VLAN creation Windows 10 enterprise and professional

Windows 10 finally introduces builtin VLAN tagging; providing an alternative to the Intel Advanced Network Services or the similar functions of the Broadcom Advanced Control Suite.

https://downloadcenter.intel.com/download/25016/Network-Adapter-Driver-for-Windows-10
  1. Still found to be working as of Anniversary Update in Windows 10 professional and enterprise
  2. As of 2017-11 found due to a hyper-v stop error, that Intel fixed the ANS tagging that necessitated this investigation, so users have the choice of ANS available for tagging, even though use of hyper-v seems more natural.

Also, tagging untrusted networks to the edge, such as user’s “Internet” VLAN, can help protect baseboard management stacks from attack such as:

To set this up, we needed to install hyper-v within the builtin turn windows features on or off, to get the vSwitch functions, done even if we don't intend running any guests.

Some recent editions of hyper-v may create a builtin switch labelled Default Switch whose configuration is locked as internal, this may be safely be ignored, it is equivalent to the libvirt virbr0 for quick nat based guests, and create another vswitch

The hyper-v GUI only offers the ability to setup one management interface, suggest leaving this one detagged, but you can then use powershell to go and create the other tagged interfaces that we wanted, these show up as vEthernet in the network interfaces GUI.

Importantly, specify -ManagementOS on the extra interfaces, then these appear in the Control Panel for configuring with IP addresses or other use.

  1. Create virtual nics as needed: Add-VMNetworkAdapter
  2. Set which 802.1q tags they have Set-VMNetworkAdapterVlan

Example

I like all host vlan to use the host's own mac address, if there is more than one adapter it may need changing in -StaticMacAddress

Jumbograms

If using jumbos with the vlans, updates may undo jumbogram settings, so can schedule a startup task to reset the MTU to maximum such as 9014 via Set-NetAdapterAdvancedProperty, may need testing to check setting is reverted on restart

This may not correct an issue seen 2018 of occasionally limiting mtu to about 2000 on windows, corrected with a system restart, mtu can be set separately on important virtual interfaces to 1500 and leave experimental interfaces and the physical at the larger value.