Skip to content

Discovery over Trunk Port

In trunk port mode, the Asset Gateway host is connected to a switch port that is configured as an 802.1Q trunk carrying the target VLANs. No tunnel and no remote endpoint are involved: the host is Layer 2 adjacent to every VLAN that the trunk port carries.

When the discovery option type is set to VLAN, the Asset Gateway creates an 802.1Q tagged sub-interface on the parent interface, attaches it to the Asset Link container, and runs the discovery against the target VLAN as if it were directly connected. The sub-interface is removed after the job completes.

Read Host Preparation first; it covers the host, probe address, and firewall requirements that apply to this mode.

Prerequisites specific to trunk port mode

  • The Asset Gateway host must be physically connected to a switch port configured as an 802.1Q trunk.
  • The trunk port must be configured to carry every VLAN that has to be discovered, with frames tagged with the corresponding VLAN ID.
  • The VLAN IDs of the VLANs to be discovered must be shared with the operator who configures the discovery jobs; they are supplied in the segmentId option.
  • The Asset Gateway host must have the 802.1Q VLAN driver available. On standard Linux hosts this is enabled by default.

Configuring the switch

  • Configure the switch port that the Asset Gateway host is connected to as an 802.1Q trunk port.
  • Allow every VLAN that has to be discovered on that trunk port. The exact configuration steps depend on the switch vendor.
  • Make sure those VLANs are tagged on the trunk. Untagged frames on the native VLAN of the trunk are not visible to the tagged sub-interface that the Asset Gateway creates, so a VLAN configured as the native VLAN cannot be scanned in this mode.

Configuring the job

Set type to VLAN and provide segmentId with the 802.1Q VLAN ID of the target VLAN, together with the parent interface, vlanSubnet, and probeIP.

Note

All discovery options must use the EQUAL comparison operator. Other operators are not supported for multi-VLAN discovery parameters.

The full option reference is on the Discovery Options page. The options that matter specifically in this mode are:

  • parentInterfaceName / parentInterfaceIP: the host interface that is cabled to the trunk port. The tagged sub-interface is created on top of it. Supply either the name or the IP; supplying both is allowed but not required.
  • segmentId: the 802.1Q VLAN ID of the target VLAN.

If the Asset Link delegates the scan to a separate tool, add the optional networkScannerName option so that the tagged sub-interface is attached to the container of that tool. See Overriding the container name.

The remoteIP and vxlanDstPort options apply only to tunneled discovery and therefore have no effect in trunk port mode. They are ignored if supplied.

Example payload

Example payload for a multi-VLAN discovery job using the Default IP Scanner. Replace the assetLinkId and deviceClass values to target a different Asset Link.

{
  "assetLinkId": "cdm-device-class-driver-siemens.cdm.dcd.default-ip-scanner",
  "deviceClass": "siemens.cdm.dcd.default-ip-scanner",
  "discoveryFilters": [
    { "key": "IPRange", "comparisonOperator": "EQUAL", "value": "192.168.2.1-192.168.2.100" }
  ],
  "zone": "default",
  "discoveryOptions": [
    { "key": "type",                "comparisonOperator": "EQUAL", "value": "VLAN" },
    { "key": "segmentId",           "comparisonOperator": "EQUAL", "value": "200" },
    { "key": "parentInterfaceName", "comparisonOperator": "EQUAL", "value": "enp2s0" },
    { "key": "parentInterfaceIP",   "comparisonOperator": "EQUAL", "value": "192.168.4.19" },
    { "key": "vlanSubnet",          "comparisonOperator": "EQUAL", "value": "192.168.2.0/24" },
    { "key": "probeIP",             "comparisonOperator": "EQUAL", "value": "192.168.2.47" }
  ]
}

Example setup

Suppose three VLANs — VLAN 10 (192.168.10.0/24), VLAN 20 (192.168.20.0/24), and VLAN 30 (192.168.30.0/24) — have to be scanned, and the Asset Gateway host is cabled directly to the switch that owns them.

On the switch:

  • Configure the port that the Asset Gateway host is connected to as an 802.1Q trunk port.
  • Allow VLAN 10, VLAN 20, and VLAN 30 on that trunk port, tagged with their VLAN IDs.

On the Asset Gateway host:

  • Use the interface connected to the trunk port, for example enp2s0, as parentInterfaceName. No further network setup is required.

Topology

The following diagram shows how the pieces of this example fit together, so that it is clear which part is set up by the user and which part the Asset Gateway creates on its own. It follows a single discovery job from the Asset Gateway down to the target VLAN: the Asset Link sends its probes through the tagged sub-interface using probeIP as the source address, the sub-interface tags the frames with the VLAN ID supplied in segmentId, and the trunk port delivers them to the matching VLAN on the switch.

The trunk port and the VLANs on it are configured by the user and must be in place before a job starts. The tagged sub-interfaces are not part of the setup: the Asset Gateway creates one on the fly for each discovery job and removes it afterward. The diagram also shows the three VLAN IDs side by side to illustrate that they share one trunk port and one parent interface, while each of them is scanned by its own job.

uml diagram

Figure: Multi-VLAN discovery over an 802.1Q trunk port

Per-job parameters

To scan the three VLANs, submit one discovery job per VLAN, each with the matching segmentId, vlanSubnet, and probeIP:

Target VLAN segmentId vlanSubnet probeIP
VLAN 10 10 192.168.10.0/24 192.168.10.50
VLAN 20 20 192.168.20.0/24 192.168.20.50
VLAN 30 30 192.168.30.0/24 192.168.30.50

The same approach scales to every VLAN the trunk port carries; only the per-job parameters change.

Parent interface behavior

The Asset Gateway brings the parent interface up if it is down and returns it to its previous state after the job completes. See Parent interface lifecycle.

Any questions left?

Ask the community