Get started with Network Passive Sensor: Virtual Appliance

With Qualys Network Passive Sensor (NPS), you can automatically detect and profile devices connected to your network, eliminating blind spots across your IT environment. NPS monitors network activity without any active probing of devices to detect active assets in your network.

Virtual Appliance supports a maximum throughput of 2 Gbps. It can be scaled up or down depending on its allocated resources. For more details, refer to the Appendix section.

Network Requirements and Configuration

Make sure that your network follows the prerequisites mentioned in the following table:

Parameters	Requirement
Bandwidth	Minimum recommended bandwidth connection of 1 Megabits per second (Mbps) to the Qualys Cloud Platform for a network containing around 10,000 assets.
Appliance Access	The Network Passive Sensor must be able to reach certain infrastructure located on the Qualys Cloud Platform where your Qualys account is located. The local network must be configured to allow outbound HTTPS (port 443) access to the Internet so that the Network Passive Sensor can communicate with the Qualys Cloud Platform. Log into your account and go to Help > About to see the Qualys Cloud Platform URLs.
DHCP or Static IP	The Virtual Sensor is preconfigured with DHCP by default. If it is configured with a static IP address, be sure you have the IP address, netmask, default gateway, and primary DNS.
Proxy Support	The Virtual Sensor includes Proxy support with or without authentication. Proxy-level termination (for example, as implemented in SSL bridging ) is not supported. SOCKS proxies are not supported.

Before you Begin - Mirror the Traffic

You need to feed traffic to the appliance by mirroring it (using a physical tap or mirror port). Connect the mirrored port to the appliance's sniffing interface. This step is required to see discovered assets.

Network Passive Sensor supports mirror traffic for SPAN, RSPAN, and ERSPAN methods. For more information, refer to the Deployment Guide.

Get Started

Once you complete the setup, the NPS starts discovering assets on your network. It takes just a couple of minutes.

Perform the following steps to set up the Network Passive Sensor:

Important to Know

Network Passive Sensor discovers assets in your network only when you have a valid Network Passive Sensor and Qualys Enterprise TruRisk™ Platform subscription.

If either subscription is inactive, the sensor behavior changes as described in the following table:

Inactive Subscription	Sensor Status	Sensor Behavior
Qualys Enterprise TruRisk™ Platform	Deregistered	The sensor continues asset discovery for 30 days from the date the subscription becomes inactive. After this period, the sensor is automatically Deregistered. After the subscription is reactivated, you must register the sensor again to resume asset discovery.
Network Passive Sensor	Paused	The sensor continues asset discovery for 30 days from the date the subscription becomes inactive. After this period, the sensor is automatically Paused. After the subscription is reactivated, the sensor must be manually put back into the sensing state after reactivation.