How to Configure IPsec Task Offload on Hyper-V Network Adapters in Windows 11 Using PowerShell

In secure enterprise networks, regulatory compliance standards (such as HIPAA, PCI-DSS, and Zero Trust architectures) mandate mutual authentication and end-to-end payload encryption across all internal server-to-server and virtual machine communication. When virtual machines establish encrypted connections using Internet Protocol Security (IPsec), encrypting and authenticating high-bandwidth traffic using modern ciphers (such as AES-GCM or AES-CBC with SHA-256) consumes significant CPU cycles on the host processor.

To eliminate this performance penalty, Microsoft Hyper-V supports IPsec Task Offload (IPsecTO). IPsec Task Offload enables virtual network adapters attached to the Hyper-V Virtual Switch to offload cryptographic hash computation, encryption, and decryption tasks directly to the physical network interface card’s (NIC) dedicated hardware cryptographic processing engine. Offloading IPsec processing dramatically reduces virtual processor utilization and lowers packet latency during intensive database replication or secure file transfers. This guide explains how IPsec Task Offload functions in Hyper-V on Windows 11 and details how to query, configure, and optimize offload limits using PowerShell.

Understanding IPsec Task Offload in Hyper-V

In standard network environments without hardware offload, when a virtual machine transmits an IPsec packet, the guest operating system’s software IPsec stack encrypts the data payload, recalculates authentication headers (AH) or Encapsulating Security Payload (ESP) tags, and computes packet checksums using software emulation running on virtual CPU cores. On 10 Gbps or 25 Gbps network fabrics, this software processing can saturate multiple CPU cores.

Hyper-V IPsec Task Offload addresses this bottleneck through physical NIC hardware coordination:

• Security Association (SA) Offloading: When a VM establishes an IPsec tunnel, the guest operating system creates a Security Association (SA) containing encryption keys, sequence numbers, and cipher parameters. Hyper-V’s Virtual Switch and Virtual Machine Multi-Queue (VMMQ) drivers pass these SA definitions down to the physical NIC.
• Hardware Crypto Acceleration: The physical network adapter encrypts outbound packets as they leave the physical port and decrypts inbound frames before delivering them across the virtual switch into guest memory, bypassing software crypto processing completely.
• Security Association Quotas: Hardware NICs possess finite on-chip memory for storing active cryptographic keys. Hyper-V allows administrators to configure the IPsecOffloadMaximumSecurityAssociation parameter on each virtual adapter to prevent any single virtual machine from monopolising physical NIC crypto tables.

By default, Hyper-V virtual network adapters have IPsec task offload enabled with a default capacity of 512 Security Associations, which can be tuned or disabled via PowerShell.

Prerequisites and Physical Hardware Verification

Configuring Hyper-V network adapter properties requires an elevated PowerShell session running as Administrator. In addition, physical NIC hardware must support IPsec Task Offload v2.

First, verify that your physical network adapters support IPsec offload features using Get-NetAdapterAdvancedProperty:

Get-NetAdapterAdvancedProperty | Where-Object { $_.DisplayName -like "*IPsec*" -or $_.RegistryKeyword -like "*IPsec*" } | Select-Object Name, DisplayName, DisplayValue, RegistryValue

If your physical adapter (e.g. Intel Ethernet Controller or Mellanox ConnectX) supports IPsec offloading, confirm that the driver property (e.g. IPsec Task Offload) is set to Enabled.

Next, confirm that the Hyper-V host management service is active:

Get-Service -Name vmms

Inspecting Current IPsec Task Offload Settings on Virtual Adapters

To inspect the current IPsec Task Offload quotas across all virtual machines on your Windows 11 host, query the IPsecOffloadMaximumSecurityAssociation attribute via Get-VMNetworkAdapter:

Get-VMNetworkAdapter -All | Select-Object VMName, Name, SwitchName, IPsecOffloadMaximumSecurityAssociation, Status | Format-Table -AutoSize

PowerShell outputs the configured Security Association thresholds:

VMName          Name            SwitchName      IPsecOffloadMaximumSecurityAssociation Status
------          ----            ----------      -------------------------------------- ------
Prod-SQL01      Network Adapter ExternalSwitch                                     512 {Ok}
Prod-SQL02      Network Adapter ExternalSwitch                                     512 {Ok}
App-Gateway     Network Adapter ExternalSwitch                                     512 {Ok}
Dev-Sandbox     Network Adapter InternalSwitch                                     512 {Ok}

To examine a single virtual machine’s complete hardware offload configuration, filter by VM name:

Get-VMNetworkAdapter -VMName "Prod-SQL01" | Select-Object VMName,
    IPsecOffloadMaximumSecurityAssociation,
    VmqWeight,
    VrssEnabled,
    PacketDirectNumaExtension | Format-List

Configuring IPsec Security Association Limits

Adjusting the IPsecOffloadMaximumSecurityAssociation parameter configures how many simultaneous encrypted IPsec tunnels the guest can offload to physical hardware.

Increasing Offload Quotas for High-Throughput Gateways

For dedicated VPN gateways, Active Directory domain controllers, or cluster database nodes that terminate hundreds of encrypted client tunnels, expand the hardware SA allocation to 1024 or 2048:

Set-VMNetworkAdapter -VMName "App-Gateway" -IPsecOffloadMaximumSecurityAssociation 2048
Set-VMNetworkAdapter -VMName "Prod-SQL01" -IPsecOffloadMaximumSecurityAssociation 1024

This setting takes effect immediately without requiring a virtual machine reboot or network adapter reset.

Disabling IPsec Offload on Non-Essential Virtual Machines

Because physical network adapters have a finite global capacity for hardware Security Associations, allocating quotas to non-essential test machines or unencrypted staging environments wastes hardware table capacity. To disable IPsec hardware offloading on development guests, set the maximum SA limit to 0:

Set-VMNetworkAdapter -VMName "Dev-Sandbox" -IPsecOffloadMaximumSecurityAssociation 0

When set to 0, the virtual machine will fall back to standard software-based IPsec processing inside the guest OS, preserving physical NIC crypto registers for production workloads.

Configuring Guest Operating System IPsec Offload Support

For IPsec Task Offload to function, the guest operating system running inside the virtual machine must also enable hardware offload in its network stack.

Inside Windows 10/11 or Windows Server guest operating systems, open an elevated PowerShell prompt within the VM and verify IPsec offload support:

# Check IPsec Task Offload on guest interface
Get-NetAdapterAdvancedProperty -Name "Ethernet*" | Where-Object { $_.DisplayName -like "*IPsec*" }

Ensure that the Windows IPsec service (IKEEXT and PolicyAgent) is active and that the TCP/IP stack permits task offloading:

Get-Service -Name PolicyAgent, IKEEXT

In Linux guest operating systems, verify that the synthetic hv_netvsc driver is loaded and that IPsec offload capabilities are reported by ethtool:

ethtool -k eth0 | grep -i ipsec

Monitoring Active Offloaded Security Associations

To verify that active IPsec tunnels are genuinely being processed by physical network hardware rather than the CPU, monitor IPsec operational statistics.

Inside a Windows guest or host running IPsec connections, execute netsh to inspect active Security Associations and offload states:

netsh ipsec dynamic show stats

Review the output under IPsec Task Offload Statistics:

IPsec Task Offload Statistics:
------------------------------------------
Active Offloaded SAs: 4
Bytes Sent (Offloaded): 14,892,104,288
Bytes Received (Offloaded): 28,491,012,410
Failed Offload Connections: 0

If Active Offloaded SAs is greater than zero and offloaded byte counters increment during data transfer, the Hyper-V Virtual Switch is successfully offloading crypto operations to the physical NIC.

To audit packet drop counters and confirm healthy virtual switch forwarding from the Hyper-V host, run:

Get-VMNetworkAdapter -VMName "Prod-SQL01" | Select-Object VMName, Status, DroppedPacketsCount

By tuning Security Association quotas based on workload criticality, administrators can maintain robust network encryption without sacrificing host processor performance or packet throughput.