My organisation has 200+ websites each with an assigned IP address, these IP addresses evaluate to a pair of load balancers. Behind these are a firewall and then 8 application servers behind this, all identically configured, same OS, identically patched, same directory structure and web sites/code and so on.

We have 5 base web applications on each of the app servers with certain IP addresses going directly to a specific application, the majority of websites go to one specific application which then applies a front end skin using a configuration file based on the web address being requested by a users browser.

Our IT dept. are now taking the decision to simply provide our ASV scanner with 5 IP addresses which evaluate to one of the 5 base applications, as we scan weekly the likelihood of scanning all 8 app servers is quite high in their opinion, the argument being even if we scanned all 200+ IP's there is no 100% certainty that we would scan all 8 servers, depending on the load we could hit the same one each time.

My argument is that we should take the PCI DSS requirement 11.2 and supporting guidance in the ASV programming guide literally and provide all 200+ IP addresses, however our IT department do not buy this despite being in black and white, we self assess and do not have a QSA, is there any definitive answer or argument I can use to ensure we submit all of the IP's?