Welcome!

Apache Authors: Sematext Blog, Pat Romanski, Yeshim Deniz, Elizabeth White, Carmen Gonzalez

Related Topics: Virtualization, SOA & WOA, .NET, Apache

Virtualization: Blog Post

Implementing Hyper-V Network Virtualization in Windows Server 2012

New virtualized network capabilities provide true network and VM portability

What is Hyper-V Network Virtualization?

Any Service, Any Server, Any Data Center or Cloud!

True network and virtual machine portability - that's the ultimate goal of Hyper-V Network Virtualization - allowing you, as an IT Pro, to align changing business needs with the best physical resource locations to run your VMs and network services - easily, without the sweeping network, router, switch, firewall and DNS changes with which we'd traditionally be plagued when merely attempting the feat of relocating VMs to a new rack, subnet or data center ... WOW!

Windows Server 2012 and our FREE Hyper-V Server 2012 include a new network virtualization feature that permits the configuration of "software-defined networking (SDN)" within the native Hyper-V hypervisor.  Hyper-V Network Virtualization extends the virtualization benefits we've realized when virtualizing server workloads into the network layer to decouple our physical network infrastructure from logical layer-2 and layer-3 subnets as illustrated below:

Sounds Interesting! But, Why Use Hyper-V Network Virtualization Instead of Traditional VLANs?

Hyper-V Network Virtualization was intended to address the limitations and complexity seen in typical environments using VLANs, such as:

  • Limited scalability - typical network switch configurations permit only 1,000 VLANs out of a maximum of 4,094 VLAN IDs.  In contrast, Hyper-V Network Virtualization can scale to support over 16 million virtualized networks.
  • Configuration cost and complexity - environments using many VLANs need to carefully manage VLAN configurations on each switch, host and virtual machine to ensure a consistent experience.  In addition, enterprise VLAN configurations can require network switches with advanced processing capabilities from a single hardware vendor, often times making it difficult to cost effectively expand virtual network capacity.  Hyper-V Network Virtualization can be centrally implemented via network virtualization policies across a diverse network switch infrastructure and does not require special capabilities in the underlying network hardware.
  • Constrained to a single subnet - Traditional VLANs are constrained to a single subnet, and although VLANs can be extended across physical sites, they must stretch one subnet at the network layer across those physical locations, which can cause extreme routing challenges - particularly when trying to leverage a combination of private data center resources along with hosted or public cloud resources.  Hyper-V Network Virtualization can present virtualized networks across diverse IP networks that extend across private, hosted and public cloud resources.

By removing these limitations, Hyper-V Network Virtualization extends the value of virtualization features that rely on network configurations.  As a I discuss these capabilities with IT Pros at our IT Camp events, three of the new scenarios that they are really excited about include:

  1. Cross-subnet Live Migration of Virtual Machines - Live migrate running virtual machines to Hyper-V hosts on a different physical network subnet!  Hyper-V Network Virtualization extends virtualized subnets across one or more physical IP subnets, allowing Live Migration to be used across physical subnet boundaries. 

    Note: Cross-subnet Live Migration with Hyper-V Network Virtualization requires the use of Hyper-V over SMB 3.0 to provide shared VM storage to Hyper-V hosts on each physical subnet.  Hyper-V over SMB 3.0 uses cost effective file shares on Windows Server 2012 to provide a shared storage location that each Hyper-V can access for running and live migrating virtual machines.
  2. IP Address and VM Portability across subnets and premises - As business needs change, re-locate VMs to any datacenter, hosting provider or public cloud location WITHOUT changing the existing IP Addresses of the VMs! Today, numerous configuration choices are tied to the IP Address of each virtual machine - physical datacenter location, firewall rules, router ACLs, directory services roles, etc - and this can make changing the IP Address of a deployed virtual machine a painful process.  As a result, many shops find that it's difficult to move VMs new host locations - such as new datacenter, hosted or public cloud locations - as business needs change, because these moves would generally require IP Address changes - not so with Hyper-V Network Virtualization!
  3. Multi-tenancy with Overlapping IP Address ranges - This is a great solution for Hosting Providers, who need to ensure that each customer's collection of virtual machines are completely isolated at a network layer from other customers.  Each virtualized network can also use the customer's native IP addressing scheme, even if it would normally conflict with IP addressing schemes used by other customers.

How Does Hyper-V Network Virtualization Work?
Hyper-V Network Virtualization is implemented in Windows Server 2012 and Hyper-V Server 2012 as a new network driver module, Windows Network Virtualization (aka "ms_netwnv").  This module can be bound to physical NICs on each server and configured with a set of policies to virtualize network addressing and routing rules.  When configuring network virtualization, two different configuration approaches can be used:

  • Generic Routing Encapsulation (NVGRE) - this approach builds GRE (RFC 2784 and 2890) tunnels between Hyper-V hosts to encapsulate virtualized networks using the details outlined  in the NVGRE Draft RFC document that has been submitted to the Internet Engineering Task Force (IETF).  This draft RFC document was assembled by a committee of networking veterans that includes senior engineers from Intel, DELL, HP, Emulex, Broadcom and Microsoft.  NVGRE is the preferred configuration approach for most network virtualization scenarios with Hyper-V hosts.
  • IP Address Rewrite (IP Rewrite) - this approach uses a NAT-like approach at each Hyper-V host to rewrite virtualized network addresses to native network addresses that can be routed across the physical network architecture.  IP Rewrite is intended for scenarios where Virtual Machines require extremely high-performance network bandwidth, such as 10 Gbps Ethernet, since traditional NIC offload mechanisms are supported to increase throughput.

Since NVGRE is the preferred choice for most network virtualization scenarios, we'll be focusing on this approach for the reminder of this article.  However, check out this article if you're interested in more details on IP Rewrite and a deeper comparison between the two approaches.

What Changes Are Needed to My Existing Physical Network Switches?
NONE!
NVGRE can both be implemented across an existing physical IP network without requiring changes your physical network switch architecture.  Since NVGRE tunnels terminate at each Hyper-V host, the hosts handle all of the handiwork for encapsulating and de-encapsulating network traffic.  If you have firewalls that are blocking GRE tunnels between sites, you will need to configure your firewalls to support forwarding GRE (IP Protocol 47) tunnel traffic.

Security Note: NVGRE tunnels do not natively provide encryption of payload contents.  If an NVGRE tunnel is being extended across public network segments, I recommend considering IPsec as part of your network layer policies to authenticate and encrypt network traffic end-to-end between virtual machine endpoints.

Performance Note: If you are planning to leverage NVGRE to virtualize heavy network IO workloads, you should also consider network adapter hardware that supports GRE Offload within the network chipset.  Without GRE Offload support within the NIC, traditional NIC offload technologies will not work with GRE traffic.  A number of NICs supporting GRE Offload for Windows Server 2012 and Hyper-V Server 2012 are expected later this calendar year.

I'm Ready! Where Do I Start?
The best starting place is to first layout the addressing scheme for IP addresses and subnets that you'd like to virtualize.  When configuring Hyper-V Network Virtualization, there are two types of IP Addresses that you'll be interacting with:

  • Provider Addresses (PA) - these are unique IP addresses assigned to each Hyper-V host that are routable across the physical network infrastructure.  I like to think of "PA" addresses as "Physical Addresses", because they are assigned to physical Hyper-V hosts.  Each Hyper-V host requires at least one PA to be assigned.
  • Customer Addresses (CA) - these are unique IP addresses assigned to each Virtual Machine that will be participating on a virtualized network.  I like to think of "CA" addresses as "Container Addresses", because they are the IP Addresses assigned to each VM "container" for use by the guest operating system running inside that VM.  Using NVGRE, multiple CA's for VMs running on a Hyper-V host can be tunneled using a single PA on that Hyper-V host.  CA's must be unique across all VMs on the same virtualized network, but CA's do not need to be unique across virtualized networks (such as in multi-tenant scenarios where each customer's VMs are isolated on separate virtualized networks).

Let's look at a simple example of NVGRE with two Hyper-V hosts using PA's and CA's:

In this example, you'll note that each Hyper-V host is assigned one PA address ( e.g., 192.168.x.x ) used for tunneling NVGRE traffic across two physical subnets ( e.g., 192.168.1.x/24 and 192.168.2.x/24 ) on the physical network.  In addition, each VM is assigned a CA address ( e.g., 10.x.x.x ) that is unique within each virtualized network and is tunneled inside the NVGRE tunnel between hosts.

To separate the traffic between the two virtualized networks, the GRE headers on the tunneled packets include a GRE Key that provides a unique Virtual Subnet ID ( e.g., 5001 and 6001 ) for each virtualized network.

Based on this configuration, we have two virtualized networks ( e.g., the "Red" network and the "Blue" network ) that are isolated from one another as separate IP networks and extended across two physical Hyper-V hosts located on two different physical subnets.

Once you have the following defined for your environment in a worksheet, you're ready to move on to the next steps in configuring Hyper-V Network Virtualization:

  • PA's for each Hyper-V Host
  • CA's for each Virtual Machine
  • Virtual Subnet ID's for each subnet to be virtualized

Done! How Can I Configure Hyper-V Network Virtualization?
Hyper-V Network Virtualization policies can be centrally configured using PowerShell 3.0 and PowerShell Remoting for no additional cost.  In addition, System Center 2012 Virtual Machine Manager Service Pack 1, currently available as a public beta, also offers an enterprise GUI management console that can centrally deploy and manage Hyper-V Network Virtualization policies across a large number of Hyper-V hosts.

To understand the configuration steps for each type of virtual network addressing (e.g., PA's, CA's, Virtual Subnet IDs ) described above, let's step through the PowerShell 3.0 Cmdlets used to configure these policies one-by-one.  In these examples, we'll be focusing on the configuration steps for the "Blue" virtual network components on the Hyper-V hosts in the example illustrated above.

Note: If you'll be using System Center 2012 to deploy and manage network virtualization policies as noted above, you won't need to manually run the specific PowerShell 3.0 Cmdlets below because System Center 2012 will run the appropriate PowerShell Cmdlets for you automatically to deploy the policies.  But, it still never hurts to understand what's happening behind the scenes! :-)

Here we go!  Let's get started configuring Hyper-V Network Virtualization via PowerShell 3.0 ...

  1. Enable the Windows Network Virtualization binding on the physical NIC of each Hyper-V Host ( Host 1 and Host 2 )

    Enable-NetAdapterBinding Ethernet -ComponentID ms_netwnv
  2. Configure Blue Subnet Locator and Route records on each Hyper-V Host ( Host 1 and Host 2 )

    New-NetVirtualizationLookupRecord -CustomerAddress "10.1.1.11" -ProviderAddress "192.168.1.10" -VirtualSubnetID "6001" -MACAddress "101010101105" -Rule "TranslationMethodEncap"

    New-NetVirtualizationLookupRecord -CustomerAddress "10.1.1.12" -ProviderAddress "192.168.2.20" -VirtualSubnetID "6001" -MACAddress "101010101107" -Rule "TranslationMethodEncap"

    New-NetVirtualizationCustomerRoute -RoutingDomainID "{11111111-2222-3333-4444-000000000000}" -VirtualSubnetID "6001" -DestinationPrefix "10.1.1.0/24" -NextHop "0.0.0.0" -Metric 255 

    Note:
    In the last command in this step above, a "RoutingDomainID" is also specified.  While this is not a network address per-se, each collection of virtualized networks that will route between each other must have a unique administrator-defined Routing Domain ID.  Using the example above, the "Blue" subnet and "Red" subnet do not have traffic routed between each other and, as such, would each require a unique Routing Domain ID.

  3. Configure the Provider Address and Route records on Hyper-V Host 1 ( Host 1 Only )

    $NIC = Get-NetAdapter Ethernet

    New-NetVirtualizationProviderAddress -InterfaceIndex $NIC.InterfaceIndex -ProviderAddress "192.168.1.10" -PrefixLength 24

    New-NetVirtualizationProviderRoute -InterfaceIndex $NIC.InterfaceIndex -DestinationPrefix "0.0.0.0/0" -NextHop "192.168.1.1"

  4. Configure the Provider Address and Route records on Hyper-V Host 2 ( Host 2 Only )

    $NIC = Get-NetAdapter Ethernet

    New-NetVirtualizationProviderAddress -InterfaceIndex $NIC.InterfaceIndex -ProviderAddress "192.168.2.20" -PrefixLength 24

    New-NetVirtualizationProviderRoute -InterfaceIndex $NIC.InterfaceIndex -DestinationPrefix "0.0.0.0/0" -NextHop "192.168.2.1"

  5. Configure the Virtual Subnet ID on the Hyper-V Network Switch Ports for each "Blue" Virtual Machine on each Hyper-V Host ( Host 1 and Host 2 )

    Get-VMNetworkAdapter -VMName BlueVM1 | where {$_.MacAddress -eq "101010101105"} | Set-VMNetworkAdapter -VirtualSubnetID 6001

    Get-VMNetworkAdapter -VMName BlueVM2 | where {$_.MacAddress -eq "101010101107"} | Set-VMNetworkAdapter -VirtualSubnetID 6001

That's it! Once you've gone through these 5 steps, you should now be able to route traffic between Virtual Machines across virtual subnet 10.1.1.x/24.

Note: If Windows Firewall is enabled on the operating system within each Virtual Machine, you may need to configure Windows Firewall within each VM to allow the traffic you're using to test.  For example, to permit ping traffic between VM's with Windows Firewall enabled, you can use the following PowerShell 3.0 Cmdlets in each VM:

New-NetFirewallRule –DisplayName “Allow ICMPv4-In” –Protocol ICMPv4

New-NetFirewallRule –DisplayName “Allow ICMPv4-Out” –Protocol ICMPv4 –Direction Outbound

What's Next? Keep Going!

Below are some great resources to continue your learning process on Hyper-V Network Virtualization ...

How Are You Planning to Use Hyper-V Network Virtualization?

Have you found an interesting use case in your environment for Hyper-V Network Virtualization?  Be sure to share your story in the comments below!

HTH,

Keith

Build Your Lab! Build Your Lab! Download Windows Server 2012
Build Your Lab in the Cloud! Don’t Have a Lab? Build Your Lab in the Cloud with Windows Azure Virtual Machines
Join our "Early Experts" study group! Want to Get Certified? Join our Windows Server 2012 "Early Experts" Study Group

More Stories By Keith Mayer

Keith Mayer is a Technical Evangelist at Microsoft focused on Windows Infrastructure, Data Center Virtualization, Systems Management and Private Cloud. Keith has over 17 years of experience as a technical leader of complex IT projects, in diverse roles, such as Network Engineer, IT Manager, Technical Instructor and Consultant. He has consulted and trained thousands of IT professionals worldwide on the design and implementation of enterprise technology solutions.

Keith is currently certified on several Microsoft technologies, including System Center, Hyper-V, Windows, Windows Server, SharePoint and Exchange. He also holds other industry certifications from IBM, Cisco, Citrix, HP, CheckPoint, CompTIA and Interwoven.

Keith is the author of the IT Pros ROCK! Blog on Microsoft TechNet, voted as one of the Top 50 "Must Read" IT Blogs.

Keith also manages the Windows Server 2012 "Early Experts" Challenge - a FREE online study group for IT Pros interested in studying and preparing for certification on Windows Server 2012. Join us and become the next "Early Expert"!

@ThingsExpo Stories

ARMONK, N.Y., Nov. 20, 2014 /PRNewswire/ --  IBM (NYSE: IBM) today announced that it is bringing a greater level of control, security and flexibility to cloud-based application development and delivery with a single-tenant version of Bluemix, IBM's platform-as-a-service. The new platform enables developers to build ap...

Building low-cost wearable devices can enhance the quality of our lives. In his session at Internet of @ThingsExpo, Sai Yamanoor, Embedded Software Engineer at Altschool, provided an example of putting together a small keychain within a $50 budget that educates the user about the air quality in their surroundings. He also provided examples such as building a wearable device that provides transit or recreational information. He then reviewed the resources available to build wearable devices at home including open source hardware, the raw materials required and the options available to power s...
The Internet of Things promises to transform businesses (and lives), but navigating the business and technical path to success can be difficult to understand. In his session at @ThingsExpo, Sean Lorenz, Technical Product Manager for Xively at LogMeIn, demonstrated how to approach creating broadly successful connected customer solutions using real world business transformation studies including New England BioLabs and more.
Since 2008 and for the first time in history, more than half of humans live in urban areas, urging cities to become “smart.” Today, cities can leverage the wide availability of smartphones combined with new technologies such as Beacons or NFC to connect their urban furniture and environment to create citizen-first services that improve transportation, way-finding and information delivery. In her session at @ThingsExpo, Laetitia Gazel-Anthoine, CEO of Connecthings, will focus on successful use cases.
Enthusiasm for the Internet of Things has reached an all-time high. In 2013 alone, venture capitalists spent more than $1 billion dollars investing in the IoT space. With "smart" appliances and devices, IoT covers wearable smart devices, cloud services to hardware companies. Nest, a Google company, detects temperatures inside homes and automatically adjusts it by tracking its user's habit. These technologies are quickly developing and with it come challenges such as bridging infrastructure gaps, abiding by privacy concerns and making the concept a reality. These challenges can't be addressed w...
The Domain Name Service (DNS) is one of the most important components in networking infrastructure, enabling users and services to access applications by translating URLs (names) into IP addresses (numbers). Because every icon and URL and all embedded content on a website requires a DNS lookup loading complex sites necessitates hundreds of DNS queries. In addition, as more internet-enabled ‘Things' get connected, people will rely on DNS to name and find their fridges, toasters and toilets. According to a recent IDG Research Services Survey this rate of traffic will only grow. What's driving t...
The Internet of Things is a misnomer. That implies that everything is on the Internet, and that simply should not be - especially for things that are blurring the line between medical devices that stimulate like a pacemaker and quantified self-sensors like a pedometer or pulse tracker. The mesh of things that we manage must be segmented into zones of trust for sensing data, transmitting data, receiving command and control administrative changes, and peer-to-peer mesh messaging. In his session at @ThingsExpo, Ryan Bagnulo, Solution Architect / Software Engineer at SOA Software, focused on desi...
"For over 25 years we have been working with a lot of enterprise customers and we have seen how companies create applications. And now that we have moved to cloud computing, mobile, social and the Internet of Things, we see that the market needs a new way of creating applications," stated Jesse Shiah, CEO, President and Co-Founder of AgilePoint Inc., in this SYS-CON.tv interview at 15th Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
The Industrial Internet revolution is now underway, enabled by connected machines and billions of devices that communicate and collaborate. The massive amounts of Big Data requiring real-time analysis is flooding legacy IT systems and giving way to cloud environments that can handle the unpredictable workloads. Yet many barriers remain until we can fully realize the opportunities and benefits from the convergence of machines and devices with Big Data and the cloud, including interoperability, data security and privacy.
The Internet of Things is tied together with a thin strand that is known as time. Coincidentally, at the core of nearly all data analytics is a timestamp. When working with time series data there are a few core principles that everyone should consider, especially across datasets where time is the common boundary. In his session at Internet of @ThingsExpo, Jim Scott, Director of Enterprise Strategy & Architecture at MapR Technologies, discussed single-value, geo-spatial, and log time series data. By focusing on enterprise applications and the data center, he will use OpenTSDB as an example t...
The industrial software market has treated data with the mentality of “collect everything now, worry about how to use it later.” We now find ourselves buried in data, with the pervasive connectivity of the (Industrial) Internet of Things only piling on more numbers. There’s too much data and not enough information. In his session at @ThingsExpo, Bob Gates, Global Marketing Director, GE’s Intelligent Platforms business, to discuss how realizing the power of IoT, software developers are now focused on understanding how industrial data can create intelligence for industrial operations. Imagine ...
Cultural, regulatory, environmental, political and economic (CREPE) conditions over the past decade are creating cross-industry solution spaces that require processes and technologies from both the Internet of Things (IoT), and Data Management and Analytics (DMA). These solution spaces are evolving into Sensor Analytics Ecosystems (SAE) that represent significant new opportunities for organizations of all types. Public Utilities throughout the world, providing electricity, natural gas and water, are pursuing SmartGrid initiatives that represent one of the more mature examples of SAE. We have s...
There is no doubt that Big Data is here and getting bigger every day. Building a Big Data infrastructure today is no easy task. There are an enormous number of choices for database engines and technologies. To make things even more challenging, requirements are getting more sophisticated, and the standard paradigm of supporting historical analytics queries is often just one facet of what is needed. As Big Data growth continues, organizations are demanding real-time access to data, allowing immediate and actionable interpretation of events as they happen. Another aspect concerns how to deliver ...
Scott Jenson leads a project called The Physical Web within the Chrome team at Google. Project members are working to take the scalability and openness of the web and use it to talk to the exponentially exploding range of smart devices. Nearly every company today working on the IoT comes up with the same basic solution: use my server and you'll be fine. But if we really believe there will be trillions of these devices, that just can't scale. We need a system that is open a scalable and by using the URL as a basic building block, we open this up and get the same resilience that the web enjoys.
The Internet of Things will greatly expand the opportunities for data collection and new business models driven off of that data. In her session at @ThingsExpo, Esmeralda Swartz, CMO of MetraTech, discussed how for this to be effective you not only need to have infrastructure and operational models capable of utilizing this new phenomenon, but increasingly service providers will need to convince a skeptical public to participate. Get ready to show them the money!
The 3rd International Internet of @ThingsExpo, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that its Call for Papers is now open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
Cloud Expo 2014 TV commercials will feature @ThingsExpo, which was launched in June, 2014 at New York City's Javits Center as the largest 'Internet of Things' event in the world.
"People are a lot more knowledgeable about APIs now. There are two types of people who work with APIs - IT people who want to use APIs for something internal and the product managers who want to do something outside APIs for people to connect to them," explained Roberto Medrano, Executive Vice President at SOA Software, in this SYS-CON.tv interview at Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
SYS-CON Media announced that Splunk, a provider of the leading software platform for real-time Operational Intelligence, has launched an ad campaign on Big Data Journal. Splunk software and cloud services enable organizations to search, monitor, analyze and visualize machine-generated big data coming from websites, applications, servers, networks, sensors and mobile devices. The ads focus on delivering ROI - how improved uptime delivered $6M in annual ROI, improving customer operations by mining large volumes of unstructured data, and how data tracking delivers uptime when it matters most.
DevOps Summit 2015 New York, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that it is now accepting Keynote Proposals. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long development cycles that produce software that is obsolete at launch. DevOps may be disruptive, but it is essential.