Enable PCI scanning from trusted IP address

[kinmun]

I need to run PCI DSS scanning on my web servers.

how do I enable the scanning IP address to be trusted so that they wont be flagged as intrusion ?

i am using firmware version 5.2.2

Review Scanner IP Addresses The service provides multiple scanners for external (perimeter) scanning. Depending on your network, it may be necessary to add the scanner IPs to your list of trusted IPs, so the service can send probes to your in-scope system components.

[Dave_Hall]

If the scans are directed at the Fortigate itself, may be set up a local-in-policy allowing the IP. 

[kinmun]

the scanning is targeted at our servers with external public ip addresses.

they are scanning the public ip address.

[ehastings]

You can create the address objects representing the IP's they will come from and create a new DoS policy with that as the source, and your VIP's as the destination. Then don't enable any of the DoS sensors. This will basically exclude them from creating alerts. Here is a screen shot showing the setup. Make sure to drag the new DoS policy to the top so it hits first. 

Best Regards,   Eric Hastings, NSE3 | Systems Engineer (South Texas) Fortinet | Fast. Secure. Global.