How to Use PowerShell to Configure Windows Server 2022 Network Controller Policies

Introduction to Network Controller Policies

Modern Windows Server environments increasingly rely on Software-Defined Networking (SDN) to achieve the scalability and flexibility required by enterprise data centers. At the heart of Microsoft’s SDN stack is the Network Controller, a centralized, programmable point of automation that manages virtual and physical network infrastructure.

By leveraging Network Controller Policies, administrators can define granular Access Control Lists (ACLs), configure virtual network routing, and implement Quality of Service (QoS) across thousands of Hyper-V hosts from a single control plane. These policies eliminate the need to manually configure individual virtual switches.

Understanding Access Control Lists (ACLs) in SDN

In a traditional network, security is often enforced by a physical firewall at the edge of the subnet. In an SDN environment using the Network Controller, security is enforced at the virtual port level using Distributed Firewalls. An ACL is simply a collection of security rules that explicitly allow or deny traffic based on the source IP, destination IP, port, and protocol.

Because the Network Controller pushes these ACLs down to the Hyper-V virtual switch on the exact host where the VM resides, traffic is blocked before it even hits the physical network, drastically reducing congestion.

Step 1: Connecting to the Network Controller

To begin configuring policies, open PowerShell as an Administrator on your management workstation. You must first establish a connection to the Network Controller cluster. We will store the REST URI of the Network Controller in a variable.

$URI = "https://nc.company.local"

Ensure that your PowerShell session is running under an account that has administrative privileges over the Network Controller.

Step 2: Creating a Network Interface ACL

In this example, we will create a policy to block all inbound SSH traffic (Port 22) to a specific tier of virtual machines, but allow HTTP traffic (Port 80).

import-module NetworkController

$Acl = New-Object Microsoft.Windows.NetworkController.Acl
$Acl.Properties = New-Object Microsoft.Windows.NetworkController.AclProperties
$Acl.ResourceId = "WebTierAcl"

# Define the Rule to Allow HTTP
$AllowHttp = New-Object Microsoft.Windows.NetworkController.AclRule
$AllowHttp.Properties = New-Object Microsoft.Windows.NetworkController.AclRuleProperties
$AllowHttp.Properties.Action = "Allow"
$AllowHttp.Properties.Protocol = "Tcp"
$AllowHttp.Properties.DestinationPortRange = "80"
$AllowHttp.Properties.Priority = 100

# Define the Rule to Block SSH
$BlockSsh = New-Object Microsoft.Windows.NetworkController.AclRule
$BlockSsh.Properties = New-Object Microsoft.Windows.NetworkController.AclRuleProperties
$BlockSsh.Properties.Action = "Deny"
$BlockSsh.Properties.Protocol = "Tcp"
$BlockSsh.Properties.DestinationPortRange = "22"
$BlockSsh.Properties.Priority = 110

# Add rules to the ACL
$Acl.Properties.AclRules = @($AllowHttp, $BlockSsh)

Step 3: Pushing the Policy to the Network Controller

Creating the object in PowerShell does not apply it to the network. You must use the New-NetworkControllerAcl cmdlet to push the configuration to the REST API.

New-NetworkControllerAcl -ConnectionUri $URI -ResourceId "WebTierAcl" -Properties $Acl.Properties -Force

Step 4: Applying the ACL to a Virtual Subnet

Once the ACL exists in the Network Controller, it must be bound to a specific virtual subnet or virtual network interface. To apply it to an entire Virtual Subnet, retrieve the subnet object, update its ACL reference, and push the update back to the controller.

$Subnet = Get-NetworkControllerVirtualSubnet -ConnectionUri $URI -VirtualNetworkId "ProdVNet" -ResourceId "WebSubnet"
$Subnet.Properties.Acl = $Acl
New-NetworkControllerVirtualSubnet -ConnectionUri $URI -VirtualNetworkId "ProdVNet" -ResourceId "WebSubnet" -Properties $Subnet.Properties -Force

The moment this command executes, the Network Controller instantly pushes the new Distributed Firewall rules to every Hyper-V host running VMs on the “WebSubnet”.

Conclusion

Configuring Network Controller Policies via PowerShell is the cornerstone of managing Windows Server 2022 SDN environments. By scripting your Access Control Lists, you can treat your network infrastructure as code, ensuring consistent, auditable, and instantly scalable security across your data center.