Skip to main content

How to set up Internal Vulnerability Scanning

All the steps you need to set up an internal scan engine and run Vulnerability Scans on your local network.

Written by Daniel Sampson

Before you get started

System Requirements

For us to scan IP addresses within your local network or behind a firewall, you'll need to set up a Virtual Machine (VM) within your environment and install our Scan Engine. The specifications for this VM are below:

Operating System

Windows 8.1 (and above) / Windows Server 2012 (and above) / Ubuntu 16.04 LTS (and above) / CentOS 7 (and above) / Red Hat Enterprise Linux Server 6 and above

CPU Cores

Minimum: 4

RAM

Minimum: 16GB

Storage

Minimum: 200GB

Firewall rules

There are two separate firewall actions required before your scan engine can connect. Both must be completed, or pairing will fail.

Step 1: Send us your VM's public IP address

Once your VM is created, make sure it has internet access and then share its public IP address via the chat in the bottom right-hand corner of the Defense.com website. If you're unsure of your VM's public IP, you can discover this using the command curl ifconfig.co. We will then whitelist this IP address on our end, allowing your scan engine to communicate with us.

Step 2: Whitelist our scan console on your own firewall

You must also add a bi-directional rule on your organisation's firewall to allow traffic to our scan console:

  • Address: scanner.defense.com

  • Port: TCP 40815

  • Direction: Bi-directional (both inbound and outbound)

If this rule isn't added, the scan engine installer will fail to pair with our platform later in this guide - even after we've whitelisted your IP on our end.

Installer and Shared Secret

Next, use the links below to download the Scan Engine installer:

Windows Installer

Linux Installer

Before you proceed with the installation, please contact us to get your Shared Secret. This is a code that is used to authenticate your scan engine with our platform.

⚠️ Important ⚠️ Your shared secret is only valid for 60 minutes. Once provided, please proceed with the installation as soon as possible. If it expires, you will need to get back in touch with us to request a new shared Secret.

Installation

Once you have your Shared Secret, if your VM is running Windows, double-click on the installer file to start the installer.

If you're on Linux, open a terminal and change your working directory to the directory where you downloaded the file (e.g. "cd /home/username/Downloads"), then run the commands below to make the installer file executable and run it:

chmod +x ./Rapid7Setup-Linux64.bin

sudo ./Rapid7Setup-Linux64.bin

Once run, the installer will start and if you're using Windows, you'll be prompted to provide admin access to the installer. Please click Yes at this stage.

The Wizard will then open, and you'll be shown a Welcome screen with some information about the product. Click Next.

The wizard won't appear if you're using command line to access your VM, but the steps are still the same.

You may then receive a warning from the Windows Firewall. Please make sure that Private networks at least is selected, then click Allow access.

Next, you'll be asked to Select components and an installation path. Please select the Scan Engine only option, then make sure the Communication Direction is set to Engine to Console. The Destination Directory can be left as the default. Once entered, click Next.

Next, the installer will check your Installation requirements. It may warn you that the "update server could not be accessed", but don't worry about this as we can update the software remotely once it's paired with our platform. As long as this is the only warning, click Next to proceed.

You'll then be asked if you'd like to Pair your Scan Engine to the Insight Platform. This is different from pairing the engine to our console, so please do not select this option. Click Next to continue.

Next, you'll be asked for some Account Information. This will be used to generate certificates to secure the connection between the engine and our platform. Please fill in your details at this stage. There's no need to worry too much about these details, as it's not overly important whose details are entered.

Next, you'll be asked to select a location in your Start Menu for shortcuts. The default is fine here, so just click Next if you're unsure.

The next page gives you an overview of what you've already selected. If you're happy, click Next to proceed with the installation.

The installer will run for a little while, you'll then be taken to the Console details screen, where you pair your scan engine with our platform.

  • The Console Address is scanner.defense.com

  • The Console TCP Port is 40815

  • Paste in the Shared Secret we provided you with. If you don't have this, please contact us.

Once these details have been entered, click Test to make sure you can reach our platform. If not, please ensure that your firewall is allowing outbound connections to scanner.defense.com on TCP port 40815.

Once the test is successful, click Next to continue. Your engine has now been installed and will attempt to pair with scanner.defense.com (this will take some time).

After 15 minutes, contact us and ask us to check if your scan engine has been paired (as you won't be able to see this yourself). Once that's confirmed, please provide us with a list of internal IP addresses you'd like to scan, and we can configure a scan group to use your new scan engine.
​
That's it! You've successfully configured internal vulnerability scanning. 🎉

Did this answer your question?