Vulnerability Assessments and Firewalls – Why an Agent-based Approach is Best

Morey Haber, Chief Technology Officer
May 24th, 2018

The security purpose of a firewall is to block or redirect unwanted network traffic by port, application, and source and destination. Regardless of any vendor’s marketing that the perimeter of your network is dissolving, a firewall is still your first line of defense from malicious Internet traffic and a threat actor’s toolkits. Whether the firewall is external or internal, it can pose a serious problem for network vulnerability assessment scanners and solutions used for asset discovery. A network scanner needs a clear line of electronic communications from the scanner itself to a target and should be able to assess every port on the target unrestricted. Typically, information technology administrators will whitelist a scanner through the firewall to achieve this goal, but there are other inherent problems with scanning through a firewall that team members are habitually not aware of. I’ve listed them below.

Total TCP Session Limitations

Most firewalls have a limit of around 64,000 or 256,000 concurrent TCP connections. For an all-ports and all-audits scan, a single target can exhaust all the resources on the firewall by attempting to open all 65,535 concurrently. This will cause a denial of service or outage on the firewall itself. On older devices, it has been known to cause the firewall to reboot spontaneously.

Raw Packet Discards

Firewalls are designed to accept traffic via rules and pass them through to the proper destination. This can involve Network Address Translation (NAT) or simple IP forwarding. If the packet is malformed and does not adhere to RFC specifications, it will likely be discarded. That is a problem. Most vulnerability assessment solutions generate raw malformed packets and review the results from the target to determine whether or not a vulnerability is present. While this is typically used as a part of a null session scan to determine if a network-based vulnerability is present and may or may not contain portions of exploit code, the malformed packet would be dropped by the firewall and the vulnerability not detected due to the lack of results.

Never Perform a Vulnerability Assessment Through a Firewall – or Use an Agent

It is, therefore, a best-practice recommendation to never perform a vulnerability assessment through a firewall unless you absolutely need to, or use vulnerability assessment agent technology on the hosts themselves to avoid this problem. Many times, you may not even be aware that it is impacting your assessments and potentially will give you a false sense of security. If you need help with doing a proper vulnerability assessment, contact BeyondTrust. Our Retina Enterprise Vulnerability Management solution can be architected with agents and remote scanners to overcome firewall problems and provide accurate results for a vulnerability assessment. Contact us today for a brief one-on-one demo.


Morey Haber, Chief Technology Officer

With more than 20 years of IT industry experience and author of Privileged Attack Vectors, Mr. Haber joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition. He currently oversees BeyondTrust technology for both vulnerability and privileged access management solutions. In 2004, Mr. Haber joined eEye as the Director of Security Engineering and was responsible for strategic business discussions and vulnerability management architectures in Fortune 500 clients. Prior to eEye, he was a Development Manager for Computer Associates, Inc. (CA), responsible for new product beta cycles and named customer accounts. Mr. Haber began his career as a Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelors of Science in Electrical Engineering from the State University of New York at Stony Brook.