How to Configure Network Adapter Virtual LAN (VLAN) IDs on Windows 11 Using PowerShell

Segmenting local area networks into Virtual Local Area Networks (VLANs) according to IEEE 802.1Q standards is essential in enterprise IT environments, security labs, and virtualisation test benches. By inserting a 4-byte 802.1Q tag into the Ethernet frame header, network switches isolate broadcast domains, separating administrative management traffic from developer workstations and guest virtual machines. On Windows 11, physical network adapters and Hyper-V virtual network adapters can be configured to tag outbound Ethernet frames with specific VLAN IDs and filter inbound tagged packets. Using native PowerShell cmdlets, administrators can inspect VLAN parameters, assign 802.1Q tags, and configure trunking without relying on third-party vendor utilities.

Understanding 802.1Q VLAN Tagging on Windows

When an Ethernet packet traverses a network port configured for VLAN tagging, an 802.1Q header specifies a 12-bit VLAN Identifier (VLAN ID), allowing values from 1 to 4094:

• Access Mode: The network adapter or port is bound to a single VLAN ID. Outbound packets receive the specified VLAN tag, and inbound packets lacking the tag or bearing a mismatched ID are dropped.
• Trunk Mode: The interface accepts packets across multiple permitted VLAN IDs, commonly used by hypervisors to deliver multi-tenant network traffic to guest virtual machines.
• Untagged / Native VLAN: Packets transmitted without an 802.1Q header, typically assigned to default management networks (VLAN 1).

On Windows 11, VLAN tagging is configured at two primary layers: directly on physical NIC drivers via driver-specific advanced properties, or through the Hyper-V virtual switch layer via native networking cmdlets.

Querying Physical Network Adapter VLAN Capabilities

Before configuring VLAN tags on physical Ethernet hardware, verify that your adapter driver exposes 802.1Q tagging support. Open an elevated PowerShell session (Run as Administrator) and run:

Get-NetAdapterAdvancedProperty | Where-Object { $_.DisplayName -match "VLAN|802.1Q|Priority" }

For Intel, Realtek, and Marvell network adapters, the driver exposes properties such as Packet Priority & VLAN or VLAN ID. You can inspect the current value on your primary Ethernet interface:

Get-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "*VLAN*"

The output reports whether VLAN tagging is globally enabled on the hardware silicon.

Enabling 802.1Q Tagging and Setting Hardware VLAN IDs

To enable 802.1Q priority and VLAN tagging on the physical adapter driver:

Set-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "Packet Priority & VLAN" -DisplayValue "Packet Priority & VLAN Enabled"

To assign a specific static VLAN ID directly to the physical interface (for example, assigning VLAN ID 20 for an isolated IoT or management network):

Set-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "VLAN ID" -DisplayValue "20"

Alternatively, using driver registry keywords for automated deployment:

Set-NetAdapterAdvancedProperty -Name "Ethernet" -RegistryKeyword "*VLANId" -RegistryValue "20"

Once assigned, all outgoing frames emitted by the physical interface are tagged with VLAN 20, and the adapter will process incoming responses tagged with VLAN 20 from upstream managed switches.

To remove the tag and return the physical adapter to native untagged traffic, set the value back to 0:

Set-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "VLAN ID" -DisplayValue "0"

Configuring VLANs on Hyper-V Virtual Network Adapters

When running Hyper-V virtual machines or Windows Subsystem for Linux (WSL) on Windows 11, the cleanest and most robust method for VLAN management is configuring the virtual network adapter port rather than modifying host driver properties.

To inspect the current VLAN configuration across all virtual machine adapters:

Get-VMNetworkAdapterVlan

By default, adapters operate in Untagged mode.

Assigning Access Mode VLAN Tags to a Virtual Machine

To configure a virtual machine network adapter in Access mode, tagging all its traffic with VLAN 30:

Set-VMNetworkAdapterVlan -VMName "Ubuntu-Dev" -Access -VlanId 30

To verify the updated configuration:

Get-VMNetworkAdapterVlan -VMName "Ubuntu-Dev"

The command outputs:

VMName      VMNetworkAdapterName Mode   AccessVlanId
------      -------------------- ----   ------------
Ubuntu-Dev  Network Adapter      Access 30

Configuring Trunk Mode for Virtual Firewalls and Routers

If you are running a virtualized router, firewall (such as pfSense or OPNsense), or network packet monitor that needs to process traffic across multiple VLANs simultaneously, configure the adapter in Trunk mode:

Set-VMNetworkAdapterVlan -VMName "Firewall-VM" -Trunk -AllowedVlanIdList "10,20,30,40" -NativeVlanId 1

This allows the virtual machine to send and receive tagged frames across VLANs 10, 20, 30, and 40 while handling untagged management frames via Native VLAN 1.

Resetting Virtual Network Adapter VLAN Settings

To remove VLAN tagging from a virtual machine and return its virtual adapter to standard untagged network operation:

Set-VMNetworkAdapterVlan -VMName "Ubuntu-Dev" -Untagged

The adapter immediately clears its 802.1Q filtering rules, restoring direct communication across the default virtual switch network.