Configure VLANs and Static Routes

This is supported in IPv4+v6 network mode (the default) and IPv6-only mode.

The Scanner Appliance supports VLAN trunking on the LAN interface for scanning traffic. VLAN trunking on the WAN interface is not supported. One VLAN interface (802.1Q) may be configured using the Scanner Appliance user interface (LCD and Remote Console). Up to 4094 VLANs and static routes can be defined using the Qualys web application.

How it works? 

The Scanner Appliance adds VLAN tag(s) to all scanning packets following the 802.1Q tagging protocol.

Configure VLAN using Appliance UI

A VLAN that is defined using the Scanner Appliance UI is saved on the Appliance and can’t be edited using the Qualys UI.

After making configuration changes, be sure to complete the entire network configuration so that your Scanner Appliance makes a successful connection to the Qualys Enterprise TruRisk™ Platform.

Configure VLAN

To configure the Scanner Appliance with a default VLAN interface on the LAN interface, perform the following steps:

  1. Go to SETUP NETWORK menu and press ENTER to continue.
  2. Press the Down arrow one time. When the ENABLE VLAN ON LAN menu displays, press ENTER to continue.
  3. When the prompt VLAN 0-4094 displays, specify the VLAN ID. The value '0000' displays in the screen by default. Specify the VLAN ID, and then press ENTER to continue.

Change VLAN

A default VLAN that you have added using the Scanner Appliance user interface (LCD and Remote Console) can be changed at any time.

Perform the following steps to change VLAN:

  1. Select the CHANGE VLAN ON LAN menu from the SETUP NETWORK menu.
  2. Then enter another VLAN ID and press ENTER.

Disable VLAN

Perform the following steps to disable default VLAN:

  1. Select the CHANGE VLAN ON LAN menu from the SETUP NETWORK menu.
  2. Then enter the VLAN ID 0000 and press ENTER.
  3. After the configuration is disabled the ENABLE DHCP ON LAN menu displays on the Scanner Appliance interface.

Configure VLANs / Static Routes using Qualys UI

To configure static routes from the Qualys Enterprise TruRisk™ Platform, perform the following steps:

  1. Log in to Qualys as a Manager, go to Scans > Appliances, select the appliance, and choose Info from the Quick Actions menu.
    The Info page displays the scanner's network configuration.
    Within the LAN and WAN settings sections, you can view the following information for each network interface:

    • Assigned IP address

    • Netmask

    • Default gateway

    • Configured DNS servers

    Before proceeding to the next step and adding static routes to the scanner, review the following routing behavior and design considerations.

    Route Selection Behavior

    The Qualys scanner determines the path to a destination network or IP address based on standard routing principles. When multiple routes are available, the scanner selects the route that has the most specific match, known as the longest prefix match, from its routing table.

    DNS and Gateway Route Validation

    The Qualys scanner is designed to ignore any static route configurations received from the Qualys TruRisk platform if any of the following addresses fall within a configured static route:

    • LAN DNS servers
    • WAN DNS servers
    • LAN default gateway
    • WAN default gateway
    • Proxy IP address

    This behavior applies even when the DNS server addresses are located outside the corresponding LAN or WAN subnet.

    According to the rules mentioned  above, the static routes in the following examples are rejected:

    Example 1

    Scanner’s LAN configuration 

    LAN subnet: 192.168.10.0/24 

    Gateway IP: 192.168.10.1 

    Static route created via TruRisk platform: 

    Destination network: 192.168.10.0/28 

    Next hop: 192.168.10.4 

    Explanation

    The gateway IP (192.168.10.1) falls within the destination network (192.168.10.0/28, range 192.168.10.0–192.168.10.15). Qualys would reject this configuration because the LAN gateway IP is contained within the static route network.

    Example 2

    Scanner’s LAN DNS configuration
    DNS servers:

    10.20.30.53

    10.40.20.4

    Static route created via TruRisk platform:

    Destination network: 10.40.20.0/24

    Next hop: 10.40.20.1

    Explanation

    The DNS server IP (10.40.20.4) belongs to the destination network (10.40.20.0/24). Therefore, the DNS server is located within the address range covered by the static route, and the Qualys scanner would reject this configuration.

  2. From the Quick Actions menu, select the Static Routes tab on the left. Click New, then click OK once you have read and understood the warning.
    Image 5

     To ensure static routes are applied successfully, verify that no configured static route overlaps with the scanner's DNS server or default gateway addresses.

  3. When the Edit Route dialog box is displayed, enter the required information and click OK.
    Image 6
  4. Click Save once all your Add/Change/Delete operations are completed.
  5. You can add up to 4094 VLANs to devices with a serial number over 29000 and up to 99 VLANs to devices with a serial number under 29000.
  6. Add up to 99 static routes.

Do not refer to these settings? The VLAN trunking feature must be turned on for your account. Contact Support or your Technical Account Representative if you want to turn it on for you.

Related Topic

Configure Static IP Address

 

© 2026 Qualys, Inc. All rights reserved. Privacy Policy. Last updated: July, 2026