Need Help Whitelisting VM Scanning

kyle.brearley — Sun, 10 Mar 2019 13:38:11 GMT

I have internal Qualys vulnerability scans which target systems inside my web DMZ. Once my AMP 8150 IPS devices see the traffic it appears to be coming from a x-forwarded IP address on our load balancers. Two things I can see when I analyze the packets on the IPS are:

1. You can see the 'X-Forwarded-For' IP address is in fact the IP address of the Qualys scanner.

2. We append the text into the packets: 'Qualys-Scan: VM'

What are my options for not generating intrusion events for this traffic? My hope was to look at the 'X-Forwarded-For' address and whitelist based on that, but it seems like that may not be possible on the Sourcefire platform(?). Any ideas?

Thanks in advance

Yes. On your Access Control

Ed Padilla Jr — Thu, 30 Jun 2016 20:29:15 GMT

Yes. On your Access Control Policy, create a rule to "Trust" that traffic Source and/or destination. Make sure you enable logging so that can search or validate has been Trust (do not inspect).

topic Yes. On your Access Control in Network Security

Need Help Whitelisting VM Scanning

Yes. On your Access Control