{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-176-check-where-sdn-virtual-network-encryption-stops/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-176-check-where-sdn-virtual-network-encryption-stops/", "slug": "dse-20260908-176-check-where-sdn-virtual-network-encryption-stops", "url": "https://update.dsesecurity.com/updates/dse-20260908-176-check-where-sdn-virtual-network-encryption-stops/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-176-check-where-sdn-virtual-network-encryption-stops.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-176-check-where-sdn-virtual-network-encryption-stops/" }, "title": "Check where SDN virtual network encryption stops", "summary": "Which traffic is covered by encryption on an SDN virtual subnet?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:14:15+00:00", "modified_at": "2026-09-08T18:26:31+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 2, "word_count": 226, "potentially_affected": "Administrators enabling encryption on Windows Server SDN virtual networks.", "dse_recommendation": "Create a protection matrix with one row per application flow.", "primary_source": { "name": "Configure Encryption for a Virtual Network", "url": "https://learn.microsoft.com/en-us/windows-server/networking/sdn/vnet-encryption/sdn-config-vnet-encryption", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft describes subnet encryption using DTLS for virtual machines communicating inside an encryption-enabled subnet. The configuration requires encryption certificates on the SDN Hyper-V hosts and a Network Controller credential referencing the certificate thumbprint. The source states that traffic crossing between subnets, or leaving the virtual network, is not encrypted by this feature even when the subnets are marked for encryption. Microsoft Learn.

\n

Applicability

\n

Map the actual source and destination subnets for the protected workload. Distinguish a same-subnet conversation from cross-subnet and external traffic. Decide which additional protection is needed for each path rather than treating one enabled setting as a complete traffic inventory.

\n

DSE recommendation

\n

Create a protection matrix with one row per application flow. Identify the certificate and credential objects used by the intended hosts, the subnet setting, and the expected protection at every boundary. Ask the workload owner to approve coverage gaps explicitly. Keep certificate handling and renewal ownership in the configuration record and preserve the original settings for the pilot.

\n

Verification

\n

Test representative traffic within a protected subnet, across a subnet boundary, and outside the virtual network. Use authorized observations that can distinguish the relevant protection without collecting unnecessary payloads. Compare the evidence with the flow matrix and investigate any unsupported assumption before expanding encryption to more workloads.

\n

Official references

\n

Microsoft Learn: Configure Encryption for a Virtual Network. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft describes subnet encryption using DTLS for virtual machines communicating inside an encryption-enabled subnet. The configuration requires encryption certificates on the SDN Hyper-V hosts and a Network Controller credential referencing the certificate thumbprint. The source states that traffic crossing between subnets, or leaving the virtual network, is not encrypted by this feature even when the subnets are marked for encryption. Microsoft Learn.\nApplicability\nMap the actual source and destination subnets for the protected workload. Distinguish a same-subnet conversation from cross-subnet and external traffic. Decide which additional protection is needed for each path rather than treating one enabled setting as a complete traffic inventory.\nDSE recommendation\nCreate a protection matrix with one row per application flow. Identify the certificate and credential objects used by the intended hosts, the subnet setting, and the expected protection at every boundary. Ask the workload owner to approve coverage gaps explicitly. Keep certificate handling and renewal ownership in the configuration record and preserve the original settings for the pilot.\nVerification\nTest representative traffic within a protected subnet, across a subnet boundary, and outside the virtual network. Use authorized observations that can distinguish the relevant protection without collecting unnecessary payloads. Compare the evidence with the flow matrix and investigate any unsupported assumption before expanding encryption to more workloads.\nOfficial references\nMicrosoft Learn: Configure Encryption for a Virtual Network. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft describes subnet encryption using DTLS for virtual machines communicating inside an encryption-enabled subnet. The configuration requires encryption certificates on the SDN Hyper-V hosts and a Network Controller credential referencing the certificate thumbprint. The source states that traffic crossing between subnets, or leaving the virtual network, is not encrypted by this feature even when the subnets are marked for encryption. [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/networking/sdn/vnet-encryption/sdn-config-vnet-encryption).\n\n## Applicability\n\nMap the actual source and destination subnets for the protected workload. Distinguish a same-subnet conversation from cross-subnet and external traffic. Decide which additional protection is needed for each path rather than treating one enabled setting as a complete traffic inventory.\n\n## DSE recommendation\n\nCreate a protection matrix with one row per application flow. Identify the certificate and credential objects used by the intended hosts, the subnet setting, and the expected protection at every boundary. Ask the workload owner to approve coverage gaps explicitly. Keep certificate handling and renewal ownership in the configuration record and preserve the original settings for the pilot.\n\n## Verification\n\nTest representative traffic within a protected subnet, across a subnet boundary, and outside the virtual network. Use authorized observations that can distinguish the relevant protection without collecting unnecessary payloads. Compare the evidence with the flow matrix and investigate any unsupported assumption before expanding encryption to more workloads.\n\n## Official references\n\n[Microsoft Learn: Configure Encryption for a Virtual Network](https://learn.microsoft.com/en-us/windows-server/networking/sdn/vnet-encryption/sdn-config-vnet-encryption). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-176-check-where-sdn-virtual-network-encryption-stops/", "url": "https://update.dsesecurity.com/updates/dse-20260908-176-check-where-sdn-virtual-network-encryption-stops/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-176-check-where-sdn-virtual-network-encryption-stops/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check where SDN virtual network encryption stops", "item": "https://update.dsesecurity.com/updates/dse-20260908-176-check-where-sdn-virtual-network-encryption-stops/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-176-check-where-sdn-virtual-network-encryption-stops/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-176-check-where-sdn-virtual-network-encryption-stops/", "url": "https://update.dsesecurity.com/updates/dse-20260908-176-check-where-sdn-virtual-network-encryption-stops/", "headline": "Check where SDN virtual network encryption stops", "description": "Which traffic is covered by encryption on an SDN virtual subnet?", "abstract": "Which traffic is covered by encryption on an SDN virtual subnet?", "articleBody": "Source facts\nMicrosoft describes subnet encryption using DTLS for virtual machines communicating inside an encryption-enabled subnet. The configuration requires encryption certificates on the SDN Hyper-V hosts and a Network Controller credential referencing the certificate thumbprint. The source states that traffic crossing between subnets, or leaving the virtual network, is not encrypted by this feature even when the subnets are marked for encryption. Microsoft Learn.\nApplicability\nMap the actual source and destination subnets for the protected workload. Distinguish a same-subnet conversation from cross-subnet and external traffic. Decide which additional protection is needed for each path rather than treating one enabled setting as a complete traffic inventory.\nDSE recommendation\nCreate a protection matrix with one row per application flow. Identify the certificate and credential objects used by the intended hosts, the subnet setting, and the expected protection at every boundary. Ask the workload owner to approve coverage gaps explicitly. Keep certificate handling and renewal ownership in the configuration record and preserve the original settings for the pilot.\nVerification\nTest representative traffic within a protected subnet, across a subnet boundary, and outside the virtual network. Use authorized observations that can distinguish the relevant protection without collecting unnecessary payloads. Compare the evidence with the flow matrix and investigate any unsupported assumption before expanding encryption to more workloads.\nOfficial references\nMicrosoft Learn: Configure Encryption for a Virtual Network. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:14:15+00:00", "dateModified": "2026-09-08T18:26:31+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-176-check-where-sdn-virtual-network-encryption-stops/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-176-check-where-sdn-virtual-network-encryption-stops/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check where SDN virtual network encryption stops" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 226, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure Encryption for a Virtual Network", "url": "https://learn.microsoft.com/en-us/windows-server/networking/sdn/vnet-encryption/sdn-config-vnet-encryption" } } ] } }