Multi-VLAN Discovery
Multi-VLAN discovery allows the Asset Gateway to discover assets that reside in remote VLANs without physically relocating the Asset Gateway host or attaching it to each target VLAN. This capability is not tied to a specific Asset Link.
Note
Multi-VLAN discovery is supported from Asset Gateway version 1.7.0 or higher and is available only for Docker Compose version of the Asset Gateway. The Asset Gateway Industrial Edge App does not support multi-VLAN discovery.
The problem it solves
A VLAN is an isolated Layer 2 broadcast domain. A discovery scan relies on broadcast and unicast probes reaching every host in a subnet, so a scanner can only find assets in VLANs it is actually part of. In a plant network segmented into dozens of VLANs, this would normally mean deploying one Asset Gateway per VLAN, or re-cabling the host before every scan.
Multi-VLAN discovery removes that constraint. For the duration of a single discovery job, the Asset Gateway gives itself a presence inside the target VLAN, runs the scan from there, and gives that presence up again when the job finishes.
Supported modes
The Asset Gateway supports two ways of reaching a remote VLAN. Both are selected through the type
discovery option and share the same option keys wherever possible.
| Mode | type value |
Requires | Choose when |
|---|---|---|---|
| VXLAN overlay | VXLAN |
Layer 3 reachability to a user-side VXLAN endpoint, plus a VNI per VLAN | The host is remote from the target network, separated by routers, a WAN link, or a VPN. |
| Trunk port | VLAN |
Layer 2 adjacency: a cable to a switch port configured as an 802.1Q trunk | The host sits in the same plant segment as the switch and can be attached to a trunk port. |
If type is omitted or set to any other value, the job runs as a standard discovery and the
multi-VLAN parameters are ignored.
Trunk port mode is the simpler of the two: it needs no tunnel, no remote endpoint, and no configuration beyond the trunk port itself. VXLAN mode is the more flexible one: it works across any routed path, at the cost of requiring a VXLAN endpoint on the user side. See Networking Concepts for how each mode works and how to choose between them.
How it works
Regardless of the mode, a discovery job follows the same lifecycle:
- The Asset Gateway reads the multi-VLAN parameters from the discovery job.
- It brings up the parent interface if it is currently down.
- It creates a dedicated network interface for the target VLAN on the host — a VXLAN interface in
VXLANmode, an 802.1Q tagged sub-interface inVLANmode — and assigns theprobeIPtaken fromvlanSubnetto it. - It attaches that interface to the Asset Link container, so the Asset Link sees the remote VLAN as an ordinary local network.
- The Asset Link runs the scan, using
probeIPas the source address of its probes. - After the job completes, the Asset Gateway removes the interface and restores the parent interface to its previous state.
The Asset Link itself does not need to be aware of VXLAN or VLAN tagging. This is why multi-VLAN discovery works with any Asset Link without changes to it.
In both modes, segmentId identifies which VLAN the job targets: the VNI in VXLAN mode, the 802.1Q
VLAN ID in VLAN mode. One discovery job always covers exactly one VLAN. To scan several VLANs,
submit one job per VLAN with the matching segmentId, vlanSubnet, and probeIP.
Note
The Asset Gateway relies entirely on the existing user network and on the values supplied in the job; it cannot validate the VLAN or VXLAN configuration behind them. See User-managed network configuration.
Warning
Credentials are stored based on gateway ID and IP address. Because different VLANs can use the same subnet and IP addresses, credentials from one VLAN may be sent to an unrelated asset with the same IP address in another VLAN. Depending on the protocol, this can go beyond a failed authentication attempt: for example, with SNMP v1/v2c the community string is transmitted in the request itself, so it would be disclosed to the unintended device. To avoid this, do not overlap probe IP ranges across VLANs, or scope credential instances per VLAN.
Where to continue
- Networking Concepts — how VLANs, trunk ports, and VXLAN overlays work, and how to choose between the two modes.
- Host Preparation — host requirements, firewall rules, parent interface behavior, and Asset Link container naming. Read this before either setup page.
- Discovery over VXLAN — complete configuration and worked example for
type: VXLAN. - Securing VXLAN Traffic — optional VPN underlay for VXLAN traffic.
- Discovery over Trunk Port — complete configuration and worked example for
type: VLAN. - Discovery Options — reference for every option key.
- Troubleshooting — unexpected or missing devices in scan results.