When deploying Nessus, knowledge of routing, filters, and firewall policies is often helpful. Deploying behind a NAT device is not desirable unless it is scanning the internal network. Any time a vulnerability scan flows through a NAT device or application proxy of some sort, the check can be distorted and a false positive or negative can result.
In addition, if the system running Nessus has personal or desktop firewalls in place, these tools can drastically limit the effectiveness of a remote vulnerability scan. Host-based firewalls can interfere with network vulnerability scanning. Depending on your firewall’s configuration, it may prevent, distort, or hide the probes of a Nessus scan.
Certain network devices that perform stateful inspection, such as firewalls, load balancers, and Intrusion Detection/Prevention Systems, may react negatively when a scan is conducted through them. Nessus has a number of tuning options that can help reduce the impact of scanning through such devices, but the best method to avoid the problems inherent in scanning through such network devices is to perform a credentialed scan.
If you configure Nessus Manager for agent management, Tenable does not recommend using Nessus Manager as a local scanner. For example, do not configure Tenable.sc scan zones to include Nessus Manager and avoid running network-based scans directly from Nessus Manager. These configurations can negatively impact agent scan performance.
This section contains the following deployment considerations: