Discovery over VXLAN

In VXLAN mode, discovery traffic is tunneled through a Virtual Extensible LAN (VXLAN) overlay between the Asset Gateway host and a user-side VXLAN endpoint that is connected to the target VLANs. Only Layer 3 reachability between the two endpoints is required; no VLAN trunk and no Layer 2 adjacency are needed.

When the discovery option type is set to VXLAN, the Asset Gateway creates a VXLAN interface on the host, attaches it to the Asset Link container, and runs the discovery against the remote VLAN as if it were directly connected. The interface is removed after the job completes.

Read Host Preparation first; it covers the host, probe address, and firewall requirements that apply to this mode, including the UDP port that the tunnel uses. See VXLAN tunnel port (UDP).

Prerequisites specific to VXLAN mode

A VXLAN endpoint (VTEP) must be configured by the user on a device, typically a switch, that is connected to the target VLANs and has Layer 3 reachability to the Asset Gateway host.
A unique VNI must be assigned by the user to each VLAN that has to be discovered. The Asset Gateway does not create or manage VNIs; it uses the VNI supplied in the segmentId discovery option to address an existing VLAN. Share these VNIs with the operator who configures the discovery job.
The Asset Gateway host must have the VXLAN driver available. On standard Linux hosts this is enabled by default.

Configuring the job

Set type to VXLAN and provide segmentId with the VXLAN Network Identifier of the target VLAN, together with the parent interface, vlanSubnet, probeIP, and remoteIP. The vxlanDstPort option is optional and defaults to 4789.

Note

All discovery options must use the EQUAL comparison operator. Other operators are not supported for multi-VLAN discovery parameters.

The full option reference is on the Discovery Options page. The options that matter specifically in this mode are:

parentInterfaceName / parentInterfaceIP: the interface on the Asset Gateway host that carries the tunnel. Supply either the name or the IP; supplying both is allowed but not required. When a VPN is used as the underlay, this points to the VPN interface rather than the physical one. See Securing VXLAN Traffic.
remoteIP: the IP address of the user-side VTEP where the tunnel terminates.
vxlanDstPort: the UDP destination port of the tunnel. It must match the port configured on the remote endpoint.

If the Asset Link delegates the scan to a separate tool, add the optional networkScannerName option so that the VXLAN interface is attached to the container of that tool. See Overriding the container name.

Example payload

Example payload for a multi-VLAN discovery job using the Default IP Scanner. Replace the assetLinkId and deviceClass values to target a different Asset Link.

{
  "assetLinkId": "cdm-device-class-driver-siemens.cdm.dcd.default-ip-scanner",
  "deviceClass": "siemens.cdm.dcd.default-ip-scanner",
  "discoveryFilters": [
    { "key": "IPRange", "comparisonOperator": "EQUAL", "value": "192.168.2.1-192.168.2.100" }
  ],
  "zone": "default",
  "discoveryOptions": [
    { "key": "type",                "comparisonOperator": "EQUAL", "value": "VXLAN" },
    { "key": "segmentId",           "comparisonOperator": "EQUAL", "value": "200" },
    { "key": "parentInterfaceName", "comparisonOperator": "EQUAL", "value": "enp2s0" },
    { "key": "parentInterfaceIP",   "comparisonOperator": "EQUAL", "value": "192.168.4.19" },
    { "key": "vlanSubnet",          "comparisonOperator": "EQUAL", "value": "192.168.2.0/24" },
    { "key": "remoteIP",            "comparisonOperator": "EQUAL", "value": "192.168.4.1" },
    { "key": "probeIP",             "comparisonOperator": "EQUAL", "value": "192.168.2.47" },
    { "key": "vxlanDstPort",        "comparisonOperator": "EQUAL", "value": "4789" }
  ]
}

Example setup

Suppose a Linux-based Asset Gateway host is connected to the switch and sits in its own management VLAN, for example VLAN 40 (192.168.40.0/24). The operator wants to scan three other VLANs on the switch: VLAN 10, VLAN 20, and VLAN 30. Only Layer 3 reachability between the host and the switch is required.

On the switch:

Configure a VXLAN endpoint (VTEP) and map each target VLAN to a unique VNI, for example VLAN 10 → VNI 10, VLAN 20 → VNI 20, and VLAN 30 → VNI 30. The exact configuration steps depend on the switch vendor.
Make sure the switch and the Asset Gateway host have Layer 3 connectivity between them.
vxlanDstPort: UDP destination port of the tunnel. Use the default 4789 unless the switch is configured to use a different port; in that case the same port must be supplied here.

On the Asset Gateway host:

Optionally, set up a VPN (IPsec or WireGuard) between the host and the switch to encrypt the tunnel traffic. The Asset Gateway only uses the VPN; it does not set it up. See Securing VXLAN Traffic.

Topology

The following diagram shows how the pieces of this example fit together, so that it is clear which part is set up by the user and which part the Asset Gateway creates on its own. It follows a single discovery job from the Asset Gateway down to the target VLAN: the Asset Link sends its probes through the VXLAN interface using probeIP as the source address, the interface encapsulates them and hands them to the parent interface, and the remote VTEP decapsulates them and forwards them into the VLAN that matches the VNI.

The example uses WireGuard as the encrypted underlay. Each WireGuard tunnel is set up by the user and must be operational before a job starts. The VXLAN interfaces are not part of the setup: the Asset Gateway creates one on the fly for each discovery job and removes it afterward. The diagram also shows the three VNIs side by side to illustrate that they share one tunnel endpoint and one parent interface, while each of them is scanned by its own job.

uml diagram

Figure: Multi-VLAN discovery over VXLAN with WireGuard as the encrypted underlay

Note

Without a VPN, the WireGuard interfaces are omitted on both sides. parentInterfaceName then points to the physical interface enp2s0 and remoteIP remains the VTEP address of the switch.

Choosing the tunnel parameters

The following parameters describe the tunnel endpoint and stay the same for every job that uses the same VXLAN endpoint:

parentInterfaceName / parentInterfaceIP: identify the interface on the Asset Gateway host that reaches the switch. In this example, the host's management interface enp2s0 with IP 192.168.40.10 is used. Provide either the interface name (enp2s0) or its IP (192.168.40.10); supplying both is allowed but not required. When a VPN is used, point this to the VPN interface instead. See Securing VXLAN Traffic.
remoteIP: IP address of the switch's VXLAN endpoint (VTEP), for example 192.168.40.1. This is where the tunnel terminates on the switch side.

Per-job parameters

To scan the three VLANs, submit one discovery job per VLAN, each with the matching segmentId, vlanSubnet, and probeIP:

Target VLAN	`segmentId`	`vlanSubnet`	`probeIP`
VLAN 10	`10`	`192.168.10.0/24`	`192.168.10.50`
VLAN 20	`20`	`192.168.20.0/24`	`192.168.20.50`
VLAN 30	`30`	`192.168.30.0/24`	`192.168.30.50`

The same approach scales to any number of remote VLANs and any number of remote VXLAN endpoints; only the per-job parameters change.

Any questions left?

Ask the community