Restrict scanning to a specific subnet
2 posts
We are evaluating SoftPerfect Network Scanner for use by a third-party AV support provider on a dedicated support VM. We need to restrict the software so that it can only scan our AV subnet (10.80.91.0/24) and cannot scan any other internal subnets.
We have tested the "Ignored IP Addresses" feature and can successfully exclude specific subnets from being scanned. Is there a supported way to either restrict scanning to a single subnet, permanently exclude all other subnets, or lock these settings so they cannot be modified by the user? We are looking for the best way to enforce this within the application itself.
No, there isn't a supported way to enforce that from within the application. Network Scanner is an administrator's tool, built on the assumption that whoever runs it is trusted to decide what to scan. The IP range is free-form input, and the Ignored IP Addresses list is an ordinary user setting stored alongside the rest of the configuration. You can pre-deploy a configuration with the 10.80.91.0/24 range and your exclusions already filled in, which gives the provider the right defaults, but there is no lock or policy mode behind it. Anyone using the application can edit the list or type in a different range. Making the configuration file read-only doesn't change that, because the settings can still be altered for the running session.
Therefore, you shouldn't rely on the application as the control here. The dependable way to do this is at the network level: restrict the support VM with a firewall rule or an ACL on its VLAN so that it can only reach 10.80.91.0/24. Then it will hold no matter what is entered in the Network Scanner, and will also cover every other tool the provider might run on that VM, which an in-app restriction never could.
With that in place, a pre-configured range and ignore list are still worth having as a convenience, so the provider opens the application and sees only what they are meant to work with.