How to configure a virtual scanner using Microsoft Hyper-V

Document created by Qualys Documentation Employee on Jan 10, 2013Last modified by Qualys Documentation Employee on May 11, 2020
Version 6Show Document
  • View in full screen mode

This document details deployment instructions of the Qualys Virtual Scanner Appliance in Microsoft Hyper-V.

 

Prerequisites

1) Download the Qualys Virtual Scanner image for Microsoft Hyper-V, qVSA.i386<version>.vhdx.zip (e.g. qVSA.i386-2.7.29-2.vhdx.zip)

2) Obtain a personalization code from your Qualys subscription for a new Virtual Scanner Appliance

 

Network Requirements

1) For single-network scanning, ensure the destination network for LAN is configured to allow outbound HTTPS (port 443) access to the internet for communicating with the Qualys Cloud Platform.

2) For split-network scanning, ensure the destination network for the WAN is configured to allow outbound HTTPS (port 443) access to the internet for communicating with the Qualys Cloud Platform.

3) While conducting a scan, the virtual scanner sends probes to target assets, i.e. hosts and/or web applications. The virtual scanner must be placed in a network where it can access the target assets for scanning.
 

Deploy Qualys Virtual Scanner Appliance

 

Step 1: Create Qualys Virtual Scanner

Follow these steps:

1) Unzip the downloaded file qVSA-2.X.X-X-vhdx.zip to obtain the virtual hard disk file qVSA-2.X.X-X-disk1.vhdx.

2) Login to the Hyper-V server. Go to Manager > Hyper-V Manager and add a new Virtual Machine.

3) Provide a name for the scanner.

4) Select “Generation 1” for this VM.

5) Configure the memory. Note: Recommended setting is 2048 MB or more.

6) Configure the networking as appropriate so the network adapter on the scanner can use a virtual network for communication.

7) For the virtual hard disk configuration, select “Use an existing virtual hard disk” and provide the location of the .vhdx file (obtained from the downloaded .zip file).

8) Click Next and then Finish.

9) Start the Virtual Machine.

 

Step 2: Network setting and Proxy configuration

By default, the LAN IP address is configured with DHCP enabled. To configure a static IP address, select “Set up network (LAN)”.

 

Setting static IP address instead of DHCP:
1) Using the Virtual Scanner Console, go to the main menu.

2) Select “Set up network (LAN)”.
3) Press the Right arrow to highlight “Enable static IP config on LAN”.
4) Press the Right arrow.
5) Enter settings.

 

scanner console set up lan

 

The scanner supports proxy configuration for the following:

  • IP-based and FQDN proxy host
  • with or without authentication
  • Authentication modes: Basic and NTLM

 

Note: It is recommended that the proxy server have an assigned static IP address and allows transparent SSL tunneling. Proxy-level termination (as implemented in SSL bridging, for example) is not supported. The scanner does not support proxy servers in networking environments where the proxy server IP address is dynamically assigned. SOCKS proxies are not supported.

 

Configuring a Proxy server on your scanner (Optional):
1) Using the Virtual Scanner Console, go to the main menu.
2) Select “Enable Proxy”.
3) Press the Right arrow to highlight “Enable Proxy”.
4) Press the Right arrow.
5) Enter settings.

 

scanner console enable proxy

 

Step 3: Personalize Qualys Virtual Scanner

Follow these steps to personalize the scanner:
1) Using the Virtual Scanner Console, go to the main menu.
2) Select “Personalize this scanner”.
3) Press the Right arrow to highlight “Personalize this scanner”.
4) Press the Right arrow.
5) Enter 14-digit Personalization code.

 

scanner console personalize

 

After entering the Personalization code, the activation process starts, and the service reports the progress. Activation can take up to 10 minutes to complete.

 

scanner console personalize progress bar

 

Step 4: Check the scanner status in Qualys

To confirm that the scanner is ready to use, check the virtual scanner status in Qualys UI. Go to Scans > Appliances and find your scanner in the list. Check that the scanner's status is Connected.

 

Tip - It can take several minutes for the Qualys user interface to get updated after you add a new appliance. Please refresh your browser periodically to ensure that you are seeing the most up to date details.

 

Appliances list in UI

 

Enabling WAN for Split Network Configuration

If the Virtual scanner appliance is already deployed and you would like to enable WAN for split-Network scanning configuration, a second network interface needs to be first configured on the virtual machine’s hardware settings and then on Qualys scanner. We recommend the following steps to enable split-network scanning configuration within Hyper-V.

 

Step 1: Power off the Virtual Scanner Appliance

Turn off the virtual scanner appliance on Hyper-V Manager

 

Step 2: Edit the Virtual Scanner Appliance Hardware Settings

Add a new Network Adapter. Network Adapter 1 should be set to the LAN destination network and Network Adapter 2 should be set to the WAN destination network.

 

Split Network Configuration

 

Step 3: Power on the Virtual Scanner Appliance

Start the Virtual scanner appliance on Hyper-V Manager.

 

Step 4: Enable WAN interface on the Virtual Scanner Appliance in Hyper-V

Follow these steps to enable WAN interface:

1) Using the Virtual Scanner Console, go to the main menu.

2) Select “Enable WAN interface”.

3) Configure the WAN interface with either DHCP or Static IP configuration.

 

scanner console enable dhcp on wan

 

Configuring VLANs on Hyper-V

If you want to configure VLANs in Single or Split Network configuration, please follow this guide:

https://www.qualys.com/docs/qualys-scanner-vlan-hyper-v.pdf

 

Troubleshooting

For any errors and troubleshooting tips, please visit Scanner Appliance Troubleshooting and FAQs.

Attachments

    Outcomes