Hyper-V Virtual Switch VLAN and Trunk Configuration

Hyper-V VLAN configuration lives in two places: the virtual switch on the host, and the virtual network adapter on each VM. Host-side configuration is minimal — you create an external switch bound to a physical NIC or team — while the per-VM adapter decides whether the guest sees untagged traffic on one VLAN, a full trunk with tagged packets, or a private VLAN. Because it is all exposed through PowerShell, every change is scriptable and auditable.

Create the External Switch

Get-NetAdapter | Where-Object Name -like "Ethernet*"

New-VMSwitch -Name "vSwitch-Prod" -NetAdapterName "Ethernet 1" `
  -AllowManagementOS $true -EnableEmbeddedTeaming $true

Get-VMSwitch | Format-Table Name,SwitchType,NetAdapterInterfaceDescription
Get-VMSwitchTeam -Name "vSwitch-Prod"

Use -EnableEmbeddedTeaming with two or more physical NICs rather than a host-level LBFO team: embedded teams are supported with SET and give the VMs a fully redundant path. A host LBFO team still leaves the VM switch dependent on the team driver.

Per-VM VLAN Modes

# access: all guest traffic tagged with one VLAN ID
Set-VMNetworkAdapterVlan -VMName Web01 -Access -VlanId 121

# trunk: the guest does its own 802.1Q tagging
Set-VMNetworkAdapterVlan -VMName Router01 -Trunk `
  -AllowedVlanIdList 10-20 -NativeVlanId 1

# untagged (default)
Get-VM Web01 | Set-VMNetworkAdapterVlan -Untagged

# private VLAN: isolated guest, promiscuous edge
Get-VMNetworkAdapter -VMName DMZ01 | Set-VMNetworkAdapterVlan -Isolated `
  -PrimaryVlanId 10 -SecondaryVlanId 200
Get-VMNetworkAdapter -VMName Edge01 | Set-VMNetworkAdapterVlan -Promiscuous `
  -PrimaryVlanId 10 -SecondaryVlanIdList 200-201

# management OS vNIC (host traffic on a tagged VLAN)
Set-VMNetworkAdapterVlan -ManagementOS -Access -VlanID 20

Access, trunk, private VLAN and untagged are mutually exclusive: setting one clears the others. A trunk adapter requires both -AllowedVlanIdList and -NativeVlanId; traffic in the native VLAN reaches the guest untagged, exactly like a physical switch port.

Verify What the Guest Actually Sees

Get-VMNetworkAdapter -VMName Router01 |
  Select-Object VMName,Name,SwitchName,MacAddress,VlanSetting

Get-VMNetworkAdapterVlan -VMName Router01
Get-VMNetworkAdapterVlan -ManagementOS

# inside a Windows guest
Get-NetAdapter | Format-Table Name,Status,LinkSpeed,MacAddress
Get-NetAdapterAdvancedProperty -Name "Ethernet" |
  Where-Object DisplayName -like "*VLAN*"

If the guest OS also configures its own VLAN tagging, you get double tagging and silent connectivity loss — decide whether Hyper-V or the guest owns the tag, and be consistent. The reliable pattern is trunk mode in Hyper-V and tagged interfaces inside the guest for routers and appliances, access mode in Hyper-V for ordinary servers.

Common Problems and Their Causes

• VM cannot reach anything after a VLAN change: the physical switch port feeding the host is not a trunk, or does not allow the VLAN in its allowed list.
• Intermittent loss with a team: mismatched LBFO/SET configuration on the host versus LACP on the switch.
• Live migration breaks numbering: the guest was built from the wrong template and Hyper-V's default VLAN is applied — check the template, not the VM.
• Management OS loses connectivity: applying -ManagementOS -Access -VlanID x to the host vNIC when the switch port is untagged. Revert from the console or iLO/iDRAC, not over the network you just broke.
• Private VLAN confusion: isolated guests can talk only to promiscuous members; a "missing" default gateway is almost always a VLAN mode mistake.

Related reading: Proxmox VE VLAN-aware bridge with LACP bond and Linux VLAN tagging with ip link 802.1Q.

原文链接：https://learn.microsoft.com/en-us/powershell/module/hyper-v/set-vmnetworkadaptervlan?view=windowsserver2025-ps