How to allow Tenable Nessus Cloud scanner scans through the FortiGate

[paul_woods]

Hello,

we need to do Nessus scans from the Tenable Nessus cloud scanners through our FortiGate firewalls to a list of externally available servers and services to ensure that they are patched/updated for several compliance regimes.

When a scan occurs we get the attached messages in the FortiGate logs.

how do we allow the tenable cloud scanner ip ranges to be allowed to get past the intrusion detection system and through the FortiGate firewall?

Thanks,

Paul

[kurtli_FTNT]

Hi Paul,

    You can bypass nessus scanning by adding an exempt-IP.  

Cli:

config IPS sensor

    ed default

        config entries

          ed 0

                 set rule xxx    e.g. 29844 for eicar 

                 config exempt-ip

                     you can set either src-ip or dest-ip here.

end

thanks

[paul_woods]

Thanks,

do I need to add exempt-ip entries for every rule or just once and that would cover all the rules?

Thanks,

Paul

[ShawnZA]

One entry per IPS sensor, if you use the same IPS sensor for all rules then only one change needed