Vulnerability Scanning in subnets

For those of you who work in Vulnerability Management. How much of a pain, if at all, is setting up a virtual scanner and corresponding segmentation firewall policy to run the scanner effectively?

Would it not be easier if the scanner were embedded in the firewall? Are there any pitfalls in doing so?

cybersecurity doing easier effectively embedded firewall management policy run scanner scanning segmentation virtual vulnerability vulnerability management vulnerability scanning work