Whitelist Pentester IP Addresses

[mhrth]

Hi,

My company is currently carrying out external pen testing on our servers and it was found out the nmap scan was blocked by FortiGate UTM. Is it possible to whitelist the IP addresses used by the pen testers? If possible, where should I whitelist those IP addresses?

Thank you.

[xsilver_FTNT]

Hi,

log should show you which firewall policy and rules blocked it.

So you can make temporary policy ABOVE that blocking one (R-click -> Insert empty - Above).

And that new one might have their source IPs and accept their connections.

But shouldn't they test also ability to pass through your firewall? This also looks like social-engineering test to highlight how willing you are to bend the rules if someone asks for it?
:D

[Yurisk]

Also make sure that no DDoS policy is in place, as it is checked before regular security policy , 

https://docs.fortinet.com/document/fortigate/6.2.9/cookbook/771644/dos-protection 

[Debbie_FTNT]

Good point, DoS policies often recognize a port scan and quarantine the originating IP.