[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2437
  • Last Modified:

Does Hyper-V support Private VLANs via trunk ports?

I want to uplink Cisco’s Community PVLANs to Hyper-V 2008 R2 servers via standard 802.1Q trunks, to isolate VLANs. When I tested this, my VMs could see traffic on the primary PVLAN, but not the community VLAN. I need to figure out if my config was the issue or is it that Hyper-V does not support PVLANs.

Has anyone gotten this to work or know if it is supported by Hyper-V?
0
apitech
Asked:
apitech
1 Solution
 
Robert Sutton JrSenior Network ManagerCommented:
There is no way to tunnel private network traffic from one host to another.

One way would be to use good old crossover cables between hosts and set up external networks.

A similar but more geeky solution is to use VLANs and VLAN tagging of the private traffic (your physical network has to support this as well).

And, then there is always subnetting (a special subnet specific to the VM to VM traffic)

All of these require External networks so the traffic can leave the confines of a single host - but they are not new tricks.  Security through obscurity applies to subnetting and tagging.  Phsyical isolation (and a very old school) name needs to go to the crossover cable
0
 
apitechAuthor Commented:
I am not sure you understand my question. Higher end Cisco switches support what is called Private VLANs. A private VLAN is isolated from other VLANs and hosts. Community Private VLANs allow all hosts within a VLAN to talk with each other, but not hosts in other VLANs. Isolated Private VLANs prevent all hosts from communicating, even those in the same VLAN. Just as with regular VLANs, PVLANs can be trunked (what you call VLAN tagging) to other devices... i.e. Hyper-V server. I should be able to set the appropriate community VLAN ID in the Hyper-V virtual switch to allow the VM to communicate on the VLAN with others in the community configured on the Cisco switch.

I know this works in VMware, but not sure about Hyper-V.
0
 
Craig BeckCommented:
There's no reason why it shouldn't work in Hyper-V.
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
apitechAuthor Commented:
Thank you for your response. However, I am unable to make this work and have not found any documentation on configuring Hyper-V to work on a Cisco PVLAN. Unfortunately, many don't seem to understand the concept of a private VLAN and confuse it with Hyper-V's built-in Private virtual machine network. At this point, I don't think it is supported.
0
 
apitechAuthor Commented:
I also want to add that I converted the trunk port to a host port. Hyper-V still could not ping it's gateway (the primary pvlan SVI) when set to the community PVLAN (vlan 221). However, when setting the VLAN to the primary pvlan number (vlan 220) in Hyper-V, the VM could ping the SVI. It appears that Hyper-V is not PVLAN aware and does not understand how the switch is tagging the packets.
0
 
Craig BeckCommented:
Private VLANs are just a way Cisco switches separate traffic.  As long as you can tag the NIC in Hyper-V with the PVLAN ID it should be ok.  Try setting the trunk port from the Hyper-V to promiscuous.

This might help...

http://blog.ine.com/2008/01/31/understanding-private-vlans/
0
 
apitechAuthor Commented:
I understand PVLANs. The issue is not on the switch. However, I tried your suggestion and put the port into promiscuous mode. Still unsuccessful.

Hyper-V does not see the PVLAN. The switch SVI does not show up in the VM's ARP table. However, the VM does show up in the switches ARP table. If I change Hyper-v to the primary pvlan, the SVI does show up in the ARP table.

I'm starting to think that Hyper-v just does not support PVLANs and requires a PVLAN trunk port on the switch. Unfortunately, this is a 3750x and you have to move up to the 4500 or 6500 for PVLAN trunk support.
0
 
Craig BeckCommented:
Hmmm I see what you're saying.  I'm going to set it up now and test using a 3560 and a 6509.  I'll keep you posted! :-)
0
 
apitechAuthor Commented:
Great, Thanks!
0
 
apitechAuthor Commented:
craigbeck,

Did you get a chance to test this?
0
 
Craig BeckCommented:
Hi apitech,

I'm sorry I haven't gotten back to you - I've only just returned from a week in the Sun!

I did manage to test this today and I couldn't get it to work at all using a 6500 either.
0
 
jake77444Commented:
api are you specifying a VLAN tag for the external adapter or the VM itself?
0

Featured Post

Vote for the Most Valuable Expert

It’s time to recognize experts that go above and beyond with helpful solutions and engagement on site. Choose from the top experts in the Hall of Fame or on the right rail of your favorite topic page. Look for the blue “Nominate” button on their profile to vote.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now