Prerequisites for CAR
Before you start with CAR operations, make sure that you meet the following prerequisites:
Prepare Your Environment to Use the CAR with Cloud Agent Devices
- The CAR app must be enabled for your subscription. To get it enabled, contact your Technical Account Manager.
- For Windows, you must have Qualys Cloud Agent 4.6.1.6 or later installed.
Refer to the Cloud Agent for Windows Installation Guide - For Linux scripts, you must have Qualys Cloud Agent 4.7.0 or later installed.
Refer to the Cloud Agent for Linux Installation Guide
Prepare Your Environment to Use the CAR with Perimeter Devices
You can use CAR to run scripts on devices that cannot run the Qualys Cloud Agent, including network appliances, devices, and other non-agent devices.
Before you run CAR scripts on non-agent devices, ensure that:
- Deploy a Scanner appliance: At least one Qualys Scanner Appliance must be deployed and online in the network where your target devices reside. You can select one scanner per execution.
- Associate devices with a Qualys network: Target devices must be associated with a Qualys network. You select the network during script execution.
- Configure authentication: In VMDR > Scans > Authentication, configure a valid authentication record for the target non-agent asset. Verify the credentials are correct, supported by the target platform, and have sufficient permissions to connect to the asset and execute the required assessment commands or scripts.
For Cisco IOS devices, note the configurations below:-
Privileged EXEC (enable) Mode for Cisco IOS Script Execution
When a CAR script targets Cisco IOS / IOS-XE devices, CAR instructs the scanner to escalate to Privileged EXEC mode - i.e., send enable and operate at privilege level 15 - by default for every script execution. The Cisco authentication record used for the target must have the Enable Password configured (Set Up Cisco Authentication). The scanner uses this password to answer the enable prompt on the device. If the enable password is not set in the record (or is incorrect), CAR script execution will fail.
-
Cisco privilege model:
Level 0 - basic commands only (disable, enable, exit, help, logout)
Level 1 - User EXEC mode commands
Level 15 - Privileged EXEC mode commands (highest privilege)
Levels 2-14 are undefined unless the device administrator explicitly assigns commands/users to them. -
Justification:
Commands require privileged EXEC - The commands CAR scripts commonly run on network devices show version, show logging, show running-config, and most other show/diagnostic commands are available only in Privileged EXEC mode (or must be individually re-mapped to a lower level on the device). Without enable, these commands fail or return incomplete output, making script results unreliable.
Consistency with VMDR authenticated scanning - VMDR already requires privilege level 15 on Cisco auth records to perform all checks (Cisco Authentication Setup, Privilege levels for Cisco IOS/IOS-XE). CAR reuses the same scanner auth-record trust model, so privilege-15 escalation does not introduce a new privilege boundary, it matches what customers already grant for vulnerability/compliance scanning. For more information, refer to Authentication Records and Tag Support for Authentication Records in VMDR.
-