Hyper-V VLANs

[localzuk]

On my old network, I have all our servers running on the same VLAN, so have not needed to look at VLANs with Hyper-V. However, with the new network I am building, I now have a need to segregate some services out onto VLANs.

 

So, I have followed the advice online as follows:

 

1. Set the physical switch to tag each VLAN I will be using, just like if I was linking to another physical switch.

2. On the virtual switch on each Hyper-V host, I have set the VLAN ID to the "main" VLAN most servers will be on. (In this case 1000).

3. On the individual server I wish to put on a different VLAN, I have set its VLAN ID to that VLAN (50).

 

The end result appears to be that all the "normal" VMs are working fine. They're all passing their traffic over VLAN 1000 like they should. However, the VLAN 50 machine isn't. I can't communicate in or out.

 

What am I missing here?

[FN-GM]

I think its the advice.

 

The way I got it working:

 

1. Setup a dot1q link to the host server.

2. Set the Host VLAN in the HV Network Management

3. Set the VLAN on each VM.

[localzuk]

I think its the advice.

The way I got it working:

1. Setup a dot1q link to the host server.

2. Set the Host VLAN in the HV Network Management

3. Set the VLAN on each VM.

 

Is that not exactly what I wrote?

[DJ-1701]

IIRC, I set a seporate vSwitch for the PVID (i.e. VLAN 50), attached to the Physical NIC you wish the server to use, then connect that vSwitch to the vNIC of the vMachine.

[Michael]

What about if you create another virtual switch on the correct VLAN, then point your single Hyper-V instance to this instead?

 

I think the issue is the virtual switch ID 1000 > to ID 50, it wouldn't translate logically speaking. When creating the virtual switch, it only knows of ID 1000.

 

I guess it also depends if you still need this server to talk to other servers?

[FN-GM]

Is that not exactly what I wrote?

 

No it isn't

 

No VLAN info sites on the virtual switch, just on every VM and then set your host management VM.

[localzuk]

No it isn't

No VLAN info sites on the virtual switch, just on every VM and then set your host management VM.

But the VLAN used on the V Switch is the bit that's actually working. MS Say you should be able to do it this way.

 

Example - https://blogs.msdn.microsoft.com/adamfazio/2008/11/14/understanding-hyper-v-vlans/

[Blue_Cookeh]

No it isn't

 

No VLAN info sites on the virtual switch, just on every VM and then set your host management VM.

 

Bingo.

 

I have 4 NICs in our Hyper-V boxes. One for the management OS only on an untagged port and the other three are one LACP trunk in Server 2016. I put that trunk untagged on one VLAN (for VMs without a VLAN tag) and then tag all the other VLANs for other VMs with the tag. I didn't need to do anything in the Hyper-V switch for this, just connect the VMs and either tag a VLAN or don't.

 

You don't want to seperate vSwitches into different VLANs really because then it becomes a pain to migrate VMs between hosts automatically

[localzuk]

OK. I have changed it around.

 

I have VLAN 1000 untagged on the physical NIC, and VLAN 50 tagged in the individual VM's settings.

 

Still not getting anything through. I've checked the physical NICs too - they're Intel X520's in each server, with VLAN support enabled in the advanced adapter settings.

[Michael]

Just a thought - if your server has 2/4 NICs, you could create a new virtual switch based on a physically different NIC. Optionally you can tag or untag the switch port to your requirements.

 

Thing is, if you do end up tagging everything, it makes it a bit pointless having separate VLANs.

[ADMaster]

I'm not sure of the terminology between switch vendors because I'm a Cisco shop but...

I have a seperate NIC for OS and VMs. The OS switch port has tagged with the normal servers vlan.

The VMs switch port is configured as a trunk, so its not tagged.

Every VM I create I must specify the VLAN in the network configuration. Its one extra step in setting up a VM but provides great flexibility.

[Davit2005]

I'm not sure of the terminology between switch vendors because I'm a Cisco shop but...

I have a seperate NIC for OS and VMs. The OS switch port has tagged with the normal servers vlan.

The VMs switch port is configured as a trunk, so its not tagged.

Every VM I create I must specify the VLAN in the network configuration. Its one extra step in setting up a VM but provides great flexibility.

 

Cisco trunk vs HP tagged, let terminology confusion commence :-( .

 

In HP a trunk is a 2 or more ports combined i.e. LACP.

 

In Cisco a trunk is a port that carries more than one vlan. A port group is created if 2 ports need combining i.e. for LACP and then the individual ports added to the port group.

 

In HP you would tag a port or (trunked ports) to allow that vLAN traffic to pass over the link. In Cisco you allow the vLAN over the trunk.

[Michael]

I thought a trunk or a tagged port were the same thing!? One or more VLANs required to pass-through, either Switch to Switch, or Switch to AP for example.

 

Teaming ports I suppose is also considered a trunk also; but that's just it, I call it teaming.

[FN-GM]

I thought a trunk or a tagged port were the same thing!? One or more VLANs required to pass-through, either Switch to Switch, or Switch to AP for example.

 

Teaming ports I suppose is also considered a trunk also; but that's just it, I call it teaming.

 

Dot1q

Cisco = Trunk

HP = Tagged

 

LACP

Cisco = Ether Channel or Port Channel

HP = Trunk

 

Confusing

[PotNoodleTech]

Ok, assuming you have HP kit here.

 

On the switch end you should have the port or trunk set up as: vlan 1000 untagged and the extra VLANs you wish to carry (50, etc) as tagged.

On the hyperv virtual switch you should leave the VLAN ID unticked, because the switch is already set to untagged for VLAN 1000, that is what the hyperV switch will see as it's "default vlan" and you don't need to specify it any further.

 

Now - any virtual machines you create - you can choose to leave the "enable vlan id" blank and that VM will automatically have VLAN 1000 as it's lan.

Or if you want the VM to have a specific vlan, tick the "enable vlan id" and specify the vlan e.g, 50 and this VM will now only communicate on the VLAN50.

 

I think the problem is because you explicitly set VLAN1000 in the hyperV virtual switch, the whole virtual switch can only communicate on vlan1000 and will ignore any other vlans that happen to be tagged on the physical link.

 

Hope that makes sense.

[localzuk]

Ok, assuming you have HP kit here.

 

Yup.

On the switch end you should have the port or trunk set up as: vlan 1000 untagged and the extra VLANs you wish to carry (50, etc) as tagged.

 

Yup. Both ports E2 and E3 (the 2 Hyper-V nodes) have 1000 untagged, and the others tagged.

On the hyperv virtual switch you should leave the VLAN ID unticked, because the switch is already set to untagged for VLAN 1000, that is what the hyperV switch will see as it's "default vlan" and you don't need to specify it any further.

 

Yup. Using the earlier comments, this is what it is set as.

Now - any virtual machines you create - you can choose to leave the "enable vlan id" blank and that VM will automatically have VLAN 1000 as it's lan.

Or if you want the VM to have a specific vlan, tick the "enable vlan id" and specify the vlan e.g, 50 and this VM will now only communicate on the VLAN50.

 

This is how I've done it. Still no traffic getting through. I'm trying with a different VM now.

I think the problem is because you explicitly set VLAN1000 in the hyperV virtual switch, the whole virtual switch can only communicate on vlan1000 and will ignore any other vlans that happen to be tagged on the physical link.

 

I've tried it both ways, neither works.

[localzuk]

Well, I've just migrated a different server over and it is working fine. So, its just this single VM that's an issue.

[PotNoodleTech]

Well, I've just migrated a different server over and it is working fine. So, its just this single VM that's an issue.

 

Hmmz.

 

When you say "this single VM" you mean the actual virtual machine or the host?

 

Just checking.

 

if it's the single VM - try disabling the old V network adaptor, creating a new v network adaptor on the VM, and setting that up see if that works?

[localzuk]

Hmmz.

When you say "this single VM" you mean the actual virtual machine or the host?

 

Just checking.

if it's the single VM - try disabling the old V network adaptor, creating a new v network adaptor on the VM, and setting that up see if that works?

Its an existing VM I've migrated over, and it runs Sophos SUM. Definitely broken when I migrate it over.