I am cut-pasting a FAQ from the Cisco website on this:
What happens if an end user has installed a personal firewall that blocks the network scanning?
This is configurable by the end user, who can either open a port to allow scanning, disable the firewall, or keep it enabled. If the firewall remains enabled, scanning will time out. The administrator can configure what actions to take with timeouts, such as informing the end user about network policy.
http://www.cisco.com/en/US/products/ps6128/products_qanda_item0900aecd802da200.shtml