1 November 2026, 18:06Виталий Лещенко

Hyper-V. Part 4: Setting up virtual machine networking

In the first part we created one external switch and connected a machine to it. Here we will look at Hyper-V networking as a whole: what kinds of virtual switches there are and what happens to the host's network card, how to give machines VLANs and private VLANs, how to combine several network cards and how to maintain the machines' network adapters — from adding them on the fly to protection against a rogue DHCP server.

Virtual switches

A machine's virtual network card is connected to a virtual switch — a software Ethernet switch inside the root partition (Hyper-V Virtual Switch overview). Like a real one, it learns MAC addresses on its ports and forwards frames between them. There are three types (creating a switch):

External — bound to a physical network card of the host; machines go out through it to the regular network.
Internal — connects machines to each other and to the host, but not to the external network.
Private — connects only machines; the host does not take part in this network.

       External               Internal             Private
┌──────────────────────┐  ┌─────────────────┐  ┌───────────────┐
│ VM1   VM2   host     │  │  VM3     host   │  │  VM4    VM5   │
│  │     │     │       │  │   │       │     │  │   │      │    │
│ ─┴─────┴─────┴───┬── │  │ ──┴───────┴──── │  │ ──┴──────┴─── │
└──────────────────┼───┘  └─────────────────┘  └───────────────┘
                   │
             physical NIC
                   │
            office network

Get-NetAdapter
New-VMSwitch -Name 'LAN' -NetAdapterName 'Ethernet 1' -AllowManagementOS $true
New-VMSwitch -Name 'Lab' -SwitchType Internal
New-VMSwitch -Name 'Isolated' -SwitchType Private
Get-VMSwitch | Format-Table Name, SwitchType, NetAdapterInterfaceDescription, AllowManagementOS

The external type is set implicitly — with the -NetAdapterName or -NetAdapterInterfaceDescription parameter; the other two need -SwitchType (New-VMSwitch).

What happens to the host's network card

Once bound to an external switch, the physical card stops being an ordinary network card of the host: only the Hyper-V switch extension remains on it, and it no longer has IP addresses. With -AllowManagementOS $true the host gets a new virtual adapter vEthernet (<switch name>) connected to the same switch, and the IP settings of the physical card move to it. With $false the card is given entirely to the machines, and the host does not take part in this network — this is done for a separate card dedicated to machine traffic.

That is why creating an external switch on a server you are connected to remotely drops the session for a few seconds — exactly what the first part warned about.

Get-NetAdapter | Format-Table Name, InterfaceDescription, Status, MacAddress
Get-NetIPAddress -AddressFamily IPv4 | Format-Table InterfaceAlias, IPAddress, PrefixLength
Get-VMNetworkAdapter -ManagementOS | Format-Table Name, SwitchName, MacAddress

The host can have several adapters on one switch — for management, live migration, the cluster; they are added by Add-VMNetworkAdapter -ManagementOS, more on them below in the section about SET.

To rename a switch or change its card or type — Set-VMSwitch and Rename-VMSwitch; to delete it — Remove-VMSwitch, and the machines' adapters on it remain but become disconnected (Set-VMSwitch).

VLAN

How VLANs work is covered in the part about VLANs of the networking series. In Hyper-V the tags are added and removed by the virtual switch itself: the physical port the host's card is connected to is configured as a trunk with all the required VLANs, and a VLAN is assigned to each virtual network card separately (Set-VMNetworkAdapterVlan).

An adapter has four modes, and they are mutually exclusive:

Mode	Parameters	What the machine sees
Untagged	`-Untagged`	frames without a tag, as if there were no VLAN; the default mode
Access	`-Access -VlanId 20`	a regular network without tags; the switch adds and removes tag 20 itself
Trunk	`-Trunk -AllowedVlanIdList '10-30' -NativeVlanId 1`	frames with tags from the list; native VLAN frames arrive without a tag
Private VLAN	`-Isolated`, `-Community`, `-Promiscuous`	more on this below

Set-VMNetworkAdapterVlan -VMName app1 -Access -VlanId 20
Set-VMNetworkAdapterVlan -VMName fw1 -Trunk -AllowedVlanIdList '10,20,30' -NativeVlanId 1
Set-VMNetworkAdapterVlan -ManagementOS -VMNetworkAdapterName 'LAN' -Access -VlanId 10
Set-VMNetworkAdapterVlan -VMName test1 -Untagged
Get-VMNetworkAdapterVlan -VMName app1, fw1

Access is the mode for ordinary machines: the guest knows nothing about VLANs. Trunk is needed by a machine that works with tags itself — a router or a firewall that has interfaces in different VLANs inside. The third line puts the host's own adapter — that same vEthernet (LAN) — into VLAN 10; if you do this remotely over this very adapter and the physical switch port does not pass VLAN 10, the connection to the host is lost.

When a machine has several adapters, specify -VMNetworkAdapterName: without it the command changes the VLAN on all adapters of the machine at once. Changing the VLAN on the fly looks to the guest like moving to another network: an address from the old subnet stops working until it is changed.

Private VLANs

Within one VLAN all machines see each other. When one subnet holds machines of different customers, or servers that have no reason to talk to each other, the Hyper-V switch supports private VLANs (PVLAN): a port gets two numbers — a primary VLAN and a secondary one — and one of three modes (PVLAN in Hyper-V Virtual Switch):

Mode	Exchanges frames with
Isolated	only the Promiscuous ports of its PVLAN
Community	the ports of its community (the same secondary VLAN) and the Promiscuous ports
Promiscuous	all ports of the PVLAN

A typical setup is a gateway or firewall in Promiscuous mode with machines behind it: web servers that must not see each other in Isolated, a pair of application servers that need to talk to each other in their own Community (Set-VMNetworkAdapterVlan):

Set-VMNetworkAdapterVlan -VMName web1, web2 -Isolated  -PrimaryVlanId 10 -SecondaryVlanId 200
Set-VMNetworkAdapterVlan -VMName app1, app2 -Community -PrimaryVlanId 10 -SecondaryVlanId 201
Set-VMNetworkAdapterVlan -VMName gw1 -Promiscuous -PrimaryVlanId 10 -SecondaryVlanIdList '200-201'
Get-VMNetworkAdapterVlan -VMName web1, web2, app1, app2, gw1

Isolated and Community are set with a single secondary VLAN (-SecondaryVlanId), Promiscuous with the list of all the secondary VLANs it serves (-SecondaryVlanIdList). All of this works inside the Hyper-V switch, but if machines of one PVLAN are on different hosts, the physical switches between them must pass both the primary and the secondary VLANs (same source).

Several cards: SET

Fault tolerance of the host's network is provided by combining several physical cards. For Hyper-V this is SET (Switch Embedded Teaming): the team is built inside the virtual switch itself, and a team can have up to eight cards (SET in the host network requirements). The old LBFO teaming (New-NetLbfoTeam) still works, but since Windows Server 2022 a virtual switch cannot be bound to it — only to SET (removed and deprecated features).

New-VMSwitch -Name 'SETswitch' -NetAdapterName 'NIC1', 'NIC2' -EnableEmbeddedTeaming $true -AllowManagementOS $true
Get-VMSwitchTeam -Name 'SETswitch' | Format-List

The cards in a SET team must be identical — vendor, model, speed. On top of such a switch the host gets several virtual adapters for different tasks — management, live migration, the cluster — each in its own VLAN:

Add-VMNetworkAdapter -ManagementOS -SwitchName 'SETswitch' -Name 'LiveMigration'
Set-VMNetworkAdapterVlan -ManagementOS -VMNetworkAdapterName 'LiveMigration' -Access -VlanId 40
New-NetIPAddress -InterfaceAlias 'vEthernet (LiveMigration)' -IPAddress 192.168.40.11 -PrefixLength 24

To add a card to the team or remove one from it — Add-VMSwitchTeamMember and Remove-VMSwitchTeamMember (Add-VMSwitchTeamMember).

In clusters on Windows Server 2025 this work can be done by Network ATC: you describe the purpose of the cards (intent — management, compute, storage), and it creates SET, the adapters and the VLANs itself, identically on all nodes (Network ATC).

The machine's network adapters

See the machine's adapters with the switch, MAC, addresses and VLAN:

Get-VMNetworkAdapter -VMName app1 | Format-Table Name, SwitchName, MacAddress, Status, IPAddresses
Get-VMNetworkAdapterVlan -VMName app1

The IPAddresses column is filled in by the Data Exchange integration service from the second part: for a machine without integration services it is empty.

Add an adapter. On a generation 2 machine — on the fly, on generation 1 — only on a machine that is turned off (compatibility table). It is worth giving the adapter a name right away and enabling -DeviceNaming: then the Hyper-V adapter name is visible inside the guest, and you can find the right card by it instead of guessing between Ethernet 2 and Ethernet 3 (Add-VMNetworkAdapter; how the name looks in the guest is shown in a post by the Hyper-V team):

$cred = Get-Credential 'app1\Administrator'
Add-VMNetworkAdapter -VMName app1 -SwitchName 'LAN' -Name 'Backup' -DeviceNaming On
Set-VMNetworkAdapterVlan -VMName app1 -VMNetworkAdapterName 'Backup' -Access -VlanId 50

Invoke-Command -VMName app1 -Credential $cred {
    $nic = Get-NetAdapterAdvancedProperty -DisplayName 'Hyper-V Network Adapter Name' |
           Where-Object DisplayValue -eq 'Backup'
    Rename-NetAdapter -Name $nic.Name -NewName 'Backup'
    New-NetIPAddress -InterfaceAlias 'Backup' -IPAddress 192.168.50.21 -PrefixLength 24
}

Invoke-Command -VMName is PowerShell Direct, commands inside the guest over VMBus; it is covered in detail in the part about management from a workstation. A gateway is usually not set on the second card: a machine has only one default route.

Rename an adapter — Rename-VMNetworkAdapter -VMName app1 -Name 'Network Adapter' -NewName 'LAN' (Rename-VMNetworkAdapter). The first adapter created by New-VM is called Network Adapter; on machines created in Hyper-V Manager on Russian-language Windows it is Сетевой адаптер (the localized "Network Adapter"). When there are several adapters, all other commands need the names: without -VMNetworkAdapterName or -Name they act on all adapters of the machine at once.

Switch to another switch or disconnect from the network without removing the adapter (Connect-VMNetworkAdapter, Disconnect-VMNetworkAdapter):

Connect-VMNetworkAdapter    -VMName app1 -Name 'LAN' -SwitchName 'SETswitch'
Disconnect-VMNetworkAdapter -VMName app1 -Name 'Backup'

A disconnected adapter stays in the guest with "Network cable unplugged" — handy for isolating a machine for a while without losing its settings.

Remove an adapter — Remove-VMNetworkAdapter -VMName app1 -Name 'Backup' (Remove-VMNetworkAdapter); on a generation 2 machine also on the fly.

MAC address

By default Hyper-V gives an adapter a dynamic MAC from the host's pool, and when the machine moves to another host it may change. If a license or a DHCP reservation depends on the MAC, the address is pinned (Set-VMNetworkAdapter); it is changed on a machine that is turned off:

Set-VMNetworkAdapter -VMName app1 -Name 'LAN' -StaticMacAddress '00155D010A21'
Get-VMNetworkAdapter -VMName app1 | Format-Table Name, MacAddress, DynamicMacAddressEnabled
Get-VMHost | Format-List MacAddressMinimum, MacAddressMaximum

The host's pool is the MacAddressMinimum…MacAddressMaximum range in the 00-15-5D prefix, which belongs to Microsoft; by default it has 256 addresses. When several hosts are in the same network, their pools must not overlap: compare Get-VMHost on all hosts, and change an overlapping range manually with Set-VMHost -MacAddressMinimum -MacAddressMaximum (Set-VMHost).

Protection and special modes

Three Set-VMNetworkAdapter switches protect the network from a machine (Set-VMNetworkAdapter):

-DhcpGuard On drops DHCP server replies from the machine — protection against an accidental DHCP server in the guest.
-RouterGuard On drops Router Advertisement and Redirect from the machine — the same for IPv6.
-MacAddressSpoofing On, on the contrary, allows the machine to send frames with someone else's MAC. It is needed if the machine runs its own Hyper-V (nested virtualization), NLB or a software switch inside; it is off by default.

Get-VM | Where-Object Name -notin 'dhcp1', 'fw1' | Get-VMNetworkAdapter |
    Set-VMNetworkAdapter -DhcpGuard On -RouterGuard On
Get-VM | Get-VMNetworkAdapter | Format-Table VMName, Name, DhcpGuard, RouterGuard, MacAddressSpoofing

The first command enables both protections for all machines except the real DHCP server and the firewall.

Bandwidth

-MaximumBandwidth is the ceiling in bits per second, -MinimumBandwidthWeight is the guaranteed share relative to other adapters of the same switch; the weight works only if the switch was created with -MinimumBandwidthMode Weight — the mode of an existing switch cannot be changed (New-VMSwitch):

Set-VMNetworkAdapter -VMName app1 -Name 'Backup' -MaximumBandwidth 1GB   # 1GB here is 1,073,741,824 bit/s
Get-VMSwitch | Format-Table Name, BandwidthReservationMode

Looking at it by hand

Switches, machine and host adapters, their VLANs and MAC addresses in one table:

Get-VMNetworkAdapter -All | Format-Table VMName, Name, SwitchName, MacAddress,
    @{n='VLAN'; e={ $v = Get-VMNetworkAdapterVlan -VMNetworkAdapter $_; "$($v.OperationMode) $($v.AccessVlanId)" }}, IPAddresses

For host adapters VMName is empty and IsManagementOs is True. Adapters not connected to any switch are a common cause of "a machine without network":

Get-VM | Get-VMNetworkAdapter | Where-Object { -not $_.SwitchName } | Format-Table VMName, Name, MacAddress

Sources

Hyper-V Virtual Switch — how the virtual switch works;
Create and configure a virtual switch with Hyper-V — switch types, sharing the card with the host, VLAN of the host adapter;
New-VMSwitch and Set-VMSwitch — creating and changing switches, the bandwidth reservation mode;
Set-VMNetworkAdapterVlan — adapter VLAN modes, private VLANs;
What's New in Hyper-V Virtual Switch in Windows Server 2012 — private VLANs and trunk mode, the requirement for physical switches;
Host network requirements — SET and card requirements;
Features removed or no longer developed in Windows Server — LBFO and the virtual switch;
Add-VMSwitchTeamMember — SET team membership;
Network ATC — intent-based network configuration of nodes;
Hyper-V feature compatibility by generation and guest — hot add of network adapters;
Add-VMNetworkAdapter, Rename-VMNetworkAdapter, Connect-VMNetworkAdapter, Disconnect-VMNetworkAdapter and Remove-VMNetworkAdapter — machine adapters;
Network Device Naming in Hyper-V — how the adapter name is visible in the guest;
Set-VMNetworkAdapter and Set-VMHost — MAC addresses and their pool, DhcpGuard, RouterGuard, MacAddressSpoofing, bandwidth.

A machine's network in Hyper-V is a virtual switch bound to a card or a team of the host's cards, and ports on it with their own VLANs, MAC addresses, protections and bandwidth.

Next — part 5: allocating processors and memory. The number of virtual processors, reserve, limit and weight, SMT and NUMA, static and dynamic memory, Smart Paging, what can be changed on a running machine, nested virtualization and resource metering.