{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-093-choose-a-networking-approach-before-enabling-nested-hyper-v/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-093-choose-a-networking-approach-before-enabling-nested-hyper-v/", "slug": "dse-20260908-093-choose-a-networking-approach-before-enabling-nested-hyper-v", "url": "https://update.dsesecurity.com/updates/dse-20260908-093-choose-a-networking-approach-before-enabling-nested-hyper-v/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-093-choose-a-networking-approach-before-enabling-nested-hyper-v.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-093-choose-a-networking-approach-before-enabling-nested-hyper-v/" }, "title": "Choose a networking approach before enabling nested Hyper-V", "summary": "Which networking assumptions should be checked when running Hyper-V inside a virtual machine?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:15:38+00:00", "modified_at": "2026-09-08T18:20:22+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 199, "potentially_affected": "Administrators preparing supported nested Hyper-V test environments.", "dse_recommendation": "Draw the host, first-level VM, nested guests, switches, and proposed address path.", "primary_source": { "name": "Run Hyper-V in a Virtual Machine with Nested Virtualization", "url": "https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/enable-nested-virtualization", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Nested virtualization allows Hyper-V to run within a virtual machine. Microsoft performs the processor-exposure configuration while that virtual machine is powered off. For packets to traverse two virtual-switch layers, the documented approach enables MAC address spoofing at the first virtual-machine level. Microsoft also describes NAT as an alternative when spoofing cannot be used, including public-cloud scenarios. Microsoft documentation.

\n

Applicability

\n

Check the physical processor, host release, guest release, VM configuration, and platform restrictions against the source prerequisites. Define which nested guests require outside connectivity and which should remain isolated.

\n

DSE recommendation

\n

Draw the host, first-level VM, nested guests, switches, and proposed address path. Have the network owner approve the chosen method and its boundary. Schedule the required VM shutdown and retain the original processor and network settings before enabling the nested environment.

\n

Verification

\n

Test connectivity from a nested guest to each intended destination and check an explicitly disallowed path. Confirm the address observed outside the nested environment and record the forwarding configuration. Recheck the first-level VM after a restart, and preserve any difference from the approved network diagram as an unresolved finding.

\n

Official references

\n

Microsoft Learn: Run Hyper-V in a Virtual Machine with Nested Virtualization. Source reviewed September 8, 2026.

", "content_text": "Source facts\nNested virtualization allows Hyper-V to run within a virtual machine. Microsoft performs the processor-exposure configuration while that virtual machine is powered off. For packets to traverse two virtual-switch layers, the documented approach enables MAC address spoofing at the first virtual-machine level. Microsoft also describes NAT as an alternative when spoofing cannot be used, including public-cloud scenarios. Microsoft documentation.\nApplicability\nCheck the physical processor, host release, guest release, VM configuration, and platform restrictions against the source prerequisites. Define which nested guests require outside connectivity and which should remain isolated.\nDSE recommendation\nDraw the host, first-level VM, nested guests, switches, and proposed address path. Have the network owner approve the chosen method and its boundary. Schedule the required VM shutdown and retain the original processor and network settings before enabling the nested environment.\nVerification\nTest connectivity from a nested guest to each intended destination and check an explicitly disallowed path. Confirm the address observed outside the nested environment and record the forwarding configuration. Recheck the first-level VM after a restart, and preserve any difference from the approved network diagram as an unresolved finding.\nOfficial references\nMicrosoft Learn: Run Hyper-V in a Virtual Machine with Nested Virtualization. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nNested virtualization allows Hyper-V to run within a virtual machine. Microsoft performs the processor-exposure configuration while that virtual machine is powered off. For packets to traverse two virtual-switch layers, the documented approach enables MAC address spoofing at the first virtual-machine level. Microsoft also describes NAT as an alternative when spoofing cannot be used, including public-cloud scenarios. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/enable-nested-virtualization).\n\n## Applicability\n\nCheck the physical processor, host release, guest release, VM configuration, and platform restrictions against the source prerequisites. Define which nested guests require outside connectivity and which should remain isolated.\n\n## DSE recommendation\n\nDraw the host, first-level VM, nested guests, switches, and proposed address path. Have the network owner approve the chosen method and its boundary. Schedule the required VM shutdown and retain the original processor and network settings before enabling the nested environment.\n\n## Verification\n\nTest connectivity from a nested guest to each intended destination and check an explicitly disallowed path. Confirm the address observed outside the nested environment and record the forwarding configuration. Recheck the first-level VM after a restart, and preserve any difference from the approved network diagram as an unresolved finding.\n\n## Official references\n\n[Microsoft Learn: Run Hyper-V in a Virtual Machine with Nested Virtualization](https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/enable-nested-virtualization). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-093-choose-a-networking-approach-before-enabling-nested-hyper-v/", "url": "https://update.dsesecurity.com/updates/dse-20260908-093-choose-a-networking-approach-before-enabling-nested-hyper-v/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-093-choose-a-networking-approach-before-enabling-nested-hyper-v/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Choose a networking approach before enabling nested Hyper-V", "item": "https://update.dsesecurity.com/updates/dse-20260908-093-choose-a-networking-approach-before-enabling-nested-hyper-v/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-093-choose-a-networking-approach-before-enabling-nested-hyper-v/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-093-choose-a-networking-approach-before-enabling-nested-hyper-v/", "url": "https://update.dsesecurity.com/updates/dse-20260908-093-choose-a-networking-approach-before-enabling-nested-hyper-v/", "headline": "Choose a networking approach before enabling nested Hyper-V", "description": "Which networking assumptions should be checked when running Hyper-V inside a virtual machine?", "abstract": "Which networking assumptions should be checked when running Hyper-V inside a virtual machine?", "articleBody": "Source facts\nNested virtualization allows Hyper-V to run within a virtual machine. Microsoft performs the processor-exposure configuration while that virtual machine is powered off. For packets to traverse two virtual-switch layers, the documented approach enables MAC address spoofing at the first virtual-machine level. Microsoft also describes NAT as an alternative when spoofing cannot be used, including public-cloud scenarios. Microsoft documentation.\nApplicability\nCheck the physical processor, host release, guest release, VM configuration, and platform restrictions against the source prerequisites. Define which nested guests require outside connectivity and which should remain isolated.\nDSE recommendation\nDraw the host, first-level VM, nested guests, switches, and proposed address path. Have the network owner approve the chosen method and its boundary. Schedule the required VM shutdown and retain the original processor and network settings before enabling the nested environment.\nVerification\nTest connectivity from a nested guest to each intended destination and check an explicitly disallowed path. Confirm the address observed outside the nested environment and record the forwarding configuration. Recheck the first-level VM after a restart, and preserve any difference from the approved network diagram as an unresolved finding.\nOfficial references\nMicrosoft Learn: Run Hyper-V in a Virtual Machine with Nested Virtualization. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:15:38+00:00", "dateModified": "2026-09-08T18:20:22+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-093-choose-a-networking-approach-before-enabling-nested-hyper-v/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-093-choose-a-networking-approach-before-enabling-nested-hyper-v/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose a networking approach before enabling nested Hyper-V" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 199, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Run Hyper-V in a Virtual Machine with Nested Virtualization", "url": "https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/enable-nested-virtualization" } } ] } }