Failed trustwave scan

Product Discussion Other Products
1

Hi,

I ran a Trustwave ASC scan on one of my routers and failed the test.
The frist time accound I failed on some Ports with UDP that needed to be closed. On the 2nd test this report came back.

I have remote admin access enabled (not using incontroll) using HTTPS with a strong username and password combo. Is this the cause for the failed “Remote Access Test” ?

Further we are have enabled the VPN with L2TP / IPsec.
Is the fail based on a limitation of this Peplink Balance One or is there stomething I can improve?

Looking forward to your input.

Rogier

Here is a link to the redacted scan report:

1035×800 91.2 KB

2

Hello ScooterIT,

Please review this PCI Compliance Guide that has been put together for Peplink devices:

We do use a default cert that you will need to update. This can be done from Network > Misc. Settings > Certificate Manager.

When using L2TP ports 500, 1701, and 4500 are expected to be open.

1 Like
3

Thanks, do you have some more guidance on the certificates?

4

Today I scanned my home network and the first results were horrific. I thought I could trust the firewall and security settings on my Synology NAS but obviously not.

I remove the entire NAS and Remote access from the network. Broke it down to almost nothing.
Stil the scann finds these vulneratbilities. This network doesn’t have to be PCI compliant but I rather pass all the test.

Since I have no idea to wat settings most of these failures relate to I look forward to your advice.

1035×800 92.9 KB

1035×800 99.1 KB

5

@ScooterIT,

The scan reports is too generic for us to comment.

  1. May i know how you perform the scanning ? Scan direct LAN interface IP for the Balance One ?

  2. What is the firmware running for your Balance One device ?

  3. Do you scan by IP address or domain name ?

  4. For Scan result 2: Certificate Not Trusted - This can be resolve by import your own certificate. Default certificate is self signed cert.

1 Like
6

Hi Sitlongs,

Thank you for your quick reply :slight_smile:

  1. Trustwave appears to be scanning the WAN IP address and is looking for open ports and known vulnerablilities.
  2. Firmware is 7.1.0 (no updates available)
  3. It’s scanning the IP adres (no DDNS service enabled)
  4. Need to learn more about importing the SSL cert (can I apply for one with the same URL as my domain name and use it on the router?)

Thanks!

Rogier

7

@ScooterIT

You can import the cert via certificate manager.

image
image890×597 34.3 KB

For others fail criteria, do you have more info to share ? This is only report that you have ?

1 Like
8

Yes this is the only report.

I was able to turn all warnings off by going trough my routersetp with a fine comb and select eveery “?” and turned off whatever was turned on.
Finally I received a new report with one failure mentioning “serivce not found” but I consider that as a good thing.

Now the challenge is to start enabling certain features again one at the time and see witch one causes an error.

As for SSL certs I will search this forum on more advice.
I kind of know what they are but don’t want’ to mess up any other serivices out there if I buy a SSL cert for my domain and start applying them on my router and server…

New terrain for me and no one to help me other then “manuals” and forums…

9

We have a client with a Balance One that has FW 7.0.2 that is failing Trustwave scan with the same failures as ScooterIT’s first post. We may have resolved the first two failures by disabling WAN management as the scan is against the WAN port. The 2nd two I’m having trouble resolving. The client isn’t using any site-to-site VPNs (PepVPN or IPsec VPN) but they are using L2TP remote user VPNs. I’ve seen a lot of forum posts about disabling TLS 1.0 to resolve the Trustwave VPN failures but it was all related to PepVPN. I’m not sure what to do next?

10

Hi TrinDH,

Sorry, I can’t give you any specific answer about what worked for me. What I did was to go through all the settings under the Network tab and click every “?” to access additional and advanced settings.

For sure you need to disable the remote admin access and UPnP / NAT-PMP in the Port forwarding section!

Good luck!

Rogier

1 Like
11

Update, the evening after I sent this the client suffered a lighting strike and I had to replace their Balance One Core with a new one. I updated the FW to 7.1.0 and pushed the backed up config (thank goodness I had that!). After this they re-ran the test and it passed? No other changes since I sent the message. The only difference was the other router had 7.0.2 and the new one has 7.1.0. I did see in the release notes that 7.1.0 added some Diffie–Hellman groups. I hope this helps!

1 Like