1. Windows Server 2012 Hyper-V Networking
4/24/2017
Windows Server 2012 Hyper-V Networking
Carlos Mayol y Oscar Bonaque
Premier Field Engineers (PFE’s)
Microsoft
TechNet
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Server Virtualization Hyper-V 2012
----- Updated to 8000

3. Server Virtualization Hyper-V 2012

4. NIC Teaming and Hyper-V
Do not require Switch configuration
Switch Independent
Static or Dynamic Teaming (LACP)
Requires Switch configuration
Switch Dependent

5. NIC Teaming and Hyper-V (Balancing Modes Summary)
Address Hash
Hyper-V port
Switch Independent
Best for: Active/Standby and Teaming in a VM
(Acceptable for all cases)
Best for: Hyper-V *
Switch Dependent
Best for: Native
Acceptable for: Hyper-V
Best for: Hyper-V
Sends on all active members, receives on all active members, traffic from same port always on same NIC
Each Hyper-V port will be bandwidth limited to not more than one team member’s bandwidth
Each VM (Hyper-V port) is associated with a single NIC, this also allows maximum use of dVMQs for better performance over all

6. Host Network configurations
Non-converged
1GbE
10GbE
HBA/
Storage
Live Migration
Cluster
Manage
VM1
VMN
Converged Option1
10GbE each
VMN
VM1
Storage
Live Migration
Cluster
Manage
Converged Option2
VMN
VM1
Storage
Live Migration
Cluster
Manage
RDMA Traffic
10GbE each
Non converged configuration can be accomplish with multiple physical NICs or using partition software at hardware level, normally equipped on Blade chassis systems like:
Dell NPAR
HP FLEXfabric
Cisco FEX

7. Converged Networks QoS Windows Server 2012 Bandwidth management
Classification and tagging
Priority based flow control
Bandwidth mechanisms:
DCB (Data Center Bridging)
QoS Software Hyper-V Switch
Bandwidth options:
Absolute: bits per second
Weight: an integer in the range between 1 and 100 (Minimum bandwidth)
Best Practices for Minimum Bandwidth configurations:
Keep the sum of the weights around or under 100
Assign a relatively large weight to critical workloads even if they don’t require that percentage of bandwidth
Gap the weight assignment to differentiate the level of service to be provided (5, 3, 1)
Make sure that traffic that is not specifically filtered out is also accounted for with a weight assignment

8. Server Virtualization Hyper-V 2012
Demo:
Converged Networks

9. Dynamic Switch Ports Primordial pool
By default, every vSwitch is placed in the default Primordial pool for the Ethernet resource pool
vEthernet (Public)
vEthernet (DMZ)
Dynamic Switch Port functionality allows a VM to request to connect to one or more virtual switches in a poll of virtual switches
Public pool
DMZ pool
vEthernet (Public)
vEthernet (DMZ)
Resource pool configuration
using PowerShell
(New-VMResourcePool)
Two-part process
Create the Ethernet resource pool
Add the vSwitch to the resource pool
Note: Properly configured Ethernet resource pools on Hyper-V hosts should allow for a proper automatic connection when a VM migrates because the virtual machine network configuration is now part of the virtual machine configuration

10. Server Virtualization Hyper-V 2012
Demo:
Dynamic Switch Ports

11. Virtual Switch Expanded Functionality
ARP/ND Poisoning (Spoofing) Protection
DHCP/Router Guard
Network Traffic Monitoring
Per VM
Bandwidth Management QoS
VM Settings
Network Adapter
MAC Spoofing protection
Prevents VMs acting as DHCP servers or sent Router Advertisements
Port Mirroring (Source or destination)
Pseudo QoS to limit VM Network adapter bandwidth
Advanced Features
IP6 ND Spoofing attacks protection
Netmon inside the VM required
Can be managed using Hyper-V powershell module
Set-VMNetworkAdapter -ComputerName localhost -VMName VM1 -MacAddressSpoofing On
Set-VMNetworkAdapter -ComputerName localhost -VMName VM1 -DhcpGuard On
Set-VMNetworkAdapter -ComputerName localhost -VMName VM1 -PortMirroring Source
Set-VMNetworkAdapter -Name “Network Adapter“ –VMName VM -MaximumBandwidth

12. Per VM Bandwidth Management QoS
Switch bandwidth mode is defined during creation
VM bandwidth modes, where?
UI = Absolute values (Mpbs)
PS = Absolute or Weight
This is an outbound traffic limit!

13. Server Virtualization Hyper-V 2012
Demo:
VM Bandwidth limit
VM Network Monitor

14. Dynamic Virtual Machine Queue
Supported on
Requires support from NIC vendors
VMQ spreads interrupts for virtual environments the way RSS does for native workloads
Dynamic VMQ reassigns available queues based on changing networking demands of the VMs
All Hyper-V customers should be using VMQ on their 10Gb NICs. Customers without VMQ and with I/O loads in VMs may see each VM’s CPU0 run hot.
Can be configured with Powershell:
Get-NetAdapterVmq and NetAdapterVmq

15. Single Root I/O Virtualization (SR-IOV)
4/24/2017
Single Root I/O Virtualization (SR-IOV)
Requires support in the Hyper-V server chipset (BIOS firmware) and in a Network Adapter (NIC) (driver + firmware) in the host
Remaps interrupts and provides Direct Memory Access to virtual machines
Host
Root Partition
Hyper-V Switch
SR-IOV Physical NIC
Virtual Machine
Virtual Function
Routing
VLAN Filtering
Data Copy
Reduces Network Latency
Reduces CPU overhead
Virtual Functions (VF) in the SR-IOV-capable adapter are mapped directly to the virtual machine
VM network traffic bypasses the vSwitch
Very similar to basic RDMA functionality
SR-IOV is supported in VM mobility scenarios
Not enabled if a destination Host does not support SR-IOV
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. Network Isolation Physical separation
4/24/2017
Network Isolation
Physical separation
Physical switches and adapters for each type of traffic
Layer 2:
VLAN
Tag is applied to packets which is used to control the forwarding
Layer 2:
Private VLAN (PVLAN)
Primary and Secondary tags are used to isolate clients while still giving access to shared services.
Network Virtualization
Isolation through encapsulation. Independence from physical address space.
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

17. Network Isolation Vlan challenges
Cumbersome configuration when VMs need to be moved within the Datacenter can result in network outage
Limited scalability. Up to 4094 VLANs
VLANs today
Physical Switch support limitations
VLANs cannot span multiple subnets

18. Private VLAN (PVLAN) Isolation
VLAN pairs used to provide isolation with small numbers of VLANs.
Primary
VLAN
Promiscuous
Secondary
VLANs
Isolated
Community
Microsoft

19. Network Virtualization
Customer Address (CA) space is based on their network infrastructure
Provider Address (PA) space is assigned by a hoster based on the physical address space in the datacenter (not visible to the VM)
Microsoft

20. Questions?