How To Permit Campus Vulnerability Scanners Access To Your Systems

A knowledge base article about How To Permit Campus Vulnerability Scanners Access To Your Systems provided by the UC Berkeley IT Service Hub - Knowledge Portal

Table of Contents

Overview

Below are the steps necessary to use the shared Address Group (ucbsec-vuln_scanners) that represents the campus vulnerability scanners managed by the Information Security Office (ISO). Using this object to allow vulnerability scanning against your systems is heavily encouraged for all users.

Policy Note: For vsys registered as containing restricted data and located in the ewdc-high-security or campus-high-security device groups, allowing the vulnerability scanners is required by policy. This is already enforced by an inherited rule in Panorama; users in these groups do not need to manually add the rule outlined below.

NOTE: If any of your systems contain restricted data and are not registered or are not in one of the high-security device groups, please contact security@berkeley.edu for assistance.

Steps to Add the Allow Rule in Panorama

  1. Log into https://panorama.net.berkeley.edu using single sign-on.
  2. From the tabs at the top of the window, choose Policies.
  3. Under Security in the left pane, choose Pre Rules.
  4. Click Add at the bottom of the window to open the "Security Policy Rule" window.
    Screenshot showing the Add button at the bottom of the Security Policy window
  5. In the General tab, provide an appropriate name, such as Allow Vulnerability Scanners.
    Screenshot of the General tab in Panorama where the rule name is entered
  6. On the Source tab, click the Any box above "Source Zone" and then click Add below the "Source Address" column.
  7. In the drop-down list for "Source Address," choose ucbsec-vuln_scanners.
    Screenshot showing the selection of ucbsec-vuln_scanners as the source address
  8. On the Destination tab, select the appropriate Zone and Destinations. We recommend setting the Zone drop-down box to any and the Destination Address to any so all systems can be scanned.
    Screenshot of the Destination tab with Zone and Address set to Any
  9. On the Actions tab, set the Profile Type to None. This prevents advanced security features from blocking the scanners and causing incorrect results.
    Screenshot of the Actions tab with Profile Type set to None
  10. Click OK to return to your rules list.
  11. Find your new Allow Vulnerability Scanners rule and click it to highlight it.
  12. At the bottom of the screen, select Move to Top from the Move menu. This ensures other blocking rules do not supersede this policy.
    Screenshot of the Move menu highlighting the Move to Top option

Commit and Push Changes

  1. From the Commit menu near the top of the screen, choose Commit to Panorama.
  2. Once finished, select Push to Device from the same menu.
    Screenshot of the Commit and Push to Device options in Panorama