Networking Concepts
This page explains the network mechanisms behind multi-VLAN discovery. It is background reading: the setup pages tell you which values to enter, this page explains what those values do.
VLANs and why isolation matters
A VLAN partitions one physical switch infrastructure into several logical networks. Each VLAN is its own broadcast domain: a frame sent inside VLAN 10 is never delivered to a port in VLAN 20, even though both ports may sit on the same switch. Traffic can only cross a VLAN boundary through a router or a Layer 3 switch, and typically only where a firewall rule explicitly allows it.
This isolation is exactly what makes discovery difficult. Discovery probes — ARP requests, ICMP echoes, SNMP and PROFINET broadcasts — are answered only by hosts within the same broadcast domain. An Asset Gateway sitting in a management VLAN therefore sees only the management VLAN, no matter how many other VLANs exist on the same switch.
To scan a VLAN, something has to be present inside it. Multi-VLAN discovery provides that presence temporarily, in one of two ways.
Trunk ports and 802.1Q tagging
A normal switch port, called an access port, belongs to exactly one VLAN. Frames arrive and leave untagged, and the switch decides their VLAN from the port configuration alone.
A trunk port is different. It carries traffic of several VLANs over the same physical link and adds an 802.1Q tag to each frame. The tag is a small header inserted into the Ethernet frame that contains the VLAN ID, a number between 1 and 4094 that identifies the VLAN the frame belongs to. The receiving side reads the tag to decide which VLAN a frame came from, and writes the tag to decide which VLAN a frame should be delivered to.
A host connected to a trunk port can participate in every VLAN the trunk carries, provided its
operating system understands 802.1Q. On Linux, this is done with sub-interfaces: a virtual interface
such as enp2s0.20 is created on top of the physical interface enp2s0 and configured with VLAN ID
20. Everything sent through enp2s0.20 leaves the physical interface tagged with VLAN 20, and only
frames tagged with VLAN 20 are delivered back to it. From the perspective of any application using
the sub-interface, it is simply a network interface in VLAN 20.
In trunk port mode, the Asset Gateway creates exactly such a sub-interface for the duration of a
discovery job, using the VLAN ID supplied in segmentId. This is the whole mechanism: there is no
tunnel and no encapsulation beyond the 802.1Q tag itself.
The limitation is physical. The Asset Gateway host must be cabled to a switch port that is configured as a trunk and that carries the VLANs to be scanned. Layer 2 adjacency is mandatory; a trunk cannot be extended across a router.
VXLAN overlays
VXLAN lifts that restriction by carrying Layer 2 frames inside ordinary UDP packets. A complete Ethernet frame belonging to the target VLAN is wrapped in a VXLAN header, a UDP header, and an IP header, and then routed across the network like any other IP traffic. At the far end, the wrapping is removed and the original frame is delivered into the VLAN. The network in between only ever sees routed UDP packets and does not need to know anything about the VLANs being carried.
Three terms describe this arrangement:
- The VTEP (Virtual Tunnel Endpoint) is the component that performs the wrapping and unwrapping. Each tunnel has two of them: one on the Asset Gateway host, created automatically per discovery job, and one on the user side, typically a switch or router configured by the user.
- The VNI (VXLAN Network Identifier) is carried in the VXLAN header and tells the receiving VTEP
which VLAN a frame belongs to. The user maps each VLAN to a VNI on the remote endpoint, for
example VLAN 20 to VNI 20. The Asset Gateway does not create or manage VNIs; it addresses an
existing one through the
segmentIdoption. - The underlay is the routed IP network the UDP packets travel over. Its only requirement is that the
Asset Gateway host can reach the remote VTEP's IP address, supplied as
remoteIP, on the VXLAN UDP port, supplied asvxlanDstPortand defaulting to 4789.
In VXLAN mode, the Asset Gateway creates a VXLAN interface on the host for the duration of a discovery job. As with a trunk sub-interface, applications see it as an ordinary network interface inside the target VLAN.
Because the underlay is just IP, the tunnel can cross routers, WAN links, and VPNs. It also means VXLAN provides no confidentiality: the encapsulated frames are unencrypted and unauthenticated. When the underlay is not trusted, the tunnel should run over a VPN. See Securing VXLAN Traffic.
Comparing the two modes
| Aspect | Trunk port (VLAN) |
VXLAN overlay (VXLAN) |
|---|---|---|
| Network requirement | Layer 2 adjacency to a trunk port | Layer 3 reachability to a remote VTEP |
Meaning of segmentId |
802.1Q VLAN ID | VXLAN Network Identifier (VNI) |
| Interface created per job | 802.1Q tagged sub-interface | VXLAN interface |
| Remote endpoint needed | No | Yes, a VTEP configured by the user |
| Encapsulation | 802.1Q tag only | Ethernet frame inside UDP |
| Applicable options | Common options only | Common options plus remoteIP and vxlanDstPort |
| Encryption | Not applicable, traffic stays on the link | None by default; use an IPsec or WireGuard underlay |
As a rule of thumb: if the Asset Gateway host can be cabled to a trunk port on the switch that owns the target VLANs, use trunk port mode. If it cannot, use VXLAN mode.
Terminology
| Term | Meaning |
|---|---|
| VLAN | Logical network segment — devices on different VLANs cannot communicate directly. |
| VLAN ID | 802.1Q identifier of a VLAN on a switch, in the range 1 to 4094. |
| Trunk port | Switch port that carries traffic of several VLANs, each frame tagged with its VLAN ID. |
| 802.1Q tag | Header field added to an Ethernet frame that carries the VLAN ID on a trunk port. |
| Sub-interface | Tagged virtual interface created on a physical interface to send and receive traffic of one VLAN. |
| VXLAN | Tunnel technology that extends a VLAN over a routed IP network (WAN underlay). |
| VNI | VXLAN Network Identifier — labels which remote VLAN a tunnel belongs to. |
| VTEP | Virtual Tunnel Endpoint — wraps/unwraps VXLAN traffic on each side of the tunnel. |
| Underlay | The routed IP network that transports the encapsulated VXLAN packets. |
| IPsec | VPN protocol suite that encrypts IP traffic on the existing interface, usable as the encrypted underlay for VXLAN traffic. |
| WireGuard | Modern VPN protocol used as the encrypted underlay for VXLAN traffic. |