The security purpose of a firewall is to block or redirect unwanted network traffic by port, application, and source and destination. Regardless of any vendor’s marketing that the perimeter of your network is dissolving, a firewall is still your first line of defense from malicious Internet traffic and a threat actor’s toolkits. Whether the firewall is external or internal, it can pose a serious problem for network vulnerability assessment scanners and solutions used for asset discovery. A network scanner needs a clear line of electronic communications from the scanner itself to a target and should be able to assess every port on the target unrestricted. Typically, information technology administrators will allow list a scanner through the firewall to achieve this goal, but there are other inherent problems with scanning through a firewall that team members are habitually not aware of. I’ve listed them below.
Total TCP Session Limitations
Most firewalls have a limit of around 64,000 or 256,000 concurrent TCP connections. For an all-ports and all-audits scan, a single target can exhaust all the resources on the firewall by attempting to open all 65,535 concurrently. This will cause a denial of service or outage on the firewall itself. On older devices, it has been known to cause the firewall to reboot spontaneously.
Raw Packet Discards
Firewalls are designed to accept traffic via rules and pass them through to the proper destination. This can involve Network Address Translation (NAT) or simple IP forwarding. If the packet is malformed and does not adhere to RFC specifications, it will likely be discarded. That is a problem. Most vulnerability assessment solutions generate raw malformed packets and review the results from the target to determine whether or not a vulnerability is present. While this is typically used as a part of a null session scan to determine if a network-based vulnerability is present and may or may not contain portions of exploit code, the malformed packet would be dropped by the firewall and the vulnerability not detected due to the lack of results.
Never Perform a Vulnerability Assessment Through a Firewall – or Use an Agent
It is, therefore, a best-practice recommendation to never perform a vulnerability assessment through a firewall unless you absolutely need to, or use vulnerability assessment agent technology on the hosts themselves to avoid this problem. Many times, you may not even be aware that it is impacting your assessments and potentially will give you a false sense of security. If you need help with doing a proper vulnerability assessment, contact BeyondTrust. Our Retina Enterprise Vulnerability Management solution can be architected with agents and remote scanners to overcome firewall problems and provide accurate results for a vulnerability assessment. Contact us today for a brief one-on-one demo.
Morey J. Haber, Chief Security Officer, BeyondTrust
Morey J. Haber is the Chief Security Officer at BeyondTrust. He has more than 25 years of IT industry experience and has authored four books: Privileged Attack Vectors, Asset Attack Vectors, Identity Attack Vectors, and Cloud Attack Vectors. He is a founding member of the industry group Transparency in Cyber, and in 2020 was elected to the Identity Defined Security Alliance (IDSA) Executive Advisory Board. Morey currently oversees BeyondTrust security and governance for corporate and cloud based solutions and regularly consults for global periodicals and media. He originally joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition where he served as a Product Owner and Solutions Engineer since 2004. Prior to eEye, he was Beta Development Manager for Computer Associates, Inc. He began his career as Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelor of Science degree in Electrical Engineering from the State University of New York at Stony Brook.
