Hyper-V and VLANs

Hyper-V supports VLAN tagging, it has been brought to my attention that some folks might not be familar with this concept; lets cover the basics VLAN tagging and how it works and relate it to Hyper-V.

If you are not already familiar with VLAN tagging; it can be described as a way to segment traffic on your network. VLAN is just an abbreviation for Virtual LAN. Is this specific to Hyper-V? No. VLAN tagging has been around for a while now. And was origionally implemented on physical switches and routers before it first appeared in virtual switches.

A Virtual LAN is accomplished by adding a VLAN tag to the header of an IP packet. In most environments this action is actually performed by a network switch.

Before switch and router vendors implemented VLAN tags, it was more common to acheive traffic isolation through subnetting (creating different subnets) or through physical traffic isolation (hard wired isolation).

The important part to know about VLAN tags is that for them to work, all of your networking infrastructure must know how to handle them - since they affect the routing of the packets and are part of the TCP/IP packet itself.

Therefore, your routers and your switches must know how to evaluate a VLAN tag in order to determine where to route a particular packet.

There are many ways to implement VLAN tags in an infrastructure - the most common is to apply a VLAN tag to a switch port. In this model the switch adds the VLAN tag to all IP packets that flow through that port.

Just like physical switches, the virtual switches within Hyper-V can do this the same way.

In the virtual machine setting dialog you can assign a VLAN tag to the virtual machine. What this does is actually apply that tag to the port of the virtual switch in the same way a physical switch does.

The only difference is that in the virtual world, the setting moves with the VM so you might not realize that the VLAN tag is actually a setting that is used by the virtual switch that runs within Hyper-V.

Now, can this be used to route traffic between virtual machines? Yes. Even if those virtual machines reside on different hosts.

(If you have VMs on the same host that need to talk privately, use and internal or private network).

However - when the VM traffic leaves your Hyper-V host, it is now traveling on the physical wire. When it passes through a physical switch or router - those devices must know how to deal with a TCP/IP packet with a VLAN tag.

This is where the physical and virtual networking must support each other. If you decide to implement VLAN tags, then you are doing it across both the virtual and physical network devices.

Do you have to use VLAN tags? Not at all.

Like I mentioned, before VLAN tags we used subnetting, or physical isolation - all of these scenarios can be used.

Be sure to talk to your networking counterparts before you begin going down the road of VLAN tags as it can get complex pretty quickly.