Windows 10: Hyper V Net Adapters are down after each pc reboot requiring me to delete the vSwitch and...

Hi,I have this PC that needs to connect to two different vlans. I created a vSwitch and then I created two network adapters. They work fine until I shutdown the PC. When I turn it back on, both adapters are down. ipconfig says media disconnect. When I check their status in hardware and connection properties, it says not operational. I tried disabling them and reenabling them to no end. The only solution that works is me deleting the vSwitch that I created and creating a new one, then recreating the two net adapters. I tried googling it / chat-gpt, but I couldn't find anything only about this i

:)

 

Hyper-V vswitches and linux AFPACKET bridging

Hello!

I seem to be having a problem with hyper-v client. I'm running windows 10 x64, and installed hyper-v on my system. So far, it's a great hypervisor, and the features are just fantastic. I really wish MS was advertise this as a feature, because it's pretty
awesome.

Anyhoo, here's my problem:

I'm a malware analyst and I have the following network setup in hyper-v:

1 vswitch bridged to my workstation's physical network card. We'll call this vswitch1

3 private vswitches. We'll call these vswitch2, 3, and 4, respectively.

I have a PFsense VM connected to vswitch 1, 2, and 3. PFSense works fine and routes/firewalls properly between all the networks.

I have another VM, a debian 8 x64 linux VM. This VM is connected to vswitch 2 for management access, and connected to vswitch 3 and 4 to act as a bridge.

Why am I doing this? I plan on having malware analysis vms on vswitch 4. the debian VM acts as "fail-close"/failsafe in that if the malware does things I don't expect, I can power down the VM and remove its network access while leaving the PFSense VM that
is routing and firewalling for my other VM networks alone.

I've done this before and I have gotten this to work on virtualbox, vmware workstation, vmware fusion, and vmware ESX with zero problems.

I configure the interfaces that my IPS software will be sniffing on (in this case, assume I'm using the snort IPS):

- I turn off any and all checksumming and/or checksum offloading for the interfaces

- I put the interfaces into promiscuous mode

- I activate snort and configure it to bridge between my two network interfaces (eth1 and eth2, respectively) using AFPACKET.

I spin up a malware analysis VM and put it on vswitch 4 and... it can't reach anything at all. running TCPDUMP shows that broadcast traffic makes it to my IPS/failsafe VM, crosses the bridge, then my pfsense VM, connected to vswitch 3 never sees it. It doesn't
respond to ARP, it doesn't respond to DHCP.

So I gave my analysis vm a static IP address, a default route, its dns servers, and statically configured arp so that the VM would know the mac address of the PFSense VM (its default gateway) and... nothing worked still. It's almost as though vswitch 3 is
dropping the traffic somehow.

Now, when I do this in vmware ESX, I have to configure any vswitches that I'm bridging between to allow promiscuous mode for this to actually work. Knowing this, I did the following:

On my PFsense VM, I configured the interface on vswitch 3 to be a port mirroring SOURCE

On the IPS VM running debian, I configured the NIC connected to vswitch 3 to be a DESTINATION

On my malware analysis vm on vswitch 4, I configured it to be a port mirroring SOURCE

On the IPS VM running deibain, I configured the NIC connected to vswitch 4 to be a DESTINATION

and still, it doesn't work, and I can't fathom why.

So let's recap:

- I'm trying to bridge to hyper-v vswitches together with a LINUX vm using AFPACKET bridging.

- I'm not asking for linux or IDS/IPS technical support. I've done this a number of time on other baremetal and hosted hypervisors and got it to work.

- Just so we're abundantly clear, I have checksum offloading turned off completely on the linux VM interfaces, and snort is operating with the "-k none" flag to NOT mess with network traffic checksums. Still no dice.

- I've turned on promiscuous mode on the linux vm's network interfaces, activate the bridge, and can see broadcast messages (DHCP requests and ARP requests) go across the AFPACKET bridge, but then something is preventing the VM on the other side from getting
the traffic. the fact that I can see the broadcast traffic on either side of the AFPACKET bridge leads me to believe that this isn't a linux problem, it's a problem with hyper-v, or the vswitch, or something.

Help MS Community, you're my only hope.

 

Hyper-V vSwitch "port" speed

I have a Server 2019 Hyper-V server and have a SET team of 6 10G NICs bound to an external vSwitch. I have created a vNIC on the management OS which creates a virtual NIC in the OS. It is my understanding that this is just like a "port" on a network
switch. My question is what speed is this port? I am going to use this vNIC for my VM traffic. I know that the VM traffic with be load balanced across the SET team but I would like to know if this single "port"/vNIC will be limited in bandwidth to 10G?

 

Hyper-V

Only Pro or Enterprise versions can run Hyper-V, in addition to the other requirements listed at the link I provided earlier.