How to Configure Hyper-V Virtual Subnet IDs on Network Adapters in Windows 11 Using PowerShell

In multi-tenant cloud hosting, software-defined networking (SDN), and isolated development laboratories on Windows 11 Hyper-V, hosting multiple distinct customer environments or staging topologies on a single physical host presents network isolation challenges. Traditionally, separating tenant traffic required provisioning dedicated 802.1Q VLAN IDs across physical switches. However, traditional VLANs are limited to 4,096 total IDs globally and require complex physical network switch configuration every time a new subnet is created.

To overcome VLAN scalability limits and enable flexible network virtualization, Microsoft Hyper-V integrates Hyper-V Network Virtualization (HNV) using Network Virtualization Generic Routing Encapsulation (NVGRE) and Virtual Subnet IDs (VSID). By configuring the VirtualSubnetId property on virtual machine network adapters via PowerShell, administrators can bind virtual machines to dedicated 24-bit virtual subnets (supporting up to 16 million distinct isolated segments). Multiple independent tenants can even use identical, overlapping private IP addresses (such as 10.0.0.1/24) on the same virtual switch without routing collisions. This guide explains how Hyper-V Virtual Subnet IDs operate and details how to query, configure, and isolate virtual network adapters using PowerShell.

Architecture of Hyper-V Virtual Subnet IDs and Network Virtualization

Hyper-V Network Virtualization decouples a virtual machine’s logical IP network from the physical network infrastructure using address virtualization:

• Customer Address (CA): The private IP address assigned inside the guest virtual machine’s operating system (e.g. 192.168.1.50). The guest OS uses its CA for all local routing and application binds.
• Provider Address (PA): The physical network IP address configured on the Hyper-V host’s physical network adapters. When a packet leaves the virtual machine, Hyper-V encapsulates the CA frame inside an NVGRE packet tagged with the PA and Virtual Subnet ID.
• Virtual Subnet ID (VSID): A 24-bit integer (ranging from 4096 to 16777214) that identifies the virtual broadcast domain. Only virtual network adapters configured with the identical VirtualSubnetId can exchange Layer 2 packets directly.
• Multi-Tenant IP Overlap: Because isolation occurs at the 24-bit VSID layer, Tenant Alpha (VSID 5001) and Tenant Beta (VSID 5002) can both configure 192.168.1.100 on their respective virtual machines without IP conflict, since packets remain segregated within their encapsulated virtual subnets.

Configuring Virtual Subnet IDs allows developers and test engineers to spin up isolated multi-tier networks on local Windows 11 machines without modifying physical router settings or requesting enterprise VLAN tags.

Prerequisites and Environment Verification

Configuring Hyper-V network adapter properties requires an elevated PowerShell session running as Administrator. Ensure that the Hyper-V module is loaded and that the virtual machine management service is active:

# Check Hyper-V module availability
Get-Module -ListAvailable -Name Hyper-V

# Ensure the VMMS service is running
Get-Service -Name vmms

Next, list the virtual machines and attached network adapters to identify target endpoints:

Get-VM | Select-Object Name, State, VirtualSwitchName | Format-Table -AutoSize

Inspecting Current Virtual Subnet ID Settings

By default, Hyper-V virtual network adapters operate with VirtualSubnetId set to 0, meaning network virtualization is disabled and traffic passes across standard physical/virtual switch VLANs.

To inspect current Virtual Subnet ID configurations across all virtual machines, run Get-VMNetworkAdapter:

Get-VMNetworkAdapter -All | Select-Object VMName, Name, SwitchName, VirtualSubnetId, Status | Format-Table -AutoSize

PowerShell outputs the current network virtualization status:

VMName          Name            SwitchName      VirtualSubnetId Status
------          ----            ----------      --------------- ------
TenantA-Web01   Network Adapter ExternalSwitch                0   {Ok}
TenantA-DB01    Network Adapter ExternalSwitch                0   {Ok}
TenantB-Web01   Network Adapter ExternalSwitch                0   {Ok}
TenantB-DB01    Network Adapter ExternalSwitch                0   {Ok}

To inspect an individual virtual machine’s complete virtualization configuration, filter by VM name:

Get-VMNetworkAdapter -VMName "TenantA-Web01" | Select-Object VMName, Name, VirtualSubnetId, PortIsolationMode, AllowTeaming | Format-List

Assigning Virtual Subnet IDs to Virtual Machine Adapters

Virtual Subnet IDs can be assigned while virtual machines are running without requiring a reboot or network adapter detachment.

Configuring Subnet Isolation for Tenant A

To group TenantA-Web01 and TenantA-DB01 into an isolated virtual network segment, assign them an identical Virtual Subnet ID (e.g. 6001):

Set-VMNetworkAdapter -VMName "TenantA-Web01" -VirtualSubnetId 6001
Set-VMNetworkAdapter -VMName "TenantA-DB01" -VirtualSubnetId 6001

Both virtual machines can now communicate directly with each other across VSID 6001.

Configuring Subnet Isolation for Tenant B

Assign a distinct Virtual Subnet ID (e.g. 6002) to Tenant B’s virtual machines:

Set-VMNetworkAdapter -VMName "TenantB-Web01" -VirtualSubnetId 6002
Set-VMNetworkAdapter -VMName "TenantB-DB01" -VirtualSubnetId 6002

With this configuration active:

• TenantA-Web01 and TenantA-DB01 communicate seamlessly on VSID 6001.
• TenantB-Web01 and TenantB-DB01 communicate seamlessly on VSID 6002.
• Packets transmitted from Tenant A’s VMs cannot reach Tenant B’s VMs, even though all four machines are connected to the exact same Hyper-V Virtual Switch and share identical IP addressing schemes.

Bulk-Assigning Virtual Subnet IDs via Pipeline

In automated laboratory deployments or multi-tier script setups, assign Virtual Subnet IDs dynamically based on virtual machine naming conventions:

# Assign VSID 7001 to all virtual machines matching 'Lab-Alpha*'
Get-VM -Name "Lab-Alpha*" | Get-VMNetworkAdapter | Set-VMNetworkAdapter -VirtualSubnetId 7001

Verify that the assignment propagated across all targeted adapters:

Get-VMNetworkAdapter -All | Where-Object { $_.VirtualSubnetId -gt 0 } | Select-Object VMName, SwitchName, VirtualSubnetId | Format-Table -AutoSize

Reverting Virtual Subnet IDs to Standard Switching

To remove network virtualization encapsulation and return a virtual machine network adapter to standard un-encapsulated physical switch forwarding, reset VirtualSubnetId to 0:

Set-VMNetworkAdapter -VMName "TenantA-Web01" -VirtualSubnetId 0
Set-VMNetworkAdapter -VMName "TenantA-DB01" -VirtualSubnetId 0

Verify that the adapter has reverted to default switching:

Get-VMNetworkAdapter -VMName "TenantA-Web01" | Select-Object VMName, VirtualSubnetId

Validating Multi-Tenant Isolation and Packet Forwarding

To confirm that Virtual Subnet IDs are enforcing Layer 2 segmentation:

1. Configure identical static IP addresses inside the guest operating systems of TenantA-Web01 and TenantB-Web01 (e.g. 192.168.10.10/24).
2. Initiate a continuous ping from TenantA-Web01 to its partner database TenantA-DB01 (192.168.10.20). The ping will succeed across VSID 6001.
3. Verify from the Hyper-V host that no ARP collisions or duplicate IP warnings are logged in the Windows Event Viewer.
4. Audit packet delivery and dropped frames on the Hyper-V Virtual Switch:

   Get-VMNetworkAdapter -VMName "TenantA-Web01" | Select-Object VMName, Status, DroppedPacketsCount

Leveraging Hyper-V Virtual Subnet IDs provides scalable, high-density multi-tenant network partitioning, enabling complex software-defined networking labs on Windows 11 workstations without physical infrastructure overhead.