Is it possible, using Hyper-V 2012R2, to construct a Virtual Switch internal to Hyper-V (no external connectivity necessary or desired), where one switch participant (VM 0 in the diagram below) has a trunk interface, and the remaining VMs (VM 1 ... VM n in the diagram below) each have access ports to the virtual switch tagged with the a particular VLAN ID.

  |                   Hyper-V host                        |
  |                                                       |
  |   _____            _____      ______       ______     |
  |  | VM0 |          | VM1 |    | VM 2 | ... | VM n |    |
  |  |     |          |     |    |      |     |      |    |
  |  |_____|          |_____|    |______|     |______|    |
  |    |:| eth0          | eth0     | eth0       | eth0   |
  |    |:| trunk         | vlan 1   | vlan 2     | vlan 3 |
  |    |:|               |          |            |        |
  |   =================================================   |
  |               Virtual Switch                          |

For instance, untagged packets leaving the eth0 interface of VM2 would be tagged with VLAN tag 2 as they pass to the virtual switch. They would then egress through the the trunk port toward VM0, where they would arrive in the the VM through eth0 of that VM, and (if this was a linux VM) be readable on eth0.2, i.e. the VLAN tagging would be evident to VM0. Similarly traffic egressing eth0 of VM0 tagged with VLAN tag 2 would enter the virtual switch with that tag in place, and the tag would be stripped prior to sending it to VM2, where it would appear on VM's eth0 interface untagged.

If so, how is this tagging achieved? I'm not a Hyper-V expert, and the only documentation I can find talks about the whole of the switch being in trunk mode or access mode. Clearly the switch needs to carry VLAN tags, but I need to put different ports into trunk or access mode. Is this possible without an external interface? I also neither want or need connectivity to the Hyper-V parent partition.


  • I realise I could have one virtual switch per VLAN in the above configuration, but don't want to do that as VM0 would have to have a large number of network interfaces and this would use many virtual switches.

  • This config works fine on VMware and Linux, and isn't as odd as you might think.

  • The line drawing is terrible, apologies.

  • I am quite prepared to do this programatically rather than through the GUI if that is necessary.


You can create a trunk link to VM.


Generally your command will be like:

Set-VMNetworkAdapterVlan -VMname $VMName -VMNetworkAdapterName $VMNetworkAdapterName -Trunk -AllowedVlanIdList "vlan number" -NativeVlanId "vlan ID"

As far us I understand you will need to have all VMs to have trunk NIC.

Native Vlan in Hyper-V used to mark all outgoing traffic, so if you'll have VM0 NIC trunk with native vlan 50 and all other in allowed, and VM1 NIC access with Vlan 1. Then VM1 -> VM0 successfull but VM0 -> VM1 is not.(under -> I mean send packets and if they are delivered to destination, and it's not necessary guaranties successful reverse flow)

So, your VM0 should have some common to all machines VLAN X as native vlan and all needed vlans from all other VM's in allowed vlan list. Any other VM should have it's unique VLAN as native and VLAN X in allowed.

For example:

VM Name     | Native Vlan | Allowed Vlan
VM1         | 1           | 1,50
VM2         | 2           | 2,50
VMn         | n           | n,50
VM0         | 50          | 1,2,n,50

Here VM0 -> Any VM = successful, Any VM -> VM0 = Success, and VMn -> VMm (if "n" and "m" are not 0) = fail.

Hope it helps & sorry for any grammar mistakes.

| improve this answer | |
  • The problem is that I only want VM0 to have a trunk link. VM1 ... VMn need to have non-trunk links, or they will received tagged traffic to all VLANs, as opposed to untagged traffic directed to the appropriate VLAN only. Is that possible? – abligh Mar 14 '15 at 13:01
  • Try to check it, not completly sure that hyper-V actually tags traffic and not just virtually forwards it to desired direction. At least it not behaves as real switch in way it's not stripping "tag" on native vlan. – isiroshtan Mar 14 '15 at 13:06
  • BTW, what do you mean by "they will received tagged traffic to all VLANs"? They will recieve only traffic from VM0 destined to them(+broadcast traffic from VM0). All other traffic from other VMs should not be there, as corresponding vlans not in allowed list. And each VM(except VM0) in unique VLAN, which mean that vlan used only to send but have nothing to recieve. – isiroshtan Mar 14 '15 at 13:16
  • @isioshtan yes you are correct re the allowed VLANs - sorry. However, my fear is that the traffic will arrive at VM1...VMn tagged, and must egress VM1...VMn tagged or it will not reach VM0 on the correct VLAN. I can't change that configuration in VM1...VMn – abligh Mar 14 '15 at 13:55
  • i', mot sure that i got it correctly, but... i have VM1 and VM2. VM1 is trunk 402 native and 401 allowed. When VM2 set to access 402 - all works fine(they can ping each other). When I put VM2 on 401 vlan - no ping. If i put VM2 to trunk native 401 allow 402 - works fine. Vm2 Native 500 allowed 401,402 - i can see ping echo requests from vm1, but VM2 cannot find VM1 and, as follows, not responding to ping. I did tested it just yesterday as I have some problems myself with vlan tagging of Hyper-v. – isiroshtan Mar 14 '15 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.