Configuring Hyper-V virtual switches creates the network foundation for virtual machines. There are three main types, each controlling how VMs communicate. An external switch connects VMs to the physical network and the internet, allowing them to talk to other VMs on the same host and to external resources. An internal switch lets VMs talk to each other and to the Hyper-V host itself, but not to any outside network, which is useful for isolated testing environments. A private switch is the most restrictive, allowing communication only between VMs on the same host, with no access to the host or the external network.
To further organize and secure traffic, you can use VLAN tagging on virtual switches. This creates separate network segments within the same physical hardware. You assign a unique VLAN ID (a number from 1 to 4094) to a group of VMs. Each VLAN gets its own IP address space and a gateway address, and you can assign specific DNS servers. This setup ensures that VMs in one VLAN can only communicate with other VMs in the same VLAN unless a router is configured to connect them, which helps isolate sensitive workloads.
Securing a virtual switch involves adding specific controls to manage traffic. Port Access Control Lists (ACLs) are rules you apply directly to a virtual switch port to block or allow traffic based on IP addresses or protocols, providing a layer of network security. You can also use switch extensions to add advanced features like traffic monitoring or filtering. For reliability and performance, you can use switch teaming, which combines multiple physical network adapters into a single logical adapter for redundancy and increased bandwidth.
After configuration, you must check that the network works as intended. You can use PowerShell commands, like Get-HcsVirtualNetwork, to verify the network and subnet settings for the switch. You should then test that VMs on the same switch and VLAN can communicate with each other and that VMs on different VLANs or switch types are properly isolated as planned. This validation confirms both connectivity and security.
In a hybrid environment, you need to connect your on-premises Hyper-V hosts to Azure virtual networks. This is typically done using a VPN gateway or an ExpressRoute connection, which creates a secure tunnel between your local network and Azure. Once connected, VMs on your Hyper-V external switches can communicate with resources in Azure. You can use services like Azure Firewall to control the flow of traffic into and out of your Azure network, extending your security policies to the cloud.
Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Prepare and test your skills
Prepare and test your skills
The three types are external, internal, and private switches. An external switch connects virtual machines to the physical network and the internet. An internal switch allows VMs to communicate with each other and the Hyper-V host but not external networks. A private switch is the most restrictive, allowing communication only between VMs on the same host with no access to the host or external network.
VLAN tagging creates separate network segments within the same physical hardware by assigning a unique VLAN ID to a group of VMs. The supported VLAN ID range is 1 to 4094, with each VLAN getting its own IP address space, gateway address, and DNS servers.
Security features include Port Access Control Lists (ACLs), which are rules applied to virtual switch ports to block or allow traffic based on IP addresses or protocols. Switch extensions can add advanced features like traffic monitoring or filtering. Switch teaming combines multiple physical network adapters into a single logical adapter for redundancy and increased bandwidth.
Connection is typically done using a VPN gateway or an ExpressRoute connection, which creates a secure tunnel between the local network and Azure. Once connected, VMs on Hyper-V external switches can communicate with resources in Azure, and you can use Azure Firewall to control traffic flow into and out of the Azure network.
StudyCerts
StudyCerts