internet -> PAN -> webserver over ssl/443 only.

The scanner will not pick up port 80 since its not open on the server. Just make sure they disable syn only packets for a full connection.

Hope that makes sense.