Welcome!

Apache Authors: Mark R. Hinkle, Carmen Gonzalez, Roger Strukhoff, Liz McMillan, Elizabeth White

Related Topics: Virtualization, SOA & WOA, .NET, Apache

Virtualization: Blog Post

Implementing Hyper-V Network Virtualization in Windows Server 2012

New virtualized network capabilities provide true network and VM portability

What is Hyper-V Network Virtualization?

Any Service, Any Server, Any Data Center or Cloud!

True network and virtual machine portability - that's the ultimate goal of Hyper-V Network Virtualization - allowing you, as an IT Pro, to align changing business needs with the best physical resource locations to run your VMs and network services - easily, without the sweeping network, router, switch, firewall and DNS changes with which we'd traditionally be plagued when merely attempting the feat of relocating VMs to a new rack, subnet or data center ... WOW!

Windows Server 2012 and our FREE Hyper-V Server 2012 include a new network virtualization feature that permits the configuration of "software-defined networking (SDN)" within the native Hyper-V hypervisor.  Hyper-V Network Virtualization extends the virtualization benefits we've realized when virtualizing server workloads into the network layer to decouple our physical network infrastructure from logical layer-2 and layer-3 subnets as illustrated below:

Sounds Interesting! But, Why Use Hyper-V Network Virtualization Instead of Traditional VLANs?

Hyper-V Network Virtualization was intended to address the limitations and complexity seen in typical environments using VLANs, such as:

  • Limited scalability - typical network switch configurations permit only 1,000 VLANs out of a maximum of 4,094 VLAN IDs.  In contrast, Hyper-V Network Virtualization can scale to support over 16 million virtualized networks.
  • Configuration cost and complexity - environments using many VLANs need to carefully manage VLAN configurations on each switch, host and virtual machine to ensure a consistent experience.  In addition, enterprise VLAN configurations can require network switches with advanced processing capabilities from a single hardware vendor, often times making it difficult to cost effectively expand virtual network capacity.  Hyper-V Network Virtualization can be centrally implemented via network virtualization policies across a diverse network switch infrastructure and does not require special capabilities in the underlying network hardware.
  • Constrained to a single subnet - Traditional VLANs are constrained to a single subnet, and although VLANs can be extended across physical sites, they must stretch one subnet at the network layer across those physical locations, which can cause extreme routing challenges - particularly when trying to leverage a combination of private data center resources along with hosted or public cloud resources.  Hyper-V Network Virtualization can present virtualized networks across diverse IP networks that extend across private, hosted and public cloud resources.

By removing these limitations, Hyper-V Network Virtualization extends the value of virtualization features that rely on network configurations.  As a I discuss these capabilities with IT Pros at our IT Camp events, three of the new scenarios that they are really excited about include:

  1. Cross-subnet Live Migration of Virtual Machines - Live migrate running virtual machines to Hyper-V hosts on a different physical network subnet!  Hyper-V Network Virtualization extends virtualized subnets across one or more physical IP subnets, allowing Live Migration to be used across physical subnet boundaries. 

    Note: Cross-subnet Live Migration with Hyper-V Network Virtualization requires the use of Hyper-V over SMB 3.0 to provide shared VM storage to Hyper-V hosts on each physical subnet.  Hyper-V over SMB 3.0 uses cost effective file shares on Windows Server 2012 to provide a shared storage location that each Hyper-V can access for running and live migrating virtual machines.
  2. IP Address and VM Portability across subnets and premises - As business needs change, re-locate VMs to any datacenter, hosting provider or public cloud location WITHOUT changing the existing IP Addresses of the VMs! Today, numerous configuration choices are tied to the IP Address of each virtual machine - physical datacenter location, firewall rules, router ACLs, directory services roles, etc - and this can make changing the IP Address of a deployed virtual machine a painful process.  As a result, many shops find that it's difficult to move VMs new host locations - such as new datacenter, hosted or public cloud locations - as business needs change, because these moves would generally require IP Address changes - not so with Hyper-V Network Virtualization!
  3. Multi-tenancy with Overlapping IP Address ranges - This is a great solution for Hosting Providers, who need to ensure that each customer's collection of virtual machines are completely isolated at a network layer from other customers.  Each virtualized network can also use the customer's native IP addressing scheme, even if it would normally conflict with IP addressing schemes used by other customers.

How Does Hyper-V Network Virtualization Work?
Hyper-V Network Virtualization is implemented in Windows Server 2012 and Hyper-V Server 2012 as a new network driver module, Windows Network Virtualization (aka "ms_netwnv").  This module can be bound to physical NICs on each server and configured with a set of policies to virtualize network addressing and routing rules.  When configuring network virtualization, two different configuration approaches can be used:

  • Generic Routing Encapsulation (NVGRE) - this approach builds GRE (RFC 2784 and 2890) tunnels between Hyper-V hosts to encapsulate virtualized networks using the details outlined  in the NVGRE Draft RFC document that has been submitted to the Internet Engineering Task Force (IETF).  This draft RFC document was assembled by a committee of networking veterans that includes senior engineers from Intel, DELL, HP, Emulex, Broadcom and Microsoft.  NVGRE is the preferred configuration approach for most network virtualization scenarios with Hyper-V hosts.
  • IP Address Rewrite (IP Rewrite) - this approach uses a NAT-like approach at each Hyper-V host to rewrite virtualized network addresses to native network addresses that can be routed across the physical network architecture.  IP Rewrite is intended for scenarios where Virtual Machines require extremely high-performance network bandwidth, such as 10 Gbps Ethernet, since traditional NIC offload mechanisms are supported to increase throughput.

Since NVGRE is the preferred choice for most network virtualization scenarios, we'll be focusing on this approach for the reminder of this article.  However, check out this article if you're interested in more details on IP Rewrite and a deeper comparison between the two approaches.

What Changes Are Needed to My Existing Physical Network Switches?
NONE!
NVGRE can both be implemented across an existing physical IP network without requiring changes your physical network switch architecture.  Since NVGRE tunnels terminate at each Hyper-V host, the hosts handle all of the handiwork for encapsulating and de-encapsulating network traffic.  If you have firewalls that are blocking GRE tunnels between sites, you will need to configure your firewalls to support forwarding GRE (IP Protocol 47) tunnel traffic.

Security Note: NVGRE tunnels do not natively provide encryption of payload contents.  If an NVGRE tunnel is being extended across public network segments, I recommend considering IPsec as part of your network layer policies to authenticate and encrypt network traffic end-to-end between virtual machine endpoints.

Performance Note: If you are planning to leverage NVGRE to virtualize heavy network IO workloads, you should also consider network adapter hardware that supports GRE Offload within the network chipset.  Without GRE Offload support within the NIC, traditional NIC offload technologies will not work with GRE traffic.  A number of NICs supporting GRE Offload for Windows Server 2012 and Hyper-V Server 2012 are expected later this calendar year.

I'm Ready! Where Do I Start?
The best starting place is to first layout the addressing scheme for IP addresses and subnets that you'd like to virtualize.  When configuring Hyper-V Network Virtualization, there are two types of IP Addresses that you'll be interacting with:

  • Provider Addresses (PA) - these are unique IP addresses assigned to each Hyper-V host that are routable across the physical network infrastructure.  I like to think of "PA" addresses as "Physical Addresses", because they are assigned to physical Hyper-V hosts.  Each Hyper-V host requires at least one PA to be assigned.
  • Customer Addresses (CA) - these are unique IP addresses assigned to each Virtual Machine that will be participating on a virtualized network.  I like to think of "CA" addresses as "Container Addresses", because they are the IP Addresses assigned to each VM "container" for use by the guest operating system running inside that VM.  Using NVGRE, multiple CA's for VMs running on a Hyper-V host can be tunneled using a single PA on that Hyper-V host.  CA's must be unique across all VMs on the same virtualized network, but CA's do not need to be unique across virtualized networks (such as in multi-tenant scenarios where each customer's VMs are isolated on separate virtualized networks).

Let's look at a simple example of NVGRE with two Hyper-V hosts using PA's and CA's:

In this example, you'll note that each Hyper-V host is assigned one PA address ( e.g., 192.168.x.x ) used for tunneling NVGRE traffic across two physical subnets ( e.g., 192.168.1.x/24 and 192.168.2.x/24 ) on the physical network.  In addition, each VM is assigned a CA address ( e.g., 10.x.x.x ) that is unique within each virtualized network and is tunneled inside the NVGRE tunnel between hosts.

To separate the traffic between the two virtualized networks, the GRE headers on the tunneled packets include a GRE Key that provides a unique Virtual Subnet ID ( e.g., 5001 and 6001 ) for each virtualized network.

Based on this configuration, we have two virtualized networks ( e.g., the "Red" network and the "Blue" network ) that are isolated from one another as separate IP networks and extended across two physical Hyper-V hosts located on two different physical subnets.

Once you have the following defined for your environment in a worksheet, you're ready to move on to the next steps in configuring Hyper-V Network Virtualization:

  • PA's for each Hyper-V Host
  • CA's for each Virtual Machine
  • Virtual Subnet ID's for each subnet to be virtualized

Done! How Can I Configure Hyper-V Network Virtualization?
Hyper-V Network Virtualization policies can be centrally configured using PowerShell 3.0 and PowerShell Remoting for no additional cost.  In addition, System Center 2012 Virtual Machine Manager Service Pack 1, currently available as a public beta, also offers an enterprise GUI management console that can centrally deploy and manage Hyper-V Network Virtualization policies across a large number of Hyper-V hosts.

To understand the configuration steps for each type of virtual network addressing (e.g., PA's, CA's, Virtual Subnet IDs ) described above, let's step through the PowerShell 3.0 Cmdlets used to configure these policies one-by-one.  In these examples, we'll be focusing on the configuration steps for the "Blue" virtual network components on the Hyper-V hosts in the example illustrated above.

Note: If you'll be using System Center 2012 to deploy and manage network virtualization policies as noted above, you won't need to manually run the specific PowerShell 3.0 Cmdlets below because System Center 2012 will run the appropriate PowerShell Cmdlets for you automatically to deploy the policies.  But, it still never hurts to understand what's happening behind the scenes! :-)

Here we go!  Let's get started configuring Hyper-V Network Virtualization via PowerShell 3.0 ...

  1. Enable the Windows Network Virtualization binding on the physical NIC of each Hyper-V Host ( Host 1 and Host 2 )

    Enable-NetAdapterBinding Ethernet -ComponentID ms_netwnv
  2. Configure Blue Subnet Locator and Route records on each Hyper-V Host ( Host 1 and Host 2 )

    New-NetVirtualizationLookupRecord -CustomerAddress "10.1.1.11" -ProviderAddress "192.168.1.10" -VirtualSubnetID "6001" -MACAddress "101010101105" -Rule "TranslationMethodEncap"

    New-NetVirtualizationLookupRecord -CustomerAddress "10.1.1.12" -ProviderAddress "192.168.2.20" -VirtualSubnetID "6001" -MACAddress "101010101107" -Rule "TranslationMethodEncap"

    New-NetVirtualizationCustomerRoute -RoutingDomainID "{11111111-2222-3333-4444-000000000000}" -VirtualSubnetID "6001" -DestinationPrefix "10.1.1.0/24" -NextHop "0.0.0.0" -Metric 255 

    Note:
    In the last command in this step above, a "RoutingDomainID" is also specified.  While this is not a network address per-se, each collection of virtualized networks that will route between each other must have a unique administrator-defined Routing Domain ID.  Using the example above, the "Blue" subnet and "Red" subnet do not have traffic routed between each other and, as such, would each require a unique Routing Domain ID.

  3. Configure the Provider Address and Route records on Hyper-V Host 1 ( Host 1 Only )

    $NIC = Get-NetAdapter Ethernet

    New-NetVirtualizationProviderAddress -InterfaceIndex $NIC.InterfaceIndex -ProviderAddress "192.168.1.10" -PrefixLength 24

    New-NetVirtualizationProviderRoute -InterfaceIndex $NIC.InterfaceIndex -DestinationPrefix "0.0.0.0/0" -NextHop "192.168.1.1"

  4. Configure the Provider Address and Route records on Hyper-V Host 2 ( Host 2 Only )

    $NIC = Get-NetAdapter Ethernet

    New-NetVirtualizationProviderAddress -InterfaceIndex $NIC.InterfaceIndex -ProviderAddress "192.168.2.20" -PrefixLength 24

    New-NetVirtualizationProviderRoute -InterfaceIndex $NIC.InterfaceIndex -DestinationPrefix "0.0.0.0/0" -NextHop "192.168.2.1"

  5. Configure the Virtual Subnet ID on the Hyper-V Network Switch Ports for each "Blue" Virtual Machine on each Hyper-V Host ( Host 1 and Host 2 )

    Get-VMNetworkAdapter -VMName BlueVM1 | where {$_.MacAddress -eq "101010101105"} | Set-VMNetworkAdapter -VirtualSubnetID 6001

    Get-VMNetworkAdapter -VMName BlueVM2 | where {$_.MacAddress -eq "101010101107"} | Set-VMNetworkAdapter -VirtualSubnetID 6001

That's it! Once you've gone through these 5 steps, you should now be able to route traffic between Virtual Machines across virtual subnet 10.1.1.x/24.

Note: If Windows Firewall is enabled on the operating system within each Virtual Machine, you may need to configure Windows Firewall within each VM to allow the traffic you're using to test.  For example, to permit ping traffic between VM's with Windows Firewall enabled, you can use the following PowerShell 3.0 Cmdlets in each VM:

New-NetFirewallRule –DisplayName “Allow ICMPv4-In” –Protocol ICMPv4

New-NetFirewallRule –DisplayName “Allow ICMPv4-Out” –Protocol ICMPv4 –Direction Outbound

What's Next? Keep Going!

Below are some great resources to continue your learning process on Hyper-V Network Virtualization ...

How Are You Planning to Use Hyper-V Network Virtualization?

Have you found an interesting use case in your environment for Hyper-V Network Virtualization?  Be sure to share your story in the comments below!

HTH,

Keith

Build Your Lab! Build Your Lab! Download Windows Server 2012
Build Your Lab in the Cloud! Don’t Have a Lab? Build Your Lab in the Cloud with Windows Azure Virtual Machines
Join our "Early Experts" study group! Want to Get Certified? Join our Windows Server 2012 "Early Experts" Study Group

More Stories By Keith Mayer

Keith Mayer is a Technical Evangelist at Microsoft focused on Windows Infrastructure, Data Center Virtualization, Systems Management and Private Cloud. Keith has over 17 years of experience as a technical leader of complex IT projects, in diverse roles, such as Network Engineer, IT Manager, Technical Instructor and Consultant. He has consulted and trained thousands of IT professionals worldwide on the design and implementation of enterprise technology solutions.

Keith is currently certified on several Microsoft technologies, including System Center, Hyper-V, Windows, Windows Server, SharePoint and Exchange. He also holds other industry certifications from IBM, Cisco, Citrix, HP, CheckPoint, CompTIA and Interwoven.

Keith is the author of the IT Pros ROCK! Blog on Microsoft TechNet, voted as one of the Top 50 "Must Read" IT Blogs.

Keith also manages the Windows Server 2012 "Early Experts" Challenge - a FREE online study group for IT Pros interested in studying and preparing for certification on Windows Server 2012. Join us and become the next "Early Expert"!

@ThingsExpo Stories
Samsung VP Jacopo Lenzi, who headed the company's recent SmartThings acquisition under the auspices of Samsung's Open Innovaction Center (OIC), answered a few questions we had about the deal. This interview was in conjunction with our interview with SmartThings CEO Alex Hawkinson. IoT Journal: SmartThings was developed in an open, standards-agnostic platform, and will now be part of Samsung's Open Innovation Center. Can you elaborate on your commitment to keep the platform open? Jacopo Lenzi: Samsung recognizes that true, accelerated innovation cannot be driven from one source, but requires a...
Explosive growth in connected devices. Enormous amounts of data for collection and analysis. Critical use of data for split-second decision making and actionable information. All three are factors in making the Internet of Things a reality. Yet, any one factor would have an IT organization pondering its infrastructure strategy. How should your organization enhance its IT framework to enable an Internet of Things implementation? In his session at Internet of @ThingsExpo, James Kirkland, Chief Architect for the Internet of Things and Intelligent Systems at Red Hat, will describe how to revoluti...
The Internet of Things will greatly expand the opportunities for data collection and new business models driven off of that data. In her session at Internet of @ThingsExpo, Esmeralda Swartz, CMO of MetraTech, will discuss how for this to be effective you not only need to have infrastructure and operational models capable of utilizing this new phenomenon, but increasingly service providers will need to convince a skeptical public to participate. Get ready to show them the money! Speaker Bio: Esmeralda Swartz, CMO of MetraTech, has spent 16 years as a marketing, product management, and busin...
SYS-CON Events announced today that Red Hat, the world's leading provider of open source solutions, will exhibit at Internet of @ThingsExpo, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Red Hat is the world's leading provider of open source software solutions, using a community-powered approach to reliable and high-performing cloud, Linux, middleware, storage and virtualization technologies. Red Hat also offers award-winning support, training, and consulting services. As the connective hub in a global network of enterprises, partners, a...
P2P RTC will impact the landscape of communications, shifting from traditional telephony style communications models to OTT (Over-The-Top) cloud assisted & PaaS (Platform as a Service) communication services. The P2P shift will impact many areas of our lives, from mobile communication, human interactive web services, RTC and telephony infrastructure, user federation, security and privacy implications, business costs, and scalability. In his session at Internet of @ThingsExpo, Robin Raymond, Chief Architect at Hookflash Inc., will walk through the shifting landscape of traditional telephone a...
SYS-CON Events announced today that Matrix.org has been named “Silver Sponsor” of Internet of @ThingsExpo, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Matrix is an ambitious new open standard for open, distributed, real-time communication over IP. It defines a new approach for interoperable Instant Messaging and VoIP based on pragmatic HTTP APIs and WebRTC, and provides open source reference implementations to showcase and bootstrap the new standard. Our focus is on simplicity, security, and supporting the fullest feature set.
BSQUARE is a global leader of embedded software solutions. We enable smart connected systems at the device level and beyond that millions use every day and provide actionable data solutions for the growing Internet of Things (IoT) market. We empower our world-class customers with our products, services and solutions to achieve innovation and success. For more information, visit www.bsquare.com.
How do APIs and IoT relate? The answer is not as simple as merely adding an API on top of a dumb device, but rather about understanding the architectural patterns for implementing an IoT fabric. There are typically two or three trends: Exposing the device to a management framework Exposing that management framework to a business centric logic • Exposing that business layer and data to end users. This last trend is the IoT stack, which involves a new shift in the separation of what stuff happens, where data lives and where the interface lies. For instance, it’s a mix of architectural style...
SYS-CON Events announced today that SOA Software, an API management leader, will exhibit at SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. SOA Software is a leading provider of API Management and SOA Governance products that equip business to deliver APIs and SOA together to drive their company to meet its business strategy quickly and effectively. SOA Software’s technology helps businesses to accelerate their digital channels with APIs, drive partner adoption, monetize their assets, and achieve a...
From a software development perspective IoT is about programming "things," about connecting them with each other or integrating them with existing applications. In his session at @ThingsExpo, Yakov Fain, co-founder of Farata Systems and SuranceBay, will show you how small IoT-enabled devices from multiple manufacturers can be integrated into the workflow of an enterprise application. This is a practical demo of building a framework and components in HTML/Java/Mobile technologies to serve as a platform that can integrate new devices as they become available on the market.
SYS-CON Events announced today that Utimaco will exhibit at SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Utimaco is a leading manufacturer of hardware based security solutions that provide the root of trust to keep cryptographic keys safe, secure critical digital infrastructures and protect high value data assets. Only Utimaco delivers a general-purpose hardware security module (HSM) as a customizable platform to easily integrate into existing software solutions, embed business logic and build s...
Connected devices are changing the way we go about our everyday life, from wearables to driverless cars, to smart grids and entire industries revolutionizing business opportunities through smart objects, capable of two-way communication. But what happens when objects are given an IP-address, and we rely on that connection, sometimes with our lives? How do we secure those vast data infrastructures and safe-keep the privacy of sensitive information? This session will outline how each and every connected device can uphold a core root of trust via a unique cryptographic signature – a “bir...
Internet of @ThingsExpo Silicon Valley announced on Thursday its first 12 all-star speakers and sessions for its upcoming event, which will take place November 4-6, 2014, at the Santa Clara Convention Center in California. @ThingsExpo, the first and largest IoT event in the world, debuted at the Javits Center in New York City in June 10-12, 2014 with over 6,000 delegates attending the conference. Among the first 12 announced world class speakers, IBM will present two highly popular IoT sessions, which will take place November 4-6, 2014 at the Santa Clara Convention Center in Santa Clara, Calif...
Almost everyone sees the potential of Internet of Things but how can businesses truly unlock that potential. The key will be in the ability to discover business insight in the midst of an ocean of Big Data generated from billions of embedded devices via Systems of Discover. Businesses will also need to ensure that they can sustain that insight by leveraging the cloud for global reach, scale and elasticity.
WebRTC defines no default signaling protocol, causing fragmentation between WebRTC silos. SIP and XMPP provide possibilities, but come with considerable complexity and are not designed for use in a web environment. In his session at Internet of @ThingsExpo, Matthew Hodgson, technical co-founder of the Matrix.org, will discuss how Matrix is a new non-profit Open Source Project that defines both a new HTTP-based standard for VoIP & IM signaling and provides reference implementations.

SUNNYVALE, Calif., Oct. 20, 2014 /PRNewswire/ -- Spansion Inc. (NYSE: CODE), a global leader in embedded systems, today added 96 new products to the Spansion® FM4 Family of flexible microcontrollers (MCUs). Based on the ARM® Cortex®-M4F core, the new MCUs boast a 200 MHz operating frequency and support a diverse set of on-chip peripherals for enhanced human machine interfaces (HMIs) and machine-to-machine (M2M) communications. The rich set of periphera...

SYS-CON Events announced today that Aria Systems, the recurring revenue expert, has been named "Bronze Sponsor" of SYS-CON's 15th International Cloud Expo®, which will take place on November 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Aria Systems helps leading businesses connect their customers with the products and services they love. Industry leaders like Pitney Bowes, Experian, AAA NCNU, VMware, HootSuite and many others choose Aria to power their recurring revenue business and deliver exceptional experiences to their customers.
The Internet of Things (IoT) is going to require a new way of thinking and of developing software for speed, security and innovation. This requires IT leaders to balance business as usual while anticipating for the next market and technology trends. Cloud provides the right IT asset portfolio to help today’s IT leaders manage the old and prepare for the new. Today the cloud conversation is evolving from private and public to hybrid. This session will provide use cases and insights to reinforce the value of the network in helping organizations to maximize their company’s cloud experience.
The Internet of Things (IoT) is making everything it touches smarter – smart devices, smart cars and smart cities. And lucky us, we’re just beginning to reap the benefits as we work toward a networked society. However, this technology-driven innovation is impacting more than just individuals. The IoT has an environmental impact as well, which brings us to the theme of this month’s #IoTuesday Twitter chat. The ability to remove inefficiencies through connected objects is driving change throughout every sector, including waste management. BigBelly Solar, located just outside of Boston, is trans...
SYS-CON Events announced today that Matrix.org has been named “Silver Sponsor” of Internet of @ThingsExpo, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Matrix is an ambitious new open standard for open, distributed, real-time communication over IP. It defines a new approach for interoperable Instant Messaging and VoIP based on pragmatic HTTP APIs and WebRTC, and provides open source reference implementations to showcase and bootstrap the new standard. Our focus is on simplicity, security, and supporting the fullest feature set.