Route traffic across networks in the SDN infrastructure

VMM 2025 and 2022 support dual stack (Ipv4 + Ipv6) for SDN components.

To enable IPv6 for site-to-site VPN connection, routing subnet must be both IPv4 and IPv6. For gateway to work in IPv6, provide IPv4 and IPv6 addresses separated by semicolon (;) and provide IPv6 address in the remote endpoint. For example, 192.0.2.1/23;2001:0db8:85a3:0000:0000:8a2e:0370::/64. For specifying VIP range, don’t use the shortened form of the IPv6 address; use ‘2001:db8:0:200:0:0:0:7’ format instead of ‘2001:db8:0:200::7’.

Configure L3 forwarding

L3 forwarding enables connectivity between the physical infrastructure in the datacenter and the virtualized infrastructure in the Hyper-V network virtualization cloud.

Using L3 forwarding, tenant network virtual machines can connect to a physical network through the Windows Server 2016 SDN Gateway, which is already configured in an SDN environment. In this case, the SDN gateway acts as a router between the virtualized network and the physical network.

To learn more, check these articles: Windows server gateway as a forwarding gateway and RAS gateway high availability.

Ensure the following before you attempt to configure L3:

• Ensure you're logged on as an administrator on the VMM server.
• You must configure a unique next-hop logical network, with unique VLAN ID, for each Tenant VM network for which L3 forwarding needs to be set up. There must be 1:1 mapping between a tenant network and corresponding physical network (with unique VLAN ID).

Use the following steps to create the next-hop logical network in SCVMM:

1. On the VMM console, select Logical Networks, right-click and select Create Logical Network.

2. In the Settings page, choose One connected network and select the checkbox for Create a VM network with the same name to allow virtual machines to access this logical network directly and Managed by Microsoft Network Controller

3. Create an IP Pool for this new logical network.

   IP address from this pool is required in the script for setting up L3 forwarding.

The following table provides examples of dynamic and static L3 connections.

Run the following script to set up L3 forwarding. Refer to the table above to check what each script parameter identifies.

  param (
      [Parameter(Mandatory=$true)]
      # Name of the L3 VPN connection
      $L3VPNConnectionName,
      [Parameter(Mandatory=$true)]
      # Name of the VM network to create gateway
      $VmNetworkName,
      [Parameter(Mandatory=$true)]
      # Name of the Next Hop one connected VM network
      # used for forwarding
      $NextHopVmNetworkName,
      [Parameter(Mandatory=$true)]
      # IPAddresses on the local side that will be used
      # for forwarding
      # Format should be @("10.10.10.100/24")
      $LocalIPAddresses,
      [Parameter(Mandatory=$true)]
      # IPAddresses on the remote side that will be used
      # for forwarding
      # Format should be @("10.10.10.200")
      $PeerIPAddresses,
      [Parameter(Mandatory=$false)]
      # Subnet for the L3 gateway
      # default value 10.254.254.0/29
      $GatewaySubnet = "10.254.254.0/29",
      [Parameter(Mandatory=$false)]
      # List of subnets for remote tenants to add routes for static routing
      # Format should be @("14.1.20.0/24","14.1.20.0/24");
      $RoutingSubnets = @(),
      [Parameter(Mandatory=$false)]
      # Enable BGP in the tenant space
      $EnableBGP = $false,
      [Parameter(Mandatory=$false)]
      # ASN number for the tenant gateway
      # Only applicable when EnableBGP is true
      $TenantASN = "0"
  )

  # Import SC-VMM PowerShell module
  Import-Module virtualmachinemanager

  # Retrieve Tenant VNET info and exit if VM Network not available
  $vmNetwork = Get-SCVMNetwork -Name $VmNetworkName;
  if ($vmNetwork -eq $null)
  {
      Write-Verbose "VM Network $VmNetworkName not found, quitting"
      return
  }

  # Retrieve L3 Network info and exit if VM Network not available
  $nextHopVmNetwork = Get-SCVMNetwork -Name $NextHopVmNetworkName;
  if ($nextHopVmNetwork -eq $null)
  {
      Write-Verbose "Next Hop L3 VM Network $NextHopVmNetworkName not found, quitting"
      return
  }

  # Retrieve gateway Service and exit if not available
  $gatewayDevice = Get-SCNetworkGateway | Where {$_.Model -Match "Microsoft Network Controller"};
  if ($gatewayDevice -eq $null)
  {
      Write-Verbose "Gateway Service not found, quitting"
      return
  }

  # Retrieve Tenant Virtual Gateway info
  $vmNetworkGatewayName = $VmNetwork.Name + "_Gateway";
  $VmNetworkGateway = Get-SCVMNetworkGateway -Name $vmNetworkGatewayName -VMNetwork $vmNetwork

  # Create a new Tenant Virtual Gateway if not configured
  if($VmNetworkGateway -eq $null)
  {
      if($EnableBGP -eq $false)
      {
          # Create a new Virtual Gateway for tenant
          $VmNetworkGateway = Add-SCVMNetworkGateway -Name $vmNetworkGatewayName -EnableBGP $false -NetworkGateway $gatewayDevice -VMNetwork $vmNetwork -RoutingIPSubnet $GatewaySubnet;
      }
      else
      {
          if($TenantASN -eq "0")
          {
              Write-Verbose "Please specify valid ASN when using BGP"
              return
          }

          # Create a new Virtual Gateway for tenant
          $VmNetworkGateway = Add-SCVMNetworkGateway -Name $vmNetworkGatewayName -EnableBGP $true -NetworkGateway $gatewayDevice -VMNetwork $vmNetwork -RoutingIPSubnet $GatewaySubnet -AutonomousSystemNumber $TenantASN;
      }

  }

  if ($VmNetworkGateway -eq $null)
  {
      Write-Verbose "Could not Find / Create Virtual Gateway for $($VmNetwork.Name), quitting"
      return
  }

  # Check if the network connection already exists
  $vpnConnection = Get-SCVPNConnection -VMNetworkGateway $VmNetworkGateway -Name $L3VPNConnectionName
  if ($vpnConnection -ne $null)
  {
      Write-Verbose "L3 Network Connection for $($VmNetwork.Name) already configured, skipping"
  }
  else
  {
      # Create a new L3 Network connection for tenant
      $vpnConnection = Add-SCVPNConnection  -NextHopNetwork $nexthopvmNetwork  -Name $L3VPNConnectionName -IPAddresses $LocalIPAddresses -PeerIPAddresses $PeerIPAddresses -VMNetworkGateway $VmNetworkGateway -protocol L3;

      if ($vpnConnection -eq $null)
      {
          Write-Verbose "Could not add network connection for $($VmNetwork.Name), quitting"
          return
      }
      Write-Output "Created VPN Connection " $vpnConnection;
  }

  # Add all the required static routes to the newly created network connection interface
  foreach($route in $RoutingSubnets)
  {
      Add-SCNetworkRoute -IPSubnet $route -RunAsynchronously -VPNConnection $vpnConnection -VMNetworkGateway $VmNetworkGateway
  }

Configure L3 forwarding

L3 forwarding enables connectivity between the physical infrastructure in the datacenter and the virtualized infrastructure in the Hyper-V network virtualization cloud.

Using L3 forwarding connection, tenant network virtual machines can connect to a physical network through the Windows Server 2016/2019 SDN Gateway, which is already configured in an SDN environment. In this case, the SDN gateway acts as a router between the virtualized network and the physical network.

Using L3 forwarding connection, tenant network virtual machines can connect to a physical network through the Windows Server 2016/2019/2022 SDN Gateway, which is already configured in an SDN environment. In this case, the SDN gateway acts as a router between the virtualized network and the physical network.

Using L3 forwarding connection, tenant network virtual machines can connect to a physical network through the Windows Server 2019/2022/2025 SDN Gateway, which is already configured in an SDN environment. In this case, the SDN gateway acts as a router between the virtualized network and the physical network.

To learn more, check these articles: Windows server gateway as a forwarding gateway and RAS gateway high availability.

Ensure the following before you attempt to configure L3 connection:

• Ensure you're logged on as an administrator on the VMM server.
• You must configure a unique next-hop logical network, with unique VLAN ID, for each Tenant VM network for which L3 forwarding needs to be set up. There must be 1:1 mapping between a tenant network and corresponding physical network (with unique VLAN ID).

Use the following steps to create the next-hop logical network in VMM:

1. On the VMM console, select Logical Networks, right-click and select Create Logical Network.

2. In the Settings page, choose One connected network and select Create a VM network with the same name to allow virtual machines to access this logical network directly and Managed by Microsoft Network Controller.

   

3. Create an IP Pool for this new logical network. IP address from this pool is required for setting up L3 forwarding.

Use the following steps to configure L3 forwarding:

1. In the VMM console, select the tenant virtual network that you want to connect to the physical network through L3 gateway.

2. Right-click the selected tenant virtual network, select Properties > Connectivity.

3. Select Connect to another network through a VPN tunnel. Optionally, to enable BGP peering in your datacenter, select Enable Border Gateway Protocol (BGP).

4. Select the network controller service for the gateway device.

5. In the VPN Connections page, select Add> Add Layer 3 tunnel.

   

6. Provide a subnet in the CIDR notation format for Routing Subnet. This subnet is used to route packets out of the VM network. You don't need to pre-configure this subnet in your datacenter.

   

7. Use the following information and configure the L3 connection:

• If you're using static routes, enter all the remote subnets that you want to connect to, in Routes.

  

  Note

  You must configure routes in your physical network, for the tenant virtual network subnets, with the next hop as the IP address of the L3 interface on the SDN gateway (Local IP address used in the creation of L3 connection). This is to ensure that the return traffic to the tenant virtual network is routed correctly through the SDN gateway.

• If you're using BGP, ensure that BGP peering is established between the SDN gateway internal interface IP address, which is present in a different compartment on the gateway VM (not the default compartment) and the peer device on the physical network.

  For BGP to work, you must do the following steps:

  1. Add BGP peer for the L3 connection. Enter your ASN, peer BGP IP, and its ASN on the Border Gateway Protocol page.

     

  2. Determine the SDN gateway internal address as detailed in the following section.

  3. Create BGP peer on the remote end (physical network gateway). While creating the BGP peer, use the SDN gateway internal address (as determined in the previous step) as the peer IP address.

  4. Configure a route on the physical network with the destination as the SDN gateway internal address and the next hop as the L3 interface IP address (Local IP address value used when creating L3 connection).

You can choose to configure static routes or dynamic routes (over BGP) with the L3 connection. If you're using static routes, you can add them using Add-SCNetworkRoute as described in the script below.

If you use BGP with L3 tunnel connection, BGP peering must be established between the SDN gateway internal interface IP address, which is present in a different compartment on the gateway VM (not the default compartment) and the peer device on the physical network.

For BGP to work, you must use the following steps:

1. Add BGP peer for the L3 connection using the Add-SCBGPPeer cmdlet.

   Example: Add-SCBGPPeer -Name "peer1" -PeerIPAddress "12.13.14.15" -PeerASN 15 -VMNetworkGateway $VmNetworkGateway

2. Determine the SDN gateway internal address as detailed in the following section.

3. Create BGP peer on the remote end (physical network gateway). While creating the BGP peer, use the SDN gateway internal address (determined in step 2 above) as the peer IP address.

4. Configure a route on the physical network with the destination as the SDN gateway internal address and the next hop as the L3 interface IP address (LocalIPAddresses parameter in the script).