Need Help Whitelisting VM Scanning

[kyle.brearley]

I have internal Qualys vulnerability scans which target systems inside my web DMZ.  Once my AMP 8150 IPS devices see the traffic it appears to be coming from a x-forwarded IP address on our load balancers.  Two things I can see when I analyze the packets on the IPS are:

1. You can see the 'X-Forwarded-For' IP address is in fact the IP address of the Qualys scanner. 

2. We append the text into the packets: 'Qualys-Scan: VM'

What are my options for not generating intrusion events for this traffic?  My hope was to look at the 'X-Forwarded-For' address and whitelist based on that, but it seems like that may not be possible on the Sourcefire platform(?).  Any ideas? 

Thanks in advance

[Ed Padilla Jr]

Yes. On your Access Control Policy, create a rule to "Trust" that traffic Source and/or destination.  Make sure you enable logging so that can search or validate has been Trust (do not inspect).