Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable 部落格

訂閱

4 種改善 Nessus 透過防火牆進行掃描的方法

Establishing the right configurations and settings can improve Nessus scan results when scanning through firewalls.

Of all the factors that can inhibit a successful Nessus scan — busy systems, congested networks, legacy systems, hosts with large amounts of listening services — firewalls (and other types of filtering devices) are one of the major causes of slow or inaccurate scans. Network-based firewalls are essential for an organization’s perimeter protection and internal network segregation, while host-based firewalls are common on both Linux and Windows systems. 

Scanners can sometimes be placed on network segments behind a firewall to avoid these problems, but this may not be feasible in all situations, creating an extra burden when moving a scanner around. This approach is also ineffective against host-based firewalls: Even if you allow the scanner's IP address through the firewall, connection tracking and stateful inspection can interfere with the scan and negatively impact performance on the firewall. 

In a typical modern environment, it’s unlikely that these configurations will be needed. However, organizations often have older equipment or infrastructure lying around which may require modifications to compensate for these types of devices. Or, if you’re required to run a full port scan against your environment for auditing purposes, understanding the potential impact that could occur is key. Read on to learn about multiple strategies you can use to deal with firewalls when using Nessus to perform internal or external vulnerability scans.

Tuning a network scan

The first approach is to configure the number of vulnerability checks to run concurrently for each host. These controls are located under the “Advanced” policy setting in Nessus:

Performance Menu Options - Advanced Policy Settings in Nessus

The default for this setting is 4 or 5, depending on the scan policy used. This is reasonable for most systems; however, systems connected over low-bandwidth links, older systems, or ones with less robust networking stacks may benefit from setting this to 2 or even 1. Note: As with most of the configuration changes detailed in this post, lowering the number of simultaneous checks per host can increase your scan times, sometimes significantly.

Most modern host firewalls are stateful, thus, they keep track of the connections made to them. If Nessus makes too many connections at once, the firewall may become overwhelmed and drop connections, causing the scan to miss open ports and/or vulnerabilities or causing the target to experience issues with other connections. By limiting Nessus to only 1 or 2 checks at a time, we can reduce the number of simultaneous connections per host, as well as the resources on the target taken by responding to the scanner’s queries. 

Other settings, such as the maximum number of concurrent TCP sessions per host or per scan, can help control the number of total sessions created for a given host, which encompasses service detection and vulnerability checks. These can be helpful when extremely fine granularity is required, especially with older network infrastructure. Note: These settings do not directly impact the default SYN port scanner as its TCP session control.

Tuning the port scanner

You can also tune the port scanner to be more sensitive when it encounters a firewall, by adjusting the “Discovery - Port Scanning” setting of the scan policy:

Nessus Scan Policy - Network Port Scanners

It may also be beneficial to review which port scanner your policy is using. While the SYN scanner is the default, and works well in most situations, it can cause connections to be “left open” in the state table of the firewalls you’re scanning through. The TCP scanner will attempt a full 3-way handshake, including closing the connection. This can entail more overall target and network overhead, but can be useful in situations where your network firewall can’t be upgraded or re-configured to support a larger state table or decrease the timeout.

Impact of full port scanning on a network firewall

Some users may need to perform full port scanning for network audit purposes. If the scanning traffic will pass through a network firewall, please make sure you plan carefully and monitor the session and resource utilization of your infrastructure.

For example, if we are assessing 30 hosts simultaneously, the potential half-open sessions that will be generated is 30 times 65,535, or the maximum number of TCP ports on a single host; this equates to 1.96 million sessions. Additionally, some of the network firewalls maintain state on both the ingress and egress interface, resulting in the requirement to maintain 3.9 million sessions in its state table. 

As a mitigation, Tenable recommends configuring the network firewall with a more aggressive timeout for dropping half-open sessions or reducing the number of hosts that are scanned simultaneously. If these are not sufficient, the number of SYN packets sent by the scanner can be controlled by editing the "nessus_syn_scanner.global_throughput.max" configuration in the Nessus scanner advanced settings. Please contact your Tenable representative for additional guidance on scanner placement if this is a requirement.

Configuring a credentialed scan

A Nessus scan with credentials avoids most of the problems encountered with a network scan of a firewall-protected host because it uses local port enumeration versus externally trying thousands of different ports to see what’s open. Local port scanners are enabled by default, and will run as long as Nessus can successfully authenticate to the target.

Nessus Settings - Local Port Enumerators

We also get much more accurate port scan results, as it provides a complete list of open TCP and UDP ports in a fraction of the time. For more information on how to configure credentialed checks for Windows versus Linux, you can visit our Nessus documentation page.

總結

Nessus works great for both unauthenticated network scans and credentialed assessments. Although scanning through firewalls may take longer, tuning your settings can ensure safer, more accurate results. And to further improve accuracy, scanning with credentials is the best way to reduce the load and assess through firewalls.

Lastly, you can explore our enterprise solutions to address this challenge. Within Tenable.io and Tenable.sc, Nessus Agents provides visibility into hard-to-scan endpoints, and Nessus Network Monitor provides a continuous view of managed and unmanaged assets on your network. Tenable.ot is also available for further visibility across operational technology environments.

相關文章

您可以利用的網路安全最新消息

輸入您的電子郵件,就不會錯過來自 Tenable 專家提供的及時警示與安全指引。

Tenable Vulnerability Management

享受現代、雲端型的弱點管理平台,能夠以無與倫比的準確性查看和追蹤所有資產。

Tenable Vulnerability Management trials created everywhere except UAE will also include Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

享受現代、雲端型的弱點管理平台,使您能夠以無與倫比的準確性查看和追蹤所有資產。 立即訂閱一年。

100 項資產

選取您的訂閱選項:

立即購買

Tenable Vulnerability Management

享受現代、雲端型的弱點管理平台,能夠以無與倫比的準確性查看和追蹤所有資產。

Tenable Vulnerability Management trials created everywhere except UAE will also include Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

享受現代、雲端型的弱點管理平台,使您能夠以無與倫比的準確性查看和追蹤所有資產。 立即訂閱一年。

100 項資產

選取您的訂閱選項:

立即購買

Tenable Vulnerability Management

享受現代、雲端型的弱點管理平台,能夠以無與倫比的準確性查看和追蹤所有資產。

Tenable Vulnerability Management trials created everywhere except UAE will also include Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

享受現代、雲端型的弱點管理平台,使您能夠以無與倫比的準確性查看和追蹤所有資產。 立即訂閱一年。

100 項資產

選取您的訂閱選項:

立即購買

試用 Tenable Web App Scanning

享受完整存取我們專為新型應用程式所設計、屬於 Tenable One 曝險管理平台一部分的最新 Web 應用程式掃描產品。不需耗費大量人力或中斷重要 Web 應用程式,即可高度準確且安全地掃描您整個線上產品系列中是否含有任何弱點。 立即註冊。

您的 Tenable Web App Scanning 試用版軟體也包含 Tenable Vulnerability Management 和 Tenable Lumin。

購買 Tenable Web App Scanning

享受現代、雲端型的弱點管理平台,使您能夠以無與倫比的準確性查看和追蹤所有資產。 立即訂閱一年。

5 個 FQDN

$3,578

立即購買

試用 Tenable Lumin

利用 Tenable Lumin 視覺化並探索您的曝險管理、追蹤經過一段時間後風險降低的情形以及與同業進行指標分析。

您的 Tenable Lumin 試用版軟體也包含 Tenable Vulnerability Management 和 Tenable Web App Scanning。

購買 Tenable Lumin

聯絡業務代表,瞭解 Tenable Lumin 如何協助您取得您整個環境的深入解析和管理網路風險。

免費試用 Tenable Nessus Professional

免費試用 7 天

Tenable Nessus 是目前市場上最全方位的弱點掃描器。

最新 - Tenable Nessus Expert
現已上市

Nessus Expert 新增了更多功能,包括外部攻擊破綻掃描和新增網域及掃描雲端基礎架構的能力。按這裡試用 Nessus Expert。

請填妥以下表單以繼續 Nessus Pro 試用。

購買 Tenable Nessus Professional

Tenable Nessus 是目前市場上最全方位的弱點掃描器。Tenable Nessus Professional 可協助將弱點掃描流程自動化,節省您執行合規工作的時間並讓您與 IT 團隊合作。

購買多年期授權,節省更多。新增 365 天全年無休 24 小時全天候可使用電話、社群及對談的進階支援。

選擇您的授權

購買多年期授權,節省更多。

增加支援與訓練

免費試用 Tenable Nessus Expert

免費試用 7 天

Nessus Expert 是專為現代攻擊破綻所打造,它能讓您從 IT 到雲端洞察更多資訊,並保護貴公司免於弱點危害。

您已經有 Tenable Nessus Professional 了嗎?
升級至 Nessus Expert,免費試用 7 天。

購買 Tenable Nessus Expert

Nessus Expert 是專為現代攻擊破綻所打造,它能讓您從 IT 到雲端洞察更多資訊,並保護貴公司免於弱點危害。

選擇您的授權

購買多年期授權省更多!

增加支援與訓練