How to configure VLANs in Windows 11 and Windows Server step by step

Setting up a VLAN in Windows 11 can seem complicated at first, especially if you're coming from environments like Hyper-V and VMwareUnraid or managed switches are examples where the VLAN concept is widely accepted. However, by understanding the limitations of Windows, the network driver options, and the available tools, a fairly flexible environment can be achieved, both on desktop computers and servers.

In this article we're going to see, calmly and in everyday Spanish, how to work with Tagged VLANs (802.1Q) in Windows 11, Windows 10, and Windows Serverwhat each edition can do, what depends on the hardware (Intel, Realtek, Broadcom, etc.), how to take advantage PowerShell and how to integrate VLANs with Hyper-V for virtual machines. We'll also address several common real-world problems, such as a lack of connectivity in a Windows 11 VM on an unraid VLAN or the need to separate iSCSI traffic into its own VLAN.

Basic concepts: what a VLAN is and what you need in Windows

A VLAN (Virtual LAN) according to the standard IEEE 802.1Q Simply put, it's a way to divide a physical network into several logically separate networks. Each network packet can include one VLAN tag (VLAN ID from 1 to 4094) which indicates which virtual network that traffic belongs to.

The beauty of VLANs is that they allow segment the network, reduce broadcast domains, and isolate traffic (for example, separating the user network, the management network, the storage iSCSI or WiFi guest network) without having to run more cable or install more physical switches.

For VLAN tagging to work, both the switch or router (trunk port) how the network card and operating system understand 802.1Q. In practice, this means:

• Physical network adapter whose driver supports VLAN 802.1Q labeling.
• Managed switch or router (Cisco, HP, Mikrotik, etc.) configured with trunk and/or access ports, with the VLANs you will use.
• In Windows, a method to Assign VLAN ID to the physical NIC or virtual NICs (manufacturer's driver, dedicated tools, PowerShell or Hyper-V).

Multiple VLANs are allowed on a single trunk port of a switch (or router, such as an ISP-provided Cisco ASR920). The port typically has a Native VLAN (PVID) Untagged VLANs and several tagged VLANs, such as: untagged VLAN 1 and tagged VLANs 70, 71, and 80. The device connected to that port must be able to send and receive those tags; otherwise, it will only see the native VLAN.

Limitations and possibilities of Windows 10 and Windows 11 with VLAN

In desktop editions, such as Windows 10 and Windows 11VLAN support is considerably more limited than in Windows Server. Out of the box, most drivers simply They ignore any 802.1Q labels that reaches them through the physical interface, so the system only sees the port's native VLAN.

Even so, there are several approaches to getting Windows 11 to work with VLANs, from using advanced driver options to pulling Hyper-V and virtual switchesIt's important to fully understand what your machine can do before you drive yourself crazy configuring the switch.

Configure a VLAN from the network adapter properties

Some network controllers allow you to directly define a VLAN ID in the advanced options of the device. In Windows 10 and 11 this usually limits you to a single VLAN per physical interface, but for many home or office scenarios this may be sufficient.

The general steps are:

1. Open the Device administrator (devmgmt.msc).
2. Expand the section Network adapters and open the properties of the NIC you want to use.
3. Go to the tab Advanced or similar.
4. Find a property type VLAN ID, VLAN Identifier, 802.1Q VLAN or similar.
5. Enter the VLAN number you want to use, for example 20, 24, 80, etc.
6. In some models, you first need to activate a certain option. Packet Priority and VLAN to allow labeling.

With this method, all outgoing traffic from that card will go labeled with the VLAN you have configuredWindows will only expect incoming traffic with that same ID. It's a straightforward solution, but it only gives you one logical interface per NIC.

Assigning a VLAN with PowerShell in Windows 10/11

In modern versions of Windows 10 and Windows 11, there is an option to configure a single VLAN ID directly on an interface using PowerShell and the Set-NetAdapter cmdletThe idea is similar to the previous one, but controlled by a line of commands.

Basic example To set VLAN 24 on the "Ethernet0" adapter:

Set-NetAdapter -Name "Ethernet0" -VlanID 24

This command tells the system that the "Ethernet0" adapter will be working in the VLAN 24. From there, you can configure an IP address on the associated network (for example, 192.168.24.10/24) and the connection will work as long as the The switch must have the port in trunk or access mode compatible. with that VLAN.

Use of manufacturer tools: Realtek, Intel, Broadcom and others

Some manufacturers offer much more powerful utilities than the default Windows options for managing VLANs. These tools make it possible to create multiple virtual interfaces on the same physical card, each with its own VLAN ID.

Typically, you'll need to download and install the latest driver and official utility Check with the manufacturer to enable full 802.1Q support. Not all models support it, so always check the controller's specifications.

Multiple VLANs on a Realtek card in Windows 10/11

On Realtek cards that support 802.1Q tagging (for example, RTL8169SC type controllers and similar) you can use the Realtek Ethernet Diagnostic Utility, an application for Windows 7/8/10/11 that, in addition to diagnostics, allows you to create virtual NICs.

El general procedure is

• Check on the Realtek website that your network chip model supports VLAN tagging.
• Download and install the latest driver and the "Realtek Ethernet Diagnostic Utility" tool.
• Open the utility and enter the section VLAN.
• Pulsar Add or "Add" and enter the Desired VLAN ID.
• Repeat the operation to create as many logical VLANs as you need.

After doing this, new connections will appear in the Windows network connections panel. virtual adapterseach one is associated with a different VLAN ID. You can assign each one its own IP configuration (subnet, gateway, DNS, etc.) just like any other card.

If you still have problems getting the VLAN to work (as happens to some users who try to use VLANs on Windows 11 VMs with unraid or with VMware), it is very possible that the Realtek driver did not implement the labeling correctly with that specific combination of hardware and software. In these cases, you can touch:

• Try alternative drivers or older/newer versions.
• Consult with the Realtek technical support if there is official VLAN support for your hardware ID.
• Assess the use of another network card with better VLAN support if segmentation is critical.

VLAN configuration on Intel cards (Intel ANS and PROSet)

Intel has been offering for years Intel Advanced Network Services (ANS) to create VLANs and teams on your adapters. Traditionally, when installing the driver and the option Intel PROSet for Device Manager Along with "Advanced Network Services", there was a specific tab for VLANs in the physical NIC properties where you could create several labeled interfaces.

The problem is that in modern builds of Windows 10 and Windows 11 this feature It is no longer supported on the classic panel, displaying messages such as:

Intel(R) Advanced Network Services (Intel(R) ANS) Teams and VLANs are not supported on Microsoft Windows 10.

Even so, Intel has been publishing New versions of drivers and the Intel PROSet tool which, combined with PowerShell, once again enables VLAN management on many NIC models. After installing the appropriate version, cmdlets from the module can be used. IntelNetCmdlets to create virtual adapters:

Import the module from Intel:

Import-Module -Name "C:\Program Files\Intel\Wired Networking\IntelNetCmdlets\IntelNetCmdlets" -Scope Local

Create an untagged virtual adapter (native VLAN, VLAN 0):

Add-IntelNetVLAN -ParentName "Intel(R) Ethernet Connection I219-LM" -VLANID 0

Create a virtual adapter in a specific VLAN, for example the VLAN 103:

Add-IntelNetVLAN -ParentName "Intel(R) Ethernet Connection I219-LM" -VLANID 103

List all adapters (physical and virtual) visible to Windows:

Get-NetAdapter

Remove a VLAN that you no longer want to use:

Remove-IntelNetVLAN -ParentName "Intel(R) Ethernet Connection I219-LM" -VLANID 103

Broadcom and other manufacturers have a similar approach using utilities such as Broadcom Advanced Control Suite, from which you can create interface groups and assign different VLAN IDs to them.

VLAN on Windows Server 2012 R2, 2016, 2019 and 2022 without third-party drivers

In server systems, especially since Windows Server 2012 R2 and laterMicrosoft offers native tools for managing multiple VLANs on the same physical NIC, without the need for special drivers (provided the card supports tagged traffic). One of the most flexible options is NIC Teaming (LBFO).

Let's imagine a very typical scenario: a Windows server connected to a trunk port with PVID 1 and VLAN 70, 71 and 80 taggedThe server is already working on the production network with an IP address like 192.168.2.1 (VLAN 1), but you need set up an iSCSI destination in VLAN 80 for storage, so that the host is the one who sees the LUNs and then exposes them to virtual machines using VHDX.

The correct way to do this in Windows Server is create additional logical interfaces associated with the tagged VLANs, either through NIC Teaming or, if you use Hyper-V, through virtual switches and dedicated management adapters.

Configuring multiple VLANs with NIC Teaming (Windows Server 2016/2019/2022)

With NIC Teaming you can group one or more physical cards into a "team" and, from there, define multiple virtual interfaceseach one linked to a VLAN. general process In Server Manager it would be:

1. OPEN server administrator and in the part of Local properties click on the link NIC Teaming Configuration.
2. In the section Equipment, click on Tasks > New teamGive it a name (for example, "vTeam") and add the physical NICs you want to group.
3. Once the team has been created, go to the section Adapters and interfaces and, in Tasks, select Add interface.
4. Specify a name for the interface (for example, "VLAN80-iSCSI") and the corresponding VLAN ID, in this case 80.
5. Repeat the process for as many VLANs as you need, keeping in mind that each device can have up to 32 virtual NICs with unique VLANs.
6. Check that in ncpa.cpl The new adapters appear and configure IP addresses, subnet masks, gateways, and DNS using the GUI or PowerShell.

In PowerShell, creating a VLAN interface on an existing device is as simple as:

Add-NetLbfoTeamNic -Team vTeam -VlanID 24 -Name VLAN24

Then you can assign an IP address and gateway to that VLAN with:

New-NetIPAddress -InterfaceAlias VLAN24 -IPAddress 192.168.24.10 -PrefixLength 24 -DefaultGateway 192.168.24.1

And set up DNS servers for that interface:

Set-DnsClientServerAddress -InterfaceAlias VLAN24 -ServerAddresses 192.168.24.12

In this way, the server will be able to communicate simultaneously through the production VLAN, iSCSI VLAN, and any other VLAN that you need, as long as the switch port is correctly configured as a trunk.

Making VLANs and Hyper-V coexist in Windows Server

When the server also has the role of Hyper-VThings get a bit more interesting, because you can use both the NIC Teaming approach and the Hyper-V virtual switches with VLANIt's important to note that in Windows Server 2022, classic LBFO teaming is declared as obsolete feature and Microsoft recommends using Switch Embedded Teaming (SET) with Hyper-V.

In any case, the goal is usually the same: to create a virtual switch associated with one or more physical NICs and, from there, assign VLANs to virtual adapters which will use the host itself (management operating system) and the virtual machines.

VLAN with Hyper-V in Windows Server and Windows 10/11 Pro

Hyper-V is not only available in Windows Server; it is also available in Windows 10/11 Pro and Enterprise as an optional feature. One of its major advantages is that it allows VLAN management at the virtual switch and VM adapter level without depending so much on the type of physical card (as long as it supports 802.1Q on the switch port).

To enable Hyper-V On a compatible edition of Windows 10/11 you can use:

Enable-WindowsOptionalFeature -Online -FeatureName:Microsoft-Hyper-V -All

Once installed, you will be able to create virtual switches from the Hyper-V Manager or with PowerShell, and assign VLANs to both the management operating system and the virtual machines.

Allow a virtual switch to use a specific VLAN

When you create an external virtual switch in Hyper-V and bind it to a physical NIC that supports VLANs, you have the option to mark a VLAN ID for host's own traffic (the so-called "administrative operating system"). The GUI procedure is:

1. In Hyper-V Manager, in the right-hand panel, open Virtual Switch Manager.
2. In the list of Virtual Switches, select the external switch connected to the physical NIC.
3. In the section of VLAN Identifier, activate the box Enable virtual LAN identification for the management operating system.
4. Enter the VLAN number that the host will use for its management traffic (for example, 10, 20, 80…).
5. Pulsar Accept to apply the changes.

All traffic passing through the physical adapter associated with the virtual switch is will be labeled with the defined VLAN ID when generated by the host operating system. In turn, virtual machines connected to that switch will be able to have their own VLAN ID at the VM adapter level.

Assigning a VLAN to a virtual machine in Hyper-V

To ensure that a virtual machine only sees traffic from a specific VLAN, you need to configure the VLAN identification on your virtual network adapterAgain, the GUI process is simple:

1. In Hyper-V Manager, in the list of virtual machines, right-click on the VM and choose Configuration (or select it and press Settings in the right panel).
2. In the menu of Hardware, select the Network adapter to which the corresponding virtual switch is connected.
3. go to section VLAN ID and check the option Enable virtual LAN identification.
4. Enter the same VLAN ID that you configured on the switch, or the one you want to use for that specific VM if the switch is in trunk mode.
5. Save changes with Accept.

If the virtual machine needs working with multiple VLANs (for example, one interface on the production VLAN and another on a VLAN of backup), can:

• Add more virtual network adapters connected to the corresponding switches, each with its VLAN ID.
• Or configure the adapter in trunk mode using the cmdlet Set-VMNetworkAdapterVlan to allow a list of specific VLANs.

Advanced VLAN management in Hyper-V with PowerShell

If you prefer the automation (or if you have many VLANs), you can create management and VM adapters with VLANs directly from PowerShell. A typical workflow would be:

Create a virtual switch linked to a physical adapter:

New-VMSwitch -Name vSwitch2 -NetAdapterName "Ethernet0" -AllowManagementOS $true

Add a management adapter in a specific VLAN (for example 24):

Add-VMNetworkAdapter -ManagementOS -Name VLAN24 -StaticMacAddress "11-11-AA-BB-CC-DD" -SwitchName vSwitch2
Set-VMNetworkAdapterVlan -ManagementOS -VMNetworkAdapterName VLAN24 -Access -VlanId 24

This adapter will appear as another network card in the system, associated only with the VLAN 24You can repeat the process for other VLANs and, if you have virtual machines, assign specific VLANs to them with:

Set-VMNetworkAdapterVlan -VMName "MiVM" -Access -VlanId 30

To list the VLANs of all VMs:

Get-VMNetworkAdapterVLAN

When working with Windows Server 2022 and Hyper-V, instead of classic NIC Teaming it is advisable to use Switch Embedded Teaming (SET)For example, to create a switch with embedded teaming across two physical NICs:

New-VMSwitch -Name HVVLANSwitch1 -NetAdapterName "Ethernet3","Ethernet4" -EnableEmbeddedTeaming $true

Then you can create management adapters on different VLANs:

Add-VMNetworkAdapter -ManagementOS -Name "VLAN22" -StaticMacAddress "XX-XX-XX-XX-XX-XX" -SwitchName HVVLANSwitch1
Set-VMNetworkAdapterVlan -ManagementOS -VMNetworkAdapterName "VLAN22" -Access -VlanId 22

If you want an adapter to receive traffic from multiple VLANs, you can switch to trunk mode and define a range of allowed VLANs and a native VLAN:

Get-VMNetworkAdapter -Name "tuAdaptador" | Set-VMNetworkAdapterVlan -Trunk -AllowedVlanIdList 40-69 -NativeVlanId 0

In this case, the parameter -NativeVlanId 0 This indicates that VLAN 0 is used as the native VLAN for untagged traffic. This allows you to manage complex scenarios without needing multiple physical NICs.

Common problems and practical considerations when configuring VLANs in Windows 11

When working with VLANs in Windows 11 and mixed environments (Hyper-V, VMware, unraid, carrier routers, etc.) it is very common to encounter seemingly inexplicable connectivity problemsIn many cases, the problem lies in how each platform interprets and applies the 802.1Q labels.

A typical example is a Windows 11 VM running on unraid. The user configures a VLAN on the network portion of unraid and changes the VM's interface to a bridge. br0.20 (associated with VLAN 20), but when the machine is turned on, it cannot access the internet. In these cases, it is essential to check:

• That the switch or router The port to which the unraid host is connected has the port as a trunk with VLAN 20 allowed.
• That the hypervisor (unraid, Hyper-V, VMware) The VLAN is correctly applied to the VM's virtual port.
• That within Windows 11, a different VLAN is not being forced through the virtual NIC driver.
• That the VM's IP configuration (IP, mask, gateway) actually corresponds to the network of that VLAN.

Something similar happens when comparing the behavior between Hyper-V and VMwareHyper-V allows you to easily set the VLAN ID on both the virtual switch and each VM adapter, while VMware ESXi/ESX has three different tagging methods:

• EST (External Switch Tagging)All labeling is done on the physical switch, and the port groups on the virtual switch carry VLAN 0.
• VST (Virtual Switch Tagging)The virtual switch handles the labeling; each group of ports has a specific VLAN ID.
• VGT (Virtual Guest Tagging): it is the very virtual machine who labels traffic, so the port group is usually in trunk.

If setting the VLAN ID on the VM adapter works in Hyper-V but not in VMware, you might be mixing modes (for example, using VGT when the switch port expects VST) or the Your physical NIC driver may have lost its tagging capability., as has happened with some Intel models in certain versions of Windows.

In particularly nasty cases, you may need to pull:

• Tests with others NIC models (Intel, Broadcom, Mellanox…).
• Detailed review of the trunk port configuration of the operator's switch or router (such as a Cisco ASR920).
• Contact the manufacturer's support (Realtek, Intel, VMware) to confirm what is actually supported on the specific combination of hardware, firmware, and operating system.

Ultimately, working with VLANs in Windows 11 and server versions requires a thorough understanding of them. limitations of the edition you are using, the capabilities of the driver, and the behavior of the hypervisorWith the appropriate drivers (Realtek, Intel, Broadcom), the use of PowerShell to assign VLANs and, when appropriate, support from Hyper-V and NIC Teaming/SET, it is possible to set up scenarios with multiple logical networks (production, iSCSI, management, backup, laboratory…) on a small number of physical interfaces without losing either security or performance.