Scanning a DMZ through a firewall

Question

We've recently installed ipMonitor and are currently running 9.0.1.  I've been able to scan internal networks fine and have also added selected IP addresses/services in the DMZ, but I'm not able to do a full scan of the DMZ.  When I specify the DMZ's IP address range, ipMonitor correctly identifies the IP addresses of the servers in the DMZ but when it attempts to scan each device it stops after a short while and displays "Scanning failed" in the State column.

The firewall has a rule to allow the ipMonitor host to access the DMZ using any service.  I've checked the firewall's log and its not saying that it is blocking ipMonitor.  I've run up Wireshark on the ipMonitor host and it shows that the initial IP address discovery seems to be working okay between ipMonitor and one of the DMZ servers (ICMP echo request and reply, attempt to connect to lansurveyor port followed by an ICMP port unreachable response, SNMP v1 and v2c get-request of various 1.3.6.1.2.1.1 values, no response presumably because SNMP is not configured on the DMZ server, NBNS query and response).  However when ipMonitor moves onto the shortlived monitor scan, Wireshark shows absolutely no network activity between ipMonitor and the DMZ server.

I've also looked through ipMonitor's logs but there's nothing to indicate why the device scans are failing.

Can anyone please help with this?

Thanks - Simon

simonpt · Answer

Hi Peter

I'll check that out and see if DNS is to blame.

Thanks for all your excellent help,

Regards, Simon

Peter.Cooper · Answer

Hi Simon, Under the hood, it's the same stuff. I'm going to stretch and suggest maybe an invalid reverse DNS entry got picked up through the discovery pass (where possible we'll try using DNS names to configure new Monitors so the cost to maintain your installation is less over time).

simonpt · Answer

Hi Peter

I tried your suggestion of deleting the previously scanned server and adding it as a new device using it's IP address.  This worked fine and offered up a bunch of monitors to add (ping, pop3, smtp, ftp, http).

Do you have any idea why ipMonitor will scan one way but not the other?

Thanks - Simon