Forum Discussion

Peter_Silva_123's avatar
Peter_Silva_123
Historic F5 Account
Sep 21, 2017

Nessus scanners are not successfully scanning our F5 devices

For LoyalSoldier

Hello,

Would anyone have any insight into why Nessus scanners are not successfully scanning our F5 devices? We've verified that they are logging in, but for some reason are throwing the below error about not having local security checks enabled. We see external scans being done; just not internal. Have tried verifying the credentials and tried different credentials, with full admin rights. Can putty into the devices with same credentials just fine. They are setup with TACACS authentication, which always shows the scanner authenticating. Have also tried taking one device off of TACACS and making it local with a new local account - no difference. Also tried scanning against the management port and ethernet port/self IP (port security checked). SSH Allow checked.

I have done a F5 support case for this already. Verified with logs, etc. that it is authenticating. Thinking it has something to do with the "or some other problem occurred" as mentioned in the error. Just running out of ideas to what that could be. Devices affected include LTMs, GTMs, and an Enterprise Manager.

Thank you!

Nessus Error:

Synopsis
    The local security checks are disabled.
Description
    Local security checks have been disabled for this host because either the credentials supplied in the scan policy did not allow Nessus to log into it or some other problem occurred.
Solution
    Address the problem(s) so that local security checks are enabled.
Nessus Plugin ID
    21745 (hostlevel_check_failed.nasl)
Plugin Output
    Additional failure information from ssh_get_info2.nasl :
    We are able to run commands on the remote host, but are unable to currently identify it in this plugin.
    - SSH was unable to login with any supplied credentials.

1 Reply

  • What "shell"(thinking it may be set to tmos shell and maybe should default to bash) is set for the account that nessus is using to authenticate against the F5 device.