7.6 Hyper-V Virtual Switches, NIC Teaming & Switch Embedded Teaming (SET)

Hyper-V Virtual Switches, NIC Teaming & Switch Embedded Teaming (SET)

Network virtualization in Windows Server 2022 and 2025 provides high-throughput, software-defined connectivity between physical networks, virtual machines, and host management interfaces. Designing secure and resilient network infrastructure requires mastery of Hyper-V Virtual Switch isolation types, advanced port security features, and modern teaming architectures like Switch Embedded Teaming (SET).

---

1. Hyper-V Virtual Switch Types & Architecture

A Hyper-V Virtual Switch (vSwitch) is a software-based Layer 2 Ethernet network switch operating inside the root partition. It manages packet inspection, MAC address routing, VLAN tagging, and bandwidth policies for connected virtual network adapters (vNICs).

+-----------------------------------------------------------------------------------------+
|                        HYPER-V VIRTUAL SWITCH ISOLATION TYPES                           |
|                                                                                         |
|   [EXTERNAL vSWITCH]             [INTERNAL vSWITCH]            [PRIVATE vSWITCH]        |
|   +--------------------------+   +--------------------------+  +----------------------+ |
|   | Physical NIC (Uplink)    |   | NO Physical NIC Uplink   |  | NO Physical NIC      | |
|   |          ^               |   |                          |  | NO Host Management   | |
|   |          |               |   | Host Management vNIC     |  |    OS vNIC           | |
|   | +--------v-------------+ |   | +--------^-------------+ |  | +------------------+ | |
|   | | Virtual Switch Engine| |   | | | Virtual Switch     | |  | | | Virtual Switch | | | |
|   | +----+-----+-----+-----+ |   | +-+------+-----+-------+ |  | +-+------+-----+---+ | |
|   |      |     |     |       |   |   |      |     |         |  |   |      |     |     | |
|   |     vNIC  vNIC  HostOS   |   |  vNIC   vNIC  HostOS     |  |  vNIC   vNIC  vNIC   | |
|   |    [VM-1] [VM-2] [vNIC]  |   | [VM-1] [VM-2] [vNIC]     |  | [VM-1] [VM-2] [VM-3] | |
|   +--------------------------+   +--------------------------+  +----------------------+ |
+-----------------------------------------------------------------------------------------+

Virtual Switch Characteristics Matrix

Creating Virtual Switches with PowerShell

# 1. Create an External Virtual Switch sharing the physical adapter with the host OS
New-VMSwitch -Name "vSwitch-External" `
             -NetAdapterName "Ethernet1" `
             -AllowManagementOS $true

# 2. Create a Private Virtual Switch for isolated test environments
New-VMSwitch -Name "vSwitch-Private" -SwitchType Private

# 3. Create an Internal Virtual Switch and configure NAT for outbound Internet access
New-VMSwitch -Name "vSwitch-Internal-NAT" -SwitchType Internal

# Configure host gateway IP on the newly created internal virtual adapter
New-NetIPAddress -IPAddress 192.168.100.1 -PrefixLength 24 -InterfaceAlias "vEthernet (vSwitch-Internal-NAT)"

# Create a Network Address Translation (NAT) rule for guest outbound traffic
New-NetNat -Name "HyperV-NAT-Network" -InternalIPInterfaceAddressPrefix "192.168.100.0/24"

---

2. Advanced Virtual Switch Security, Filtering & QoS

Hyper-V vSwitches include built-in packet inspection, security filtering, and quality of service (QoS) controls configured directly on virtual network adapters.

1. VLAN Tagging (IEEE 802.1Q)

Virtual network adapters can be configured in Access Mode (belonging to a single VLAN) or Trunk Mode (passing multiple tagged VLANs to nested firewalls or virtual appliances).

# Assign a VM to VLAN 100 in Access Mode
Set-VMNetworkAdapterVlan -VMName "VM-APP-01" -Access -VlanId 100

# Configure Trunk Mode for a virtual firewall appliance passing VLANs 10, 20, and 30
Set-VMNetworkAdapterVlan -VMName "VM-FW-01" -Trunk -AllowedVlanIdList "10-30" -NativeVlanId 1

2. Advanced Security Protections (DHCP Guard & Router Guard)

• DHCP Guard: Intercepts and drops unauthorized DHCP Server OFFER and ACK messages originating from rogue virtual machines, preventing man-in-the-middle DHCP hijacking.
• Router Guard: Discards IPv6 Router Advertisement (RA) and ICMP redirect messages originating from unauthorized guest VMs.

# Enable DHCP Guard and Router Guard on a VM's virtual adapter
Set-VMNetworkAdapter -VMName "VM-APP-01" -DhcpGuard On -RouterGuard On

3. Port Access Control Lists (Port ACLs)

Applies stateful Layer 3/4 firewall rules directly at the virtual switch port level before traffic reaches the guest OS:

# Block all incoming traffic to VM-APP-01 from a specific malicious subnet
Add-VMNetworkAdapterAcl -VMName "VM-APP-01" `
                       -RemoteIPAddress "198.51.100.0/24" `
                       -Direction Inbound `
                       -Action Deny

4. Bandwidth Management & Quality of Service (QoS)

Controls minimum guaranteed bandwidth (weight or bps) and maximum ceiling bandwidth (rate limiting) to prevent noisy neighbor contention:

# Configure absolute bandwidth limits (Minimum 50 Mbps, Maximum 200 Mbps)
Set-VMNetworkAdapter -VMName "VM-APP-01" `
                     -MinimumBandwidthAbsolute 50000000 `
                     -MaximumBandwidthAbsolute 200000000

---

3. NIC Teaming Evolution: Legacy LBFO vs Switch Embedded Teaming (SET)

Windows Server historically used Load Balancing and Failover (LBFO) NIC Teaming (lbfoadmin.exe / New-NetLbfoTeam). However, LBFO has significant architectural limitations that make it obsolete for modern software-defined datacenters. Switch Embedded Teaming (SET) is the modern standard integrated directly into the Hyper-V Virtual Switch.

+-----------------------------------------------------------------------------------------+
|                     LBFO NIC TEAMING VS SWITCH EMBEDDED TEAMING (SET)                   |
|                                                                                         |
|   [LEGACY LBFO NIC TEAMING]                      [SWITCH EMBEDDED TEAMING (SET)]        |
|   +------------------------------------+         +------------------------------------+ |
|   | Hyper-V Virtual Switch             |         | Hyper-V Virtual Switch             | |
|   +-----------------+------------------+         | (Teaming logic built INTO switch)  | |
|                     |                            |  - Supports RDMA (RoCE / iWARP)    | |
|   +-----------------v------------------+         |  - Supports SR-IOV                 | |
|   | OS LBFO Team Driver (NIC / NetLbfo)|         |  - Up to 8 Matching NICs           | |
|   +--------+------------------+--------+         +--------+------------------+--------+ |
|            |                  |                           |                  |          |
|   +--------v-------+ +--------v-------+          +--------v-------+ +--------v-------+  |
|   | Physical NIC 1 | | Physical NIC 2 |          | Physical NIC 1 | | Physical NIC 2 |  |
|   | (NO RDMA supp) | | (NO RDMA supp) |          | (RDMA Enabled) | | (RDMA Enabled) |  |
|   +----------------+ +----------------+          +----------------+ +----------------+  |
+-----------------------------------------------------------------------------------------+

Comprehensive Comparison Matrix

[!CAUTION] LBFO Deprecation Warning: Starting with Windows Server 2022 and Windows Server 2025, LBFO NIC Teaming is deprecated for Hyper-V workloads. Attempting to deploy Storage Spaces Direct (S2D) or RDMA over an LBFO team is blocked by cluster validation rules.

---

4. SET Load Balancing Algorithms

Switch Embedded Teaming operates exclusively in Switch Independent mode, meaning physical upstream switches do not require LACP or multi-chassis link aggregation (MLAG/vPC) configuration. SET supports two distinct load balancing algorithms:

1. Hyper-V Port Mode (-LoadBalancingAlgorithm HyperVPort):

   • Distributes outbound traffic based on the source virtual network adapter port ID or MAC address.
   • Each virtual network adapter is statically affinitized to one of the physical NICs in the team. All inbound and outbound traffic for that specific vNIC passes through its assigned physical adapter.
   • Advantage: Low CPU overhead, highly deterministic.
   • Limitation: A single vNIC with high throughput cannot exceed the bandwidth capacity of its single assigned physical adapter.

2. Dynamic Mode (-LoadBalancingAlgorithm Dynamic) (Default & Recommended):

   • Evaluates outbound TCP flowlets and hashes (Source/Destination IP and TCP ports).
   • Dynamically rebalances TCP streams across all active physical adapters in the team in real time.
   • Inbound traffic is distributed using the Hyper-V Port algorithm, while outbound traffic utilizes multi-link dynamic hash balancing.
   • Advantage: Maximizes aggregate bandwidth utilization across all physical uplinks.

---

5. NIC Teaming Inside the Guest Virtual Machine

SET and LBFO protect the host's uplinks. They do nothing for a virtual machine whose traffic bypasses the virtual switch entirely — which is exactly what happens when a vNIC is bound to an SR-IOV virtual function (VF). An SR-IOV VF is mapped straight from the physical adapter into the guest, so if that one physical NIC fails, the VM loses connectivity even though the host still has a healthy second adapter. The blueprint objective is "Configure NIC Teaming on the Hyper-V host and virtual machine," and guest teaming is the answer to that second half.

+-----------------------------------------------------------------------------------------+
|                          GUEST (IN-VM) NIC TEAMING TOPOLOGY                             |
|                                                                                         |
|   +---------------------------------------------------------------------------------+   |
|   |  GUEST VM  --  LBFO team (Switch Independent + Address Hash, exactly 2 members)  |   |
|   |            +---------------------------+ +---------------------------+           |   |
|   |            |  Guest vNIC 1             | |  Guest vNIC 2             |           |   |
|   |            |  AllowTeaming = On        | |  AllowTeaming = On        |           |   |
|   +------------+-------------+-------------+-+-------------+-------------+-----------+   |
|                              |                             |                             |
|                   +----------v----------+       +----------v----------+                  |
|                   | External vSwitch A  |       | External vSwitch B  |   <-- MUST be    |
|                   +----------+----------+       +----------+----------+       different  |
|                              |                             |                  switches   |
|                   +----------v----------+       +----------v----------+                  |
|                   | Physical NIC 1      |       | Physical NIC 2      |                  |
|                   +---------------------+       +---------------------+                  |
+-----------------------------------------------------------------------------------------+

The Four Hard Requirements

Microsoft supports exactly two team members inside a virtual machine. Larger guest teams can be created, but they are not a supported configuration.

Step 1: Allow Teaming on the Virtual Network Adapters (Host Side)

This is the step candidates forget, and it is the single most likely thing an exam item will test. Without it the guest can build the team object, but the virtual switch drops the teaming traffic and failover never works. In Hyper-V Manager it is the NIC Teaming checkbox under the adapter's Advanced Features page.

# Enable teaming on every virtual network adapter of the VM
Get-VMNetworkAdapter -VMName "VM-SRIOV-01" | Set-VMNetworkAdapter -AllowTeaming On

# Verify the setting took effect
Get-VMNetworkAdapter -VMName "VM-SRIOV-01" | Format-Table Name, SwitchName, AllowTeaming

Step 2: Create the Team Inside the Guest

There is no SET inside a guest — SET only exists as part of a Hyper-V virtual switch, and a VM has no virtual switch. Guest teaming therefore still uses LBFO, and this is the one remaining scenario where New-NetLbfoTeam is the correct answer on a modern Windows Server. The host-side LBFO deprecation covered above applies to Hyper-V hosts, not to teams built inside guests.

# Run INSIDE the guest operating system
New-NetLbfoTeam -Name "GuestTeam" `
                -TeamMembers "Ethernet","Ethernet 2" `
                -TeamingMode SwitchIndependent `
                -LoadBalancingAlgorithm TransportPorts `
                -Confirm:$false

Get-NetLbfoTeam -Name "GuestTeam"
Get-NetLbfoTeamMember -Team "GuestTeam"

[!TIP] Decision rule for the exam. If the scenario mentions SR-IOV, a VM that must survive a physical NIC failure, or a guest that needs its own fault tolerance, the answer is guest NIC teaming with -AllowTeaming On. If the scenario is about host uplinks, RDMA, converged networking, or Storage Spaces Direct, the answer is SET on the host. Configuring one never substitutes for the other.

---

6. PowerShell SET Switch Deployment & Converged Networking

In modern datacenter designs, enterprise hosts implement Converged Networking, where management traffic, Storage Spaces Direct (S2D) SMB Direct traffic, cluster heartbeats, and VM payload traffic share a single redundant SET switch pair.

+-----------------------------------------------------------------------------------------+
|                        CONVERGED NETWORKING ON SET VSWITCH                              |
|                                                                                         |
|   [HYPER-V HOST MANAGEMENT OS]                   [TENANT GUEST VMs]                     |
|   +---------------------------------------+      +------------------------------------+ |
|   | vEthernet (Management)   - VLAN 10    |      | VM-1 (Tenant Traffic) - VLAN 100   | |
|   | vEthernet (Cluster-Heart)- VLAN 20    |      | VM-2 (Tenant Traffic) - VLAN 200   | |
|   | vEthernet (SMB-Direct-1) - RDMA / RoCE|      |                                    | |
|   | vEthernet (SMB-Direct-2) - RDMA / RoCE|      |                                    | |
|   +-------------------+-------------------+      +-----------------+------------------+ |
|                       |                                            |                    |
|   +-------------------v--------------------------------------------v------------------+ |
|   |                       SWITCH EMBEDDED TEAMING (SET) vSWITCH                       | |
|   |                 (Dynamic Load Balancing / Switch Independent Mode)                | |
|   +---------------------------+----------------------------+--------------------------+ |
|                               |                            |                            |
|                  +------------v-----------+   +------------v-----------+                |
|                  | Physical 25GbE NIC 1   |   | Physical 25GbE NIC 2   |                |
|                  | (Mellanox / Intel RDMA)|   | (Mellanox / Intel RDMA)|                |
|                  +------------------------+   +------------------------+                |
+-----------------------------------------------------------------------------------------+

Step-by-Step Converged SET Switch Deployment Workflow

# Step 1: Create the SET Virtual Switch with Dynamic Load Balancing
New-VMSwitch -Name "SET-ConvergedSwitch" `
             -NetAdapterName "NIC1","NIC2" `
             -EnableEmbeddedTeaming $true `
             -LoadBalancingAlgorithm Dynamic

# Step 2: Add dedicated host management vNICs for SMB Direct Storage
Add-VMNetworkAdapter -ManagementOS `
                     -Name "SMB-Direct-1" `
                     -SwitchName "SET-ConvergedSwitch"

Add-VMNetworkAdapter -ManagementOS `
                     -Name "SMB-Direct-2" `
                     -SwitchName "SET-ConvergedSwitch"

# Step 3: Configure VLAN IDs for host management adapters
Set-VMNetworkAdapterVlan -ManagementOS -VMNetworkAdapterName "SMB-Direct-1" -Access -VlanId 10
Set-VMNetworkAdapterVlan -ManagementOS -VMNetworkAdapterName "SMB-Direct-2" -Access -VlanId 20

# Step 4: Enable Remote Direct Memory Access (RDMA) on host storage adapters
Enable-NetAdapterRdma -Name "vEthernet (SMB-Direct-1)", "vEthernet (SMB-Direct-2)"

# Step 5: Verify SET Team Health and Physical Member Status
Get-VMSwitchTeam -Name "SET-ConvergedSwitch"
Get-NetAdapterRdma

Managing SET Team Members Online

Physical adapters can be added or removed from an active SET team without deleting or re-creating the virtual switch:

# Add a third physical adapter to the existing SET team
Set-VMSwitchTeam -Name "SET-ConvergedSwitch" -NetAdapterName "NIC1","NIC2","NIC3"