I'm using an external WAF (Cloudflare). My server firewall is setup to only allow connections from the WAF.
Currently, I'm using McAfee Secure for the PCI compliance external vulnerability scan. Due to my firewall, the scan did not detect any open ports. McAfee Secure insists that I whitelist their IP so that they can bypass both my firewall and WAF.
Is it normal for a PCI compliance external vulnerability scan ASV to ask you to whitelist their ip and allow them to bypass both your firewall and WAF for an external scan? This seems odd to me.