How to Configure Hyper-V Network Adapter Port Isolation in Windows 11 Using PowerShell

In multi-tenant virtualisation environments, developer test clusters, and staging labs running on Windows 11 Hyper-V, virtual machines connected to the same virtual switch frequently share an IP subnet and Layer 2 broadcast domain. In standard switch configurations, any virtual machine on the switch can communicate directly with any other virtual machine via local Ethernet frames, posing a lateral movement risk if a development container or testing VM is compromised.

While traditional network isolation requires establishing separate 802.1Q VLANs, routing subnets, or complex private VLAN (PVLAN) mappings, Hyper-V includes a native Layer 2 isolation feature: Port Isolation (configured via the PortIsolationMode property on virtual network adapters). Port Isolation prevents isolated virtual machines on the same Hyper-V Virtual Switch from communicating directly with one another, allowing them to communicate only with the default gateway, upstream physical networks, or designated promiscuous ports. This guide explains how Hyper-V Port Isolation operates, how to query adapter states, and how to configure port isolation modes using PowerShell.

Understanding Hyper-V Virtual Switch Port Isolation Modes

Hyper-V Virtual Switch port isolation controls traffic forwarding at the Layer 2 switch port level. When port isolation is enabled on a virtual machine network adapter, the Hyper-V Virtual Switch filters inbound and outbound unicast, multicast, and broadcast frames between isolated endpoints.

The Set-VMNetworkAdapter cmdlet controls port isolation through three distinct operational modes:

• None (Default): Standard Ethernet switching. The virtual machine network adapter communicates freely with all other virtual machines connected to the same virtual switch and VLAN, as well as external network gateways.
• Isolated: Complete lateral isolation. The virtual machine network adapter can transmit packets to external physical hosts, default IP gateways, and non-isolated ports, but it is strictly blocked from exchanging packets with any other network adapter configured in Isolated mode on the same switch, even if they share the exact same IP subnet.
• Vlan: Extends isolation based on standard 802.1Q VLAN tagging rules, filtering inter-VM traffic across matching VLAN tags while allowing upstream trunk forwarding.

Port Isolation provides significant architectural advantages for sandbox and multi-tenant hosting: multiple virtual machines can reside within a single flat subnet (e.g. 192.168.100.0/24) and obtain IP addresses from a single DHCP server without having the ability to port-scan, spoof ARP caches, or sniff traffic from adjacent neighbour VMs.

Prerequisites and Environment Verification

Configuring Hyper-V network adapter properties requires an elevated PowerShell console running as Administrator. Ensure the Hyper-V management module is loaded and that the virtual machine management service is active:

# Check Hyper-V module availability
Get-Module -ListAvailable -Name Hyper-V

# Ensure the VMMS service is running
Get-Service -Name vmms

Next, list existing virtual machines and their attached virtual switches to identify the target adapters:

Get-VM | Select-Object Name, State, VirtualSwitchName | Format-Table -AutoSize

Inspecting Current Port Isolation Settings

By default, Hyper-V virtual network adapters operate with port isolation set to None. To verify the current port isolation status across all virtual machines, run Get-VMNetworkAdapter and select the isolation properties:

Get-VMNetworkAdapter -All | Select-Object VMName, Name, SwitchName, PortIsolationMode, AllowTeaming, IeeePriorityTag | Format-Table -AutoSize

PowerShell outputs the current adapter security state:

VMName        Name                   SwitchName    PortIsolationMode AllowTeaming IeeePriorityTag
------        ----                   ----------    ----------------- ------------ ---------------
Tenant-Web01  Network Adapter        ExternalSwitch             None        False           Off
Tenant-Web02  Network Adapter        ExternalSwitch             None        False           Off
Secure-Worker Network Adapter        InternalSwitch             None        False           Off
Gateway-Router Network Adapter       ExternalSwitch             None        False           Off

To inspect a single virtual machine adapter in detail, use Get-VMNetworkAdapter filtered by VM name:

Get-VMNetworkAdapter -VMName "Tenant-Web01" | Select-Object VMName, Name, PortIsolationMode, MacAddress, Status | Format-List

Configuring Isolated Mode on Virtual Network Adapters

Port Isolation can be applied while virtual machines are running without requiring a reboot or network adapter detachment.

Enabling Port Isolation on Individual Virtual Machines

To isolate a tenant virtual machine so it cannot communicate with other isolated virtual machines on the same switch, set -PortIsolationMode to Isolated:

Set-VMNetworkAdapter -VMName "Tenant-Web01" -PortIsolationMode Isolated
Set-VMNetworkAdapter -VMName "Tenant-Web02" -PortIsolationMode Isolated

With this configuration applied:

• Tenant-Web01 can reach the default gateway, DNS servers, and external internet hosts.
• Tenant-Web02 can reach the default gateway, DNS servers, and external internet hosts.
• Direct network packets (ping, SSH, HTTP, SMB) between Tenant-Web01 and Tenant-Web02 are dropped by the Hyper-V Virtual Switch before reaching either VM’s virtual NIC.

Bulk-Enabling Port Isolation Across All Lab Virtual Machines

In automated testing environments or student lab deployments, you can apply port isolation across an entire collection of virtual machines matching a naming pattern:

# Apply isolation to all VMs prefixed with 'Lab-'
Get-VM -Name "Lab-*" | Get-VMNetworkAdapter | Set-VMNetworkAdapter -PortIsolationMode Isolated

Configuring Promiscuous Gateway Adapters

In multi-tenant topologies where a dedicated firewall, router, or proxy virtual machine (e.g. pfSense, OPNsense, or Windows Server RRAS) manages tenant traffic, the gateway must retain the ability to communicate with all isolated virtual machines.

To maintain gateway accessibility:

1. Leave the gateway VM’s network adapter configured with PortIsolationMode None:

   Set-VMNetworkAdapter -VMName "Gateway-Router" -PortIsolationMode None

2. Because the gateway is not in Isolated mode, both Tenant-Web01 and Tenant-Web02 can establish bidirectional Layer 2 communication with Gateway-Router.
3. All traffic passing between Tenant-Web01 and Tenant-Web02 must be routed through Gateway-Router, where firewall inspection, intrusion detection, and access control policies can be enforced.

Reverting Port Isolation to Default Mode

To restore standard lateral communication between virtual machines on the same switch, reset PortIsolationMode to None:

Set-VMNetworkAdapter -VMName "Tenant-Web01" -PortIsolationMode None
Set-VMNetworkAdapter -VMName "Tenant-Web02" -PortIsolationMode None

Verify that the setting has reverted:

Get-VMNetworkAdapter -VMName "Tenant-Web01" | Select-Object VMName, PortIsolationMode

Validating Port Isolation Functionality

To confirm that port isolation is actively filtering traffic on the Hyper-V Virtual Switch, perform end-to-end connectivity verification:

1. Log in to Tenant-Web01 and verify outbound network connectivity by pinging the upstream gateway:

   ping 192.168.1.1

   (The ping should succeed, demonstrating normal egress connectivity).
2. Attempt to ping the adjacent isolated virtual machine (Tenant-Web02):

   ping 192.168.1.52

   (The ping will result in Request timed out or Destination host unreachable).
3. From the Hyper-V host, inspect packet drop counters and virtual port statistics using PowerShell:

   Get-VMNetworkAdapter -VMName "Tenant-Web01" | Select-Object -ExpandProperty DroppedPacketsCount

Combining Port Isolation with Hyper-V DHCP Guard and Router Guard establishes a hardened Layer 2 environment that prevents lateral reconnaissance, ARP poisoning, and rogue gateway attacks across Windows 11 virtualisation hosts.