Stormshield SNS (API) connector
The Stormshield SNS (API) connector adds a Stormshield Network Security firewall as an asset, by querying the API of its administration interface. It requires neither SNMP, nor script execution, nor agent installation.
It retrieves:
- the SNS firmware version, used to compute vulnerabilities;
- the name of the firewall.
The firewall is reported with the same system and the same version as with the SNMP scan, and therefore with the same vulnerabilities. The connector only runs two read commands, SYSTEM PROPERTY and SYSTEM IDENT, and closes its administration session at the end of each scan.
Unlike the SNMP scan, it reports neither the IP addresses of the interfaces, nor the listening ports, nor metadata.
Prerequisites
Creating agentless connections of type Stormshield SNS requires enabling this type of connection from the menu Administration > Connectors management.
The Cyberwatch scanner must reach the HTTPS administration interface of the firewall.
Prepare the firewall
- In the administration interface of the firewall, create an administrator dedicated to Cyberwatch.
- Give it read-only rights: the two commands of the connector are available to any administrator.
- If access to the administration interface is restricted to some hosts, add the address of the Cyberwatch scanner.
Configure the credentials
You may configure your credentials from the Stored credentials menu of the sidebar, then click on the Add button. In the form, select the type Stormshield SNS, then fill in:
- Username and Password: those of the administrator created for Cyberwatch;
- URL: optional, it is only used by the Stormshield SNS discovery;
- Client certificate: leave it empty, the connector authenticates with a username and a password;
- Disable certificate verification: check it if the certificate of the firewall is not signed by a recognized authority;
- Ignore proxy: check it if the scanner reaches the firewall without going through the proxy configured in Cyberwatch.
The same credential set can be used for several firewalls administered with the same account. The credential set can also be created from the form of the connection: it then asks for neither URL nor certificate.
The credentials are sent to the firewall designated by the address of the connection. A user who can create an agentless connection with this credential set can therefore send them to the address of their choice, like an SSH or WinRM credential set. Disabling certificate verification also gives up authenticating the firewall.
Add the firewall
In Cyberwatch, under the Assets section:
- Go to the Assets menu and click on Agentless connections
- Select the Stormshield SNS access protocol
- In the Address field, enter the IP address or the name of the firewall
- In the Port field, enter the port of the HTTPS administration interface (443 by default)
- Select the Stormshield SNS credential set, or create one
- Click on Save
Cyberwatch always calls the firewall at the address and on the port of the connection, whatever the URL of the credential set.
The Stormshield SNS discovery lists the host objects of the firewall configuration, not the firewall itself: the firewall is added with a connection.
Reported information
| Information | Value |
|---|---|
| System | Stormshield |
| Firmware | SNS version, for example 4.7.1, under the CPE cpe:2.3:o:stormshield:stormshield_network_security |
| Hostname | Name of the firewall, otherwise the address of the connection |
As with the SNMP scan of network devices, the scan runs every two days by default.
Troubleshooting
When a scan fails, the asset keeps the firmware of the previous scan.
| Error | Probable cause |
|---|---|
| Authentication failure message from the firewall | Username or password rejected, or account locked |
| Session opening refused | Maximum number of administration sessions reached on the firewall |
| Certificate error | Certificate not signed by a recognized authority: check Disable certificate verification in the credential set |
| Timeout | Firewall unreachable from the scanner: check the flows and the hosts allowed to administer it. The connector gives up after 10 seconds to open the connection, and 30 seconds per request. |
Unexpected response from the firewall | The port of the connection is not the one of the administration interface, or another server, such as a proxy, responds instead of the firewall |
SYSTEM PROPERTY returned no Version | The firewall did not give its version |