{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-094-map-container-endpoint-addresses-onto-an-sdn-tenant-subnet/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-094-map-container-endpoint-addresses-onto-an-sdn-tenant-subnet/", "slug": "dse-20260908-094-map-container-endpoint-addresses-onto-an-sdn-tenant-subnet", "url": "https://update.dsesecurity.com/updates/dse-20260908-094-map-container-endpoint-addresses-onto-an-sdn-tenant-subnet/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-094-map-container-endpoint-addresses-onto-an-sdn-tenant-subnet.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-094-map-container-endpoint-addresses-onto-an-sdn-tenant-subnet/" }, "title": "Map container endpoint addresses onto an SDN tenant subnet", "summary": "How are Windows container endpoints addressed when attached to an SDN tenant virtual network?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:15:37+00:00", "modified_at": "2026-09-08T18:20:22+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 216, "potentially_affected": "Administrators connecting Windows container endpoints to existing SDN tenant networks.", "dse_recommendation": "Prepare an endpoint allocation worksheet before configuring the host.", "primary_source": { "name": "Connect container endpoints to a tenant virtual network", "url": "https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Connect-container-endpoints-to-a-Tenant-Virtual-Network", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s procedure uses the l2bridge network driver, with l2tunnel as another option, for container networks within a tenant VM. For these SDN drivers, container endpoints occupy the same virtual subnet as the tenant VM that hosts them. The Host Networking Service assigns endpoint addresses through the private-cloud plugin. The endpoints have distinct IP addresses but share their host VM’s MAC address because Layer-2 address translation is used. Microsoft documentation.

\n

Applicability

\n

Check the existing tenant network, subnet, VM NIC resource, container host, and documented software prerequisites. Treat the source’s sample addresses as examples and substitute only addresses approved for the actual tenant subnet.

\n

DSE recommendation

\n

Prepare an endpoint allocation worksheet before configuring the host. Identify the tenant network, container address range, responsible network controller, and expected isolation boundary. Review the relationship between endpoint IP identities and the shared MAC identity with the operators who will investigate connectivity.

\n

Verification

\n

Create a controlled endpoint and compare its assigned address with the approved range and tenant subnet. Test its allowed connections and isolation from a separate tenant. Preserve the controller, host, and container observations together so address allocation and policy enforcement can be assessed for the same endpoint.

\n

Official references

\n

Microsoft Learn: Connect container endpoints to a tenant virtual network. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft’s procedure uses the l2bridge network driver, with l2tunnel as another option, for container networks within a tenant VM. For these SDN drivers, container endpoints occupy the same virtual subnet as the tenant VM that hosts them. The Host Networking Service assigns endpoint addresses through the private-cloud plugin. The endpoints have distinct IP addresses but share their host VM’s MAC address because Layer-2 address translation is used. Microsoft documentation.\nApplicability\nCheck the existing tenant network, subnet, VM NIC resource, container host, and documented software prerequisites. Treat the source’s sample addresses as examples and substitute only addresses approved for the actual tenant subnet.\nDSE recommendation\nPrepare an endpoint allocation worksheet before configuring the host. Identify the tenant network, container address range, responsible network controller, and expected isolation boundary. Review the relationship between endpoint IP identities and the shared MAC identity with the operators who will investigate connectivity.\nVerification\nCreate a controlled endpoint and compare its assigned address with the approved range and tenant subnet. Test its allowed connections and isolation from a separate tenant. Preserve the controller, host, and container observations together so address allocation and policy enforcement can be assessed for the same endpoint.\nOfficial references\nMicrosoft Learn: Connect container endpoints to a tenant virtual network. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft’s procedure uses the l2bridge network driver, with l2tunnel as another option, for container networks within a tenant VM. For these SDN drivers, container endpoints occupy the same virtual subnet as the tenant VM that hosts them. The Host Networking Service assigns endpoint addresses through the private-cloud plugin. The endpoints have distinct IP addresses but share their host VM’s MAC address because Layer-2 address translation is used. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Connect-container-endpoints-to-a-Tenant-Virtual-Network).\n\n## Applicability\n\nCheck the existing tenant network, subnet, VM NIC resource, container host, and documented software prerequisites. Treat the source’s sample addresses as examples and substitute only addresses approved for the actual tenant subnet.\n\n## DSE recommendation\n\nPrepare an endpoint allocation worksheet before configuring the host. Identify the tenant network, container address range, responsible network controller, and expected isolation boundary. Review the relationship between endpoint IP identities and the shared MAC identity with the operators who will investigate connectivity.\n\n## Verification\n\nCreate a controlled endpoint and compare its assigned address with the approved range and tenant subnet. Test its allowed connections and isolation from a separate tenant. Preserve the controller, host, and container observations together so address allocation and policy enforcement can be assessed for the same endpoint.\n\n## Official references\n\n[Microsoft Learn: Connect container endpoints to a tenant virtual network](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Connect-container-endpoints-to-a-Tenant-Virtual-Network). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-094-map-container-endpoint-addresses-onto-an-sdn-tenant-subnet/", "url": "https://update.dsesecurity.com/updates/dse-20260908-094-map-container-endpoint-addresses-onto-an-sdn-tenant-subnet/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-094-map-container-endpoint-addresses-onto-an-sdn-tenant-subnet/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Map container endpoint addresses onto an SDN tenant subnet", "item": "https://update.dsesecurity.com/updates/dse-20260908-094-map-container-endpoint-addresses-onto-an-sdn-tenant-subnet/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-094-map-container-endpoint-addresses-onto-an-sdn-tenant-subnet/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-094-map-container-endpoint-addresses-onto-an-sdn-tenant-subnet/", "url": "https://update.dsesecurity.com/updates/dse-20260908-094-map-container-endpoint-addresses-onto-an-sdn-tenant-subnet/", "headline": "Map container endpoint addresses onto an SDN tenant subnet", "description": "How are Windows container endpoints addressed when attached to an SDN tenant virtual network?", "abstract": "How are Windows container endpoints addressed when attached to an SDN tenant virtual network?", "articleBody": "Source facts\nMicrosoft’s procedure uses the l2bridge network driver, with l2tunnel as another option, for container networks within a tenant VM. For these SDN drivers, container endpoints occupy the same virtual subnet as the tenant VM that hosts them. The Host Networking Service assigns endpoint addresses through the private-cloud plugin. The endpoints have distinct IP addresses but share their host VM’s MAC address because Layer-2 address translation is used. Microsoft documentation.\nApplicability\nCheck the existing tenant network, subnet, VM NIC resource, container host, and documented software prerequisites. Treat the source’s sample addresses as examples and substitute only addresses approved for the actual tenant subnet.\nDSE recommendation\nPrepare an endpoint allocation worksheet before configuring the host. Identify the tenant network, container address range, responsible network controller, and expected isolation boundary. Review the relationship between endpoint IP identities and the shared MAC identity with the operators who will investigate connectivity.\nVerification\nCreate a controlled endpoint and compare its assigned address with the approved range and tenant subnet. Test its allowed connections and isolation from a separate tenant. Preserve the controller, host, and container observations together so address allocation and policy enforcement can be assessed for the same endpoint.\nOfficial references\nMicrosoft Learn: Connect container endpoints to a tenant virtual network. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:15:37+00:00", "dateModified": "2026-09-08T18:20:22+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-094-map-container-endpoint-addresses-onto-an-sdn-tenant-subnet/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-094-map-container-endpoint-addresses-onto-an-sdn-tenant-subnet/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Map container endpoint addresses onto an SDN tenant subnet" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 216, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Connect container endpoints to a tenant virtual network", "url": "https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Connect-container-endpoints-to-a-Tenant-Virtual-Network" } } ] } }