Skip to content

Commit ce544ed

Browse files
authored
Update configure-mirror-hyper-v.md
Added extra options to do the steps in PowerShell Added a section to specify the VLAN config in case the monitored traffic comes from different VLAN(s) then the Hyper-V host sits in. Removed line "In the Hardware list, under the Network Adapter drop-down list, select Hardware Acceleration and clear the Virtual Machine Queue option for the monitoring network interface." as it was not reflected in the PowerShell version and I don't believe it is needed.
1 parent 530f7bf commit ce544ed

File tree

1 file changed

+46
-4
lines changed

1 file changed

+46
-4
lines changed

articles/defender-for-iot/organizations/traffic-mirroring/configure-mirror-hyper-v.md

Lines changed: 46 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,23 @@ Before you start:
3030

3131
- Ensure that the data port SPAN configuration isn't configured with an IP address.
3232

33-
## Configure a traffic mirroring port with Hyper-V
33+
## Create new Hyper-V virtual switch to rely the mirrored traffic into the VM
34+
35+
### Create a new virtual switch with PowerShell
36+
37+
```PowerShell
38+
New-VMSwitch -Name vSwitch_Span -NetAdapterName Ethernet -AllowManagementOS:$true
39+
```
40+
Where:
41+
42+
| Parameter | Description |
43+
|--|--|
44+
|**vSwitch_Span** |Newly added SPAN virtual switch name |
45+
|**Ethernet** |Physical adapter name |
46+
47+
Reference: [Create and configure a virtual switch with Hyper-V](https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/get-started/create-a-virtual-switch-for-hyper-v-virtual-machines?tabs=powershell#create-a-virtual-switch)
48+
49+
### Create a new virtual switch with Hyper-V Manager
3450

3551
1. Open the Virtual Switch Manager.
3652

@@ -84,15 +100,23 @@ If you use PowerShell, define the name of the newly added adapter hardware as `M
84100
85101
:::image type="content" source="../media/tutorial-install-components/vswitch-span.png" alt-text="Screenshot of selecting the following options on the virtual switch screen.":::
86102
87-
1. In the **Hardware** list, under the **Network Adapter** drop-down list, select **Hardware Acceleration** and clear the **Virtual Machine Queue** option for the monitoring network interface.
88-
89103
1. In the **Hardware** list, under the **Network Adapter** drop-down list, select **Advanced Features**. Under the **Port Mirroring** section, select **Destination** as the mirroring mode for the new virtual interface.
90104
91105
:::image type="content" source="../media/tutorial-install-components/destination.png" alt-text="Screenshot of the selections needed to configure mirroring mode.":::
92106
93107
1. Select **OK**.
94108
95-
## Turn on Microsoft NDIS capture extensions
109+
## Turn on Microsoft NDIS capture extensions with PowerShell
110+
111+
Turn on support for [Microsoft NDIS Capture Extensions](/windows-hardware/drivers/network/capturing-extensions) for the virtual switch you'd [created earlier](#configure-a-traffic-mirroring-port-with-hyper-v).
112+
113+
**To enable Microsoft NDIS capture extensions for your new virtual switch**:
114+
115+
```PowerShell
116+
Enable-VMSwitchExtension -VMSwitchName vSwitch_Span -Name "Microsoft NDIS Capture"
117+
```
118+
119+
## Turn on Microsoft NDIS capture extensions with Hyper-V Manager
96120

97121
Turn on support for [Microsoft NDIS Capture Extensions](/windows-hardware/drivers/network/capturing-extensions) for the virtual switch you'd [created earlier](#configure-a-traffic-mirroring-port-with-hyper-v).
98122

@@ -139,6 +163,24 @@ Get-VMSwitchExtensionPortFeature -FeatureName "Ethernet Switch Port Security Set
139163
|--|--|
140164
|**vSwitch_Span** | Newly added SPAN virtual switch name |
141165

166+
## Configure VLAN settings for the Monitor adapter (if needed)
167+
168+
In case the HYper-V server would sit in a diffeernt VLAN than the VLAN from which the mirrored traffic comes, the Monitor adapter must be set to accpet traffic from the mirrored VLANs
169+
170+
Use below PowerShell command to enable the Monitor adapter to accept traffic from the monitored traffic from different VLANs:
171+
```PowerShell
172+
Set-VMNetworkAdapterVlan -VMName VK-C1000V-LongRunning-650 -VMNetworkAdapterName Monitor -Trunk -AllowedVlanIdList 1010-1020 -NativeVlanId 10
173+
```
174+
Where:
175+
176+
| Parameter | Description |
177+
|--|--|
178+
|**VK-C1000V-LongRunning-650** | CPPM VA name |
179+
|**1010-1020** |VLAN range from which IoT traffic is mirrored |
180+
|**10** |tive VLAN ID of the environment |
181+
182+
Reference: [Set-VMNetworkAdapterVlan](https://learn.microsoft.com/en-us/powershell/module/hyper-v/set-vmnetworkadaptervlan?view=windowsserver2022-ps)
183+
142184
[!INCLUDE [validate-traffic-mirroring](../includes/validate-traffic-mirroring.md)]
143185

144186
## Next steps

0 commit comments

Comments
 (0)