Vulnerability Assessments and Firewalls – Why an Agent-based Approach is Best

The security purpose of a firewall is to block or redirect unwanted network traffic by port, application, and source and destination. Regardless of any vendor’s marketing that the perimeter of your network is dissolving, a firewall is still your first line of defense from malicious Internet traffic and a threat actor’s toolkits. Whether the firewall is external or internal, it can pose a serious problem for network vulnerability assessment scanners and solutions used for asset discovery. A network scanner needs a clear line of electronic communications from the scanner itself to a target and should be able to assess every port on the target unrestricted. Typically, information technology administrators will allow list a scanner through the firewall to achieve this goal, but there are other inherent problems with scanning through a firewall that team members are habitually not aware of. I’ve listed them below.

Total TCP Session Limitations

Most firewalls have a limit of around 64,000 or 256,000 concurrent TCP connections. For an all-ports and all-audits scan, a single target can exhaust all the resources on the firewall by attempting to open all 65,535 concurrently. This will cause a denial of service or outage on the firewall itself. On older devices, it has been known to cause the firewall to reboot spontaneously.

Raw Packet Discards

Firewalls are designed to accept traffic via rules and pass them through to the proper destination. This can involve Network Address Translation (NAT) or simple IP forwarding. If the packet is malformed and does not adhere to RFC specifications, it will likely be discarded. That is a problem. Most vulnerability assessment solutions generate raw malformed packets and review the results from the target to determine whether or not a vulnerability is present. While this is typically used as a part of a null session scan to determine if a network-based vulnerability is present and may or may not contain portions of exploit code, the malformed packet would be dropped by the firewall and the vulnerability not detected due to the lack of results.

Never Perform a Vulnerability Assessment Through a Firewall – or Use an Agent

It is, therefore, a best-practice recommendation to never perform a vulnerability assessment through a firewall unless you absolutely need to, or use vulnerability assessment agent technology on the hosts themselves to avoid this problem. Many times, you may not even be aware that it is impacting your assessments and potentially will give you a false sense of security. If you need help with doing a proper vulnerability assessment, contact BeyondTrust. Our Retina Enterprise Vulnerability Management solution can be architected with agents and remote scanners to overcome firewall problems and provide accurate results for a vulnerability assessment. Contact us today for a brief one-on-one demo.