Multi-VLAN Discovery over VXLAN

Multi-VLAN discovery allows the Asset Gateway to discover assets that reside in remote VLANs without physically relocating the Asset Gateway host or attaching it to each target VLAN. Discovery traffic is tunneled through a Virtual Extensible LAN (VXLAN) overlay between the Asset Gateway host and a customer-side VXLAN endpoint that is connected to the target VLANs. This capability is not tied to a specific Asset Link.

Note

Multi-VLAN discovery is supported from Asset Gateway version 1.7.0-rc+d882a8b5 or higher and is available only for Docker Compose version of the Asset Gateway. Industrial Edge App deployments do not support multi-VLAN discovery.

Key Concepts

Term	Meaning
VLAN	Logical network segment — devices on different VLANs cannot communicate directly.
VXLAN	Tunnel technology that extends a VLAN over a routed IP network (WAN underlay).
VNI	VXLAN Network Identifier — labels which remote VLAN a tunnel belongs to.
VTEP	Virtual Tunnel Endpoint — wraps/unwraps VXLAN traffic on each side of the tunnel.
WireGuard	Modern VPN protocol used as the encrypted underlay for VXLAN traffic.

How it works

A VXLAN tunnel is established between the Asset Gateway host and a customer-side VXLAN endpoint that sits in the target network. Each VLAN to be discovered is identified by a unique VXLAN Network Identifier (VNI). When the discovery option type is set to VXLAN, the Asset Gateway creates a VXLAN interface on the host, attaches it to the Asset Link container, and runs the discovery against the remote VLAN as if it were directly connected.

Enabling multi-VLAN discovery

To run a discovery job in multi-VLAN mode, set the discovery option type to VXLAN and provide the remaining VXLAN parameters listed below. If type is omitted or set to any other value, the job runs as a standard discovery and the VXLAN parameters are ignored.

Note

All discovery options listed below must use the EQUAL comparison operator. Other operators are not supported for multi-VLAN discovery parameters.

Discovery options

Key	Required	Description	Example value
`type`	Yes	Marks the job as a multi-VLAN discovery job. Must be set to `VXLAN`.	`VXLAN`
`vni`	Yes	VXLAN Network Identifier of the target VLAN. Must match the VNI configured on the customer-side VXLAN endpoint for the VLAN to be discovered.	`200`
`parentInterfaceName`	Conditional	Name of the interface on the Asset Gateway host that carries the VXLAN traffic. Either `parentInterfaceName` or `parentInterfaceIP` must be provided; supplying both is optional. See Securing VXLAN traffic with a VPN for more details.	`enp2s0`
`parentInterfaceIP`	Conditional	IP address of the interface on the Asset Gateway host that carries the VXLAN traffic.	`192.168.4.19`
`vlanSubnet`	Yes	Subnet of the remote VLAN, in CIDR notation. Used to assign the `probeIP` to the VXLAN interface and to route discovery traffic through the tunnel.	`192.168.2.0/24`
`remoteIP`	Yes	IP address of the customer-side VXLAN endpoint (VTEP) that terminates the tunnel and forwards traffic into the target VLAN.	`192.168.4.1`
`probeIP`	Yes	IP address assigned to the VXLAN interface on the Asset Gateway host and used as the source address for discovery probes. Must belong to `vlanSubnet`, must be free inside the target VLAN, and must not conflict with any existing host.	`192.168.2.47`
`vxlanDstPort`	No	UDP destination port used by the VXLAN tunnel. Must match the port configured on the remote endpoint. Defaults to `4789`.	`4789`

Example payload

Example payload for a multi-VLAN discovery job using the Default IP Scanner. Replace the assetLinkId and deviceClass values to target a different Asset Link.

{
  "assetLinkId": "cdm-device-class-driver-siemens.cdm.dcd.default-ip-scanner",
  "deviceClass": "siemens.cdm.dcd.default-ip-scanner",
  "zone": "default",
  "discoveryOptions": [
    { "key": "type",                "comparisonOperator": "EQUAL", "value": "VXLAN" },
    { "key": "vni",                 "comparisonOperator": "EQUAL", "value": "200" },
    { "key": "parentInterfaceName", "comparisonOperator": "EQUAL", "value": "enp2s0" },
    { "key": "parentInterfaceIP",   "comparisonOperator": "EQUAL", "value": "192.168.4.19" },
    { "key": "vlanSubnet",          "comparisonOperator": "EQUAL", "value": "192.168.2.0/24" },
    { "key": "remoteIP",            "comparisonOperator": "EQUAL", "value": "192.168.4.1" },
    { "key": "probeIP",             "comparisonOperator": "EQUAL", "value": "192.168.2.47" },
    { "key": "vxlanDstPort",        "comparisonOperator": "EQUAL", "value": "4789" }
  ]
}

Prerequisites

The following must be in place before starting a multi-VLAN discovery job:

The Asset Gateway host must have VXLAN driver and docker engine installed. On standard Linux hosts this is enabled by default.
A VXLAN endpoint (VTEP) must be configured by the customer on a device (typically a switch) that is connected to the target VLANs and has Layer 3 reachability to the Asset Gateway host.
A unique VNI must be assigned by the customer to each VLAN that has to be discovered. The Asset Gateway does not create or manage VNIs; it uses the VNI supplied in the vni discovery option to address an existing VLAN. Share these VNIs with the operator who configures the discovery job.
The IP address used as probeIP must be reserved inside each target VLAN for the Asset Gateway, so that it is not assigned to any other host for the duration of the discovery job. A conflict with an existing host causes the discovery to fail or return incomplete results.

To discover multiple VLANs, submit one discovery job per VLAN with the matching vni, vlanSubnet, and probeIP values. The parentInterfaceName, parentInterfaceIP, remoteIP, and vxlanDstPort values typically stay the same across jobs that share the same VXLAN endpoint.

Parent interface lifecycle

Before a multi-VLAN discovery job starts, the Asset Gateway checks the state of the parent network interface identified by parentInterfaceName or parentInterfaceIP that carries the VXLAN traffic:

If the parent interface is down, the Asset Gateway brings it up, uses it for the discovery, and brings it back down after the job completes. This keeps VXLAN-based network communication available only for the duration of the discovery and minimizes the time the interface stays active.
If the parent interface is already up before the job starts, the Asset Gateway uses it as is and leaves it unchanged after the job completes.

Note

Only the parent interface used by the VXLAN tunnel is affected. See the parentInterfaceName and parentInterfaceIP discovery options in Discovery options.

Securing VXLAN traffic with a VPN (Optional)

VXLAN does not provide encryption or authentication on its own. When discovery traffic traverses an untrusted network, the customer may establish a VPN tunnel between the Asset Gateway host and the remote VXLAN endpoint, and verify connectivity before running a multi-VLAN discovery job. The Asset Gateway does not set up the VPN.

IPsec VPN: No change to the discovery parameters is required. Use the physical interface (for example, enp2s0) as parentInterfaceName, because IPsec operates transparently on the same interface that carries the unencrypted traffic.
WireGuard: Set parentInterfaceName to the WireGuard interface (for example, wg0) instead of the physical interface, and set parentInterfaceIP to the IP address assigned to that WireGuard interface. The VXLAN tunnel is then established over the encrypted WireGuard interface.

Supported Asset Links

Multi-VLAN discovery can be used with any Asset Link. The Asset Link itself does not need to be aware of VXLAN; the Asset Gateway sets up the tunnel and presents the remote VLAN to the Asset Link as a regular network. For the Asset Gateway to attach the VXLAN interface to the correct container, the Asset Link container name must include the trailing segment of the assetLinkId (the part after the final . or -), prefixed by . or -. Container names must match the regular expression:

^.*[.-]<id>(?:[.-].*)?$

Replace <id> with the trailing segment of the assetLinkId. For example, an Asset Link with the id cdm-device-class-driver-siemens.cdm.dcd.sat has trailing segment sat and requires a container name such as asset-link-sat or siemens.cdm.dcd.sat.

Example setup

Suppose a Linux-based Asset Gateway host is connected to the switch and sits in its own management VLAN, for example VLAN 40 (192.168.40.0/24). The operator wants to scan three other VLANs on the switch: VLAN 10, VLAN 20, and VLAN 30. Only Layer 3 reachability between the host and the switch is required.

On the switch:

Configure a VXLAN endpoint (VTEP) and map each target VLAN to a unique VNI, for example VLAN 10 → VNI 10, VLAN 20 → VNI 20, and VLAN 30 → VNI 30. The exact configuration steps depend on the switch vendor.
Make sure the switch and the Asset Gateway host have Layer 3 connectivity between them.
vxlanDstPort: UDP destination port of the tunnel. Use the default 4789 unless the switch is configured to use a different port; in that case the same port must be supplied here.

On the Asset Gateway host:

Optionally, set up a VPN (IPsec or WireGuard) between the host and the switch to encrypt the tunnel traffic. The Asset Gateway only uses the VPN; it does not set it up. See Securing VXLAN traffic with a VPN.

Choosing the tunnel parameters

The following parameters describe the tunnel endpoint and stay the same for every job that uses the same VXLAN endpoint:

parentInterfaceName / parentInterfaceIP: identify the interface on the Asset Gateway host that reaches the switch. In this example, the host's management interface enp2s0 with IP 192.168.40.10 is used. Provide either the interface name (enp2s0) or its IP (192.168.40.10); supplying both is allowed but not required. When a VPN is used, point this to the VPN interface instead (see the VPN section).
remoteIP: IP address of the switch's VXLAN endpoint (VTEP), for example 192.168.40.1. This is where the tunnel terminates on the switch side.

Per-job parameters

To scan the three VLANs, submit one discovery job per VLAN, each with the matching vni, vlanSubnet, and probeIP:

Target VLAN	`vni`	`vlanSubnet`	`probeIP`
VLAN 10	`10`	`192.168.10.0/24`	`192.168.10.50`
VLAN 20	`20`	`192.168.20.0/24`	`192.168.20.50`
VLAN 30	`30`	`192.168.30.0/24`	`192.168.30.50`

The same approach scales to any number of remote VLANs and any number of remote VXLAN endpoints; only the per-job parameters change.

Any questions left?

Ask the community