{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-049-document-tenant-and-subnet-identifiers-in-an-hnvv2-overlay-network/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-049-document-tenant-and-subnet-identifiers-in-an-hnvv2-overlay-network/", "slug": "dse-20260908-049-document-tenant-and-subnet-identifiers-in-an-hnvv2-overlay-network", "url": "https://update.dsesecurity.com/updates/dse-20260908-049-document-tenant-and-subnet-identifiers-in-an-hnvv2-overlay-network/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-049-document-tenant-and-subnet-identifiers-in-an-hnvv2-overlay-network.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-049-document-tenant-and-subnet-identifiers-in-an-hnvv2-overlay-network/" }, "title": "Document tenant and subnet identifiers in an HNVv2 overlay network", "summary": "How should tenant boundaries be represented when HNVv2 virtual networks reuse IP ranges?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:16:22+00:00", "modified_at": "2026-09-08T18:17:14+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 2, "word_count": 233, "potentially_affected": "Use this review for a documented HNVv2 deployment.", "dse_recommendation": "Maintain a mapping that records tenant ownership and overlay identifiers alongside address ranges.", "primary_source": { "name": "Hyper-V Network Virtualization Technical Details in Windows Server", "url": "https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/hyper-v-network-virtualization/hyperv-network-virtualization-technical-details-windows-server", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

The implementation described by this Microsoft source is HNVv2. Microsoft models a Hyper-V Network Virtualization customer as an owner of one or more virtual networks, each containing virtual subnets. HNV uses NVGRE or VXLAN encapsulation to isolate overlay networks, allowing different tenants to use overlapping IP subnets. A virtual subnet supplies Layer 3 subnet semantics and a broadcast domain, with isolation associated with an NVGRE TNI or VXLAN VNI. Microsoft documentation.

\n

Applicability

\n

Use this review for a documented HNVv2 deployment. Identify the tenant, virtual network, subnet, and encapsulation in use before interpreting an IP address or troubleshooting a connection. Verify the current platform requirements for that design.

\n

DSE recommendation

\n

Maintain a mapping that records tenant ownership and overlay identifiers alongside address ranges. Have the network owner inspect any reused address ranges and confirm their intended isolation boundaries. Include both permitted intra-tenant paths and prohibited cross-tenant paths in the test plan. Preserve the mapping with the configuration so operational records do not depend on IP addresses alone.

\n

Verification

\n

Test representative connections within an intended virtual network and across a boundary that should remain isolated. Record the tenant and overlay context for every result. Compare the observed path with the approved mapping and investigate a misplaced identifier before changing application addressing. Update the map after any accepted network change.

\n

Official references

\n

Microsoft Learn: Hyper-V Network Virtualization Technical Details in Windows Server. Source reviewed September 8, 2026.

", "content_text": "Source facts\nThe implementation described by this Microsoft source is HNVv2. Microsoft models a Hyper-V Network Virtualization customer as an owner of one or more virtual networks, each containing virtual subnets. HNV uses NVGRE or VXLAN encapsulation to isolate overlay networks, allowing different tenants to use overlapping IP subnets. A virtual subnet supplies Layer 3 subnet semantics and a broadcast domain, with isolation associated with an NVGRE TNI or VXLAN VNI. Microsoft documentation.\nApplicability\nUse this review for a documented HNVv2 deployment. Identify the tenant, virtual network, subnet, and encapsulation in use before interpreting an IP address or troubleshooting a connection. Verify the current platform requirements for that design.\nDSE recommendation\nMaintain a mapping that records tenant ownership and overlay identifiers alongside address ranges. Have the network owner inspect any reused address ranges and confirm their intended isolation boundaries. Include both permitted intra-tenant paths and prohibited cross-tenant paths in the test plan. Preserve the mapping with the configuration so operational records do not depend on IP addresses alone.\nVerification\nTest representative connections within an intended virtual network and across a boundary that should remain isolated. Record the tenant and overlay context for every result. Compare the observed path with the approved mapping and investigate a misplaced identifier before changing application addressing. Update the map after any accepted network change.\nOfficial references\nMicrosoft Learn: Hyper-V Network Virtualization Technical Details in Windows Server. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nThe implementation described by this Microsoft source is HNVv2. Microsoft models a Hyper-V Network Virtualization customer as an owner of one or more virtual networks, each containing virtual subnets. HNV uses NVGRE or VXLAN encapsulation to isolate overlay networks, allowing different tenants to use overlapping IP subnets. A virtual subnet supplies Layer 3 subnet semantics and a broadcast domain, with isolation associated with an NVGRE TNI or VXLAN VNI. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/hyper-v-network-virtualization/hyperv-network-virtualization-technical-details-windows-server).\n\n## Applicability\n\nUse this review for a documented HNVv2 deployment. Identify the tenant, virtual network, subnet, and encapsulation in use before interpreting an IP address or troubleshooting a connection. Verify the current platform requirements for that design.\n\n## DSE recommendation\n\nMaintain a mapping that records tenant ownership and overlay identifiers alongside address ranges. Have the network owner inspect any reused address ranges and confirm their intended isolation boundaries. Include both permitted intra-tenant paths and prohibited cross-tenant paths in the test plan. Preserve the mapping with the configuration so operational records do not depend on IP addresses alone.\n\n## Verification\n\nTest representative connections within an intended virtual network and across a boundary that should remain isolated. Record the tenant and overlay context for every result. Compare the observed path with the approved mapping and investigate a misplaced identifier before changing application addressing. Update the map after any accepted network change.\n\n## Official references\n\n[Microsoft Learn: Hyper-V Network Virtualization Technical Details in Windows Server](https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/hyper-v-network-virtualization/hyperv-network-virtualization-technical-details-windows-server). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-049-document-tenant-and-subnet-identifiers-in-an-hnvv2-overlay-network/", "url": "https://update.dsesecurity.com/updates/dse-20260908-049-document-tenant-and-subnet-identifiers-in-an-hnvv2-overlay-network/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-049-document-tenant-and-subnet-identifiers-in-an-hnvv2-overlay-network/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Document tenant and subnet identifiers in an HNVv2 overlay network", "item": "https://update.dsesecurity.com/updates/dse-20260908-049-document-tenant-and-subnet-identifiers-in-an-hnvv2-overlay-network/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-049-document-tenant-and-subnet-identifiers-in-an-hnvv2-overlay-network/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-049-document-tenant-and-subnet-identifiers-in-an-hnvv2-overlay-network/", "url": "https://update.dsesecurity.com/updates/dse-20260908-049-document-tenant-and-subnet-identifiers-in-an-hnvv2-overlay-network/", "headline": "Document tenant and subnet identifiers in an HNVv2 overlay network", "description": "How should tenant boundaries be represented when HNVv2 virtual networks reuse IP ranges?", "abstract": "How should tenant boundaries be represented when HNVv2 virtual networks reuse IP ranges?", "articleBody": "Source facts\nThe implementation described by this Microsoft source is HNVv2. Microsoft models a Hyper-V Network Virtualization customer as an owner of one or more virtual networks, each containing virtual subnets. HNV uses NVGRE or VXLAN encapsulation to isolate overlay networks, allowing different tenants to use overlapping IP subnets. A virtual subnet supplies Layer 3 subnet semantics and a broadcast domain, with isolation associated with an NVGRE TNI or VXLAN VNI. Microsoft documentation.\nApplicability\nUse this review for a documented HNVv2 deployment. Identify the tenant, virtual network, subnet, and encapsulation in use before interpreting an IP address or troubleshooting a connection. Verify the current platform requirements for that design.\nDSE recommendation\nMaintain a mapping that records tenant ownership and overlay identifiers alongside address ranges. Have the network owner inspect any reused address ranges and confirm their intended isolation boundaries. Include both permitted intra-tenant paths and prohibited cross-tenant paths in the test plan. Preserve the mapping with the configuration so operational records do not depend on IP addresses alone.\nVerification\nTest representative connections within an intended virtual network and across a boundary that should remain isolated. Record the tenant and overlay context for every result. Compare the observed path with the approved mapping and investigate a misplaced identifier before changing application addressing. Update the map after any accepted network change.\nOfficial references\nMicrosoft Learn: Hyper-V Network Virtualization Technical Details in Windows Server. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:16:22+00:00", "dateModified": "2026-09-08T18:17:14+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-049-document-tenant-and-subnet-identifiers-in-an-hnvv2-overlay-network/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-049-document-tenant-and-subnet-identifiers-in-an-hnvv2-overlay-network/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Document tenant and subnet identifiers in an HNVv2 overlay network" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 233, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Hyper-V Network Virtualization Technical Details in Windows Server", "url": "https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/hyper-v-network-virtualization/hyperv-network-virtualization-technical-details-windows-server" } } ] } }