Views:

Learn about known scanning behavior and limitations for F5 BIG-IP devices in the Network Vulnerability Scanner service.

F5 BIG-IP scanning carries the following support limitations. Take note of potential scanning issues and ensure your devices are configured appropriately before scanning.

Duplicate scan entries

If you scan the same F5 BIG-IP device using both SSH and SNMP authentication methods, the device may appear as two separate entries in scan results. This occurs because SSH retrieves the hostname from the TMOS layer, while SNMP retrieves the hostname from the underlying OS layer. These hostnames can differ if not synchronized.
Note
Note
The hostname shown in scan results reflects the OS-layer configuration only, which may differ from any hostname or device name configured at the application layer. This is expected behavior, not a scan error.
To prevent duplicate entries, synchronize the TMOS and OS-layer hostnames by running the following commands on the F5 BIG-IP device. Replace <hostname> with the TMOS hostname returned by the command list sys global-settings hostname:
run /util bash -c "echo <hostname> > /proc/sys/kernel/hostname"
run /util bash -c "sed -i 's/HOSTNAME=.*/HOSTNAME=<hostname>/' /etc/sysconfig/network"
run /util bash -c "bigstart restart snmpd"

Vulnerability detection and module support

Network Vulnerability Scanner detects vulnerabilities for each provisioned F5 BIG-IP module individually. The following modules are supported for per-module vulnerability detection:
  • ltm
  • apm
  • afm
  • asm
  • cgnat
  • gtm
  • sslo
  • pem
  • lc
  • avr
  • fps
Only modules set to a provisioning level of nominal, dedicated, minimum, or custom are included in the scan. Modules set to none are excluded.