I'm not a network guy, but a system administrator by background. I find myself, now, the sole IT guy at a growing business.

(This turned into a long explanation to setup the question, which is at the bottom of the post.)

I have four hosts in a colocation rack, two Synology NAS devices.

Each host is running 2012 R2 Hyper-V.

Each host has four NICs: 3 1gb and 1 10gb.

We talk to the hosts via a PAN firewall/VPN, which fronts a juniper switch, using http, https, RDP, SSL.

When the plan for deployment was written, by a now-departed admin, we ran up a proof of concept using Debian and ...

The 10gb NICs were VLAN/Internal, reserved for internal use only: between the guest VMs, and to the NAS devices. The IPs here were assigned to 10.10.1.x block.

The 3 1gb NICs were teamed in VLAN/External, and were used exclusively for internet traffic. The hosts on this network were assigned IPs in our public /26 block.

Since then we've scaled back the number of hypervisors, switched from Debian to Server 2012 R2, added the PAN firewall/VPN.

I'm not sure the VLAN idea makes any sense, if it ever did. We've added the Firewall at the top of the rack, and we can now NAT the traffic.

And every time I describe this setup to network pros, they sort of look funny, like it's all needlessly complicated. I'd like to simplify this, if possible.

My idea is to give all hosts IPs in the same subnet, using a single VLAN. My sticky point is this;

I'd like to continue to have each hypervisor (and each guest vm) use the 10gb NIC to talk amongst themselves, and to the NAS devices, while sending 'external' traffic (web, RDP) on the 1gb nics.

This will let us do the data crunching and file writing as quickly as possible, which is the whole reason for the exercise.

How do I do that? Use routing on the hypervisor?

By request: from my whiteboard, to tiff.

as is and to be

  • Vlan or routing both sound like possible solutions. Would you happen to have a diagram to illustrate the current and intended situation?
    – Gerben
    Jun 25, 2014 at 20:39
  • I'll run up something in dia and post. Jun 25, 2014 at 21:01
  • From my whiteboard, to tiff. Sorry for the ratty quality, but it was easier to screenshot dia than to fight with it's exporter. Jun 25, 2014 at 21:29
  • I'm not seeing the problem you are trying to solve. You want to simplify by having one VLAN, and then need something to keep stuff separate within this one VLAN. And the ultimate goal is higher throughput? Is the current speed slower than you would expect?
    – Gerben
    Jun 25, 2014 at 22:33
  • Let me try that again. If you're still paying attention, thanks. My problem is that I have Server 1gb NIC1 - 10gb NIC2 - NAS 10gb NIC - When this was Debian it was fine. Ripped that out, installed Windows, and now Server NIC2 ( can't 'see' NAS NIC ( It is this problem I'm trying to resolve. I suspect my former co-worker did some undocumented static routes to make it all happen, but I am not sure. Jun 26, 2014 at 17:22

2 Answers 2


I think 2 private networks is the right way to do this. The second network is just like what everyone calls a SAN except it's ethernet with iSCSI, etc. instead of FC.

Example setup:

Your firewall has a public IP and a private IP ( It uses SNAT to translate private machines to the internet public IP.

All your machines have internal IPs (, including hypervisor, storage server, etc. (so you can manage them). The default gateway is

The hypervisor and storage servers have a separate dedicated storage/migration subnet also (, which is not routed, NATted or bridged to the first subnet, and has no static routes, or gateway (and probably no dns, dhcp, etc.). One reason it is nice to have this separate is so you can raise the MTU without worrying about hardware support of some random desktop machines, etc. which don't support 9000 MTU.

If your storage was a cluster, it would be the same (many connections to the main network, and many connections to the storage network).

And then the VMs would not have any access to the storage network, but they would use the storage from the hypervisor which uses the storage network. (So I don't like your left side diagram that connects VMs to the storage.)

To separate them, you can use VLANs (to share switches or other hardware), or different hardware (but the separate hardware should also have some admin access, perhaps join it into the other stuff with a simple VLAN; don't bridge them). And even if they are separate, don't necessarily assume that security is irrelevant; someone can still plug in a device to the network.


First, I highly recommend you check out this book on Hyper-V. Specifically you will want to read the chapter on Networking, subsection Advanced Networking.

Second, you definitely want VLANs to split out traffic types. It is unfortunate that you're stuck with 1 10GbE adapter that you wish to share with SAN, management and VM traffic. The method I would look at would be this:


  • Vlan 10: Management
  • Vlan 11: FC Management (if using failover cluster)
  • Vlan 20: SAN
  • Vlan 30: VM internal
  • Vlan 40: VM external

I would not route Vlan 20 at all.

Switch Setup

On the switch, the 10GbE port would be configured for trunking. The 3 1GbE ports would be configured for LACP, switch port access vlan 40.

Host VM Switch #1

On each host you would add a VM switch to the 10GbE adapter. Then you would add Management OS VM net adapters (Hyper-V terms) to this switch. One for actual management and one for iSCSI (and a third for failover cluster communication if you're using FC). You will configure each adapter to its own specific vlan and assign appropriate IPs.

Host LACP Team / VM Switch #2

Then you would create a network team in Server 2012 for your 3 1GbE ports. You will want to use LACP with HyperVPort load balancing. After this you build a second VM switch using this network team for the VMs external traffic.

VM Network Adapters

When you create your VMs, you can add a NIC on the second switch for external traffic, a NIC on the first switch in Vlan 20 for SAN traffic (if needed, though I recommend their own Vlan for SAN with specific security on the SAN boxes if this is a must so they cannot modify VM storage) and a NIC on the first switch for inter-vlan traffic in Vlan 30.


For each virtual NIC on the hosts, you will want to add some sort of QoS to make sure the SAN traffic has priority on the 10GbE link.

Lastly, this has more to do with best practices for your virtualization environment and you may wish to move this to Server Fault.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.