Security in Hyper-V

Hyper-V is Microsoft’s virtualization technology running on Windows Server 2008 R2 now and is largely being used in so many networks nowadays. Hyper-V could support so many different applications that even now Microsoft Forefront TMG 2010 can be run on it; so we can completely virtualize the edge of the network in a very efficient design. I have written three articles for virtualization of Forefront TMG 2010 and you can access them from the links below:

Deploying the network edge on a virtualized environment – Part 1

Deploying the network edge on a virtualized environment – Part 2

Deploying the network edge on a virtualized environment – Part 3

Once we run so many different applications and servers on different virtual machines, we come to wonder whether it is really secure or we are just putting all the servers running on Hyper-V at risk of being hacked? The answer is Yes, it is really secure provided that we implement a good design.

So as you know Hyper-V includes a parent partition which is basically our main Windows Server 2008 R2 (64-Bit) on which we have installed the Hyper-V role and this is where all the Hyper-V management toolset is installed and can be accessed.

And there is one or more child partitions on which we could install another operating system as our virtual machine and make it operational to give or maybe even receive any kind of services.

Now imagine that Hyper-V is on the edge of your network and there is a very high possibility that some bad guy would attack it. Now what if the bad guy did attack your server and because of some security bug that one of your applications had, your parent partition got hacked and he penetrated into your parent partition. Now what? He has access to all the other VMs through the Hyper-V manager and can make any kind of modification on the other child partitions and operating systems.

So the first step is to think of disconnecting the parent partition from the internet while still giving internet access to the virtual machines. Is it possible? Yes, it is.

So let’s say that you have a network adapters that is connected to the Interent. You simply right click on that NIC (Physical NIC) and go to the properties and follow the configuration that you see in the picture below:

Then you will open up your Virtual Network Manager and create a New Virtual Network and call it WAN and make it an External Connection type and in the drop down menu right below External, choose the NIC that is connected to the Internet (The one you just saw its properties above). The next thing you need to know is that you need to uncheck “Allow management operating system to share this network adapter”.

Now you are done and if you test the parent partition you will see it is disconnected from the Internet; here was how you can disconnect the parent VM from the Internet. Now if you have another child virtual VM and if you want to connect it to the Internet, what will you do? Do you think now that you disconnect the parent from the internet it is still possible to give the child internet access? Yes it is…

Let’s say the child is a TMG server that you want to give it Internet access and then connect the rest of the network to the Internet through TMG. On your Hyper-V network manager console, right click on the child VM with TMG and then click on the settings and then click on the Network Adapter on the right. Then on the top of the window, connect it to the WAN network:

Now if you test network connectivity on your TMG child VM, you can see that it is connected to the internet. On the TMG VM still you need to add another Network adapter and connect it to the LAN physical network interface, because you need the LAN users to see your TMG and then connect through it to the Internet.

Remember that on the Hyper-V server you still need to install a third network adapter for the management purposes and connect it physically to a management switch. So if you did install one, go to the Virtual Network Manager and create a new Virtual Network called Management and make it an External network and then add that new Network adapter as the chosen network adapter and this time check “Allow management operating system to share this network adapter” to let the management users access the parent VM through this interface.

I hope it was useful 

To get more information about my book click on the book below:


Best of luck

Deploying the network edge on a virtual environment – Part 3

Now that you have some background knowledge on the concept of a virtualized network edge, we will go a little bit deeper and in this post I will try to illustrate different scenarios where we put TMG in our network:

1- TMG as an Edge Firewall

An edge firewall is a firewall placed on the edge of the network connecting the LAN to the Internet and is capable of inspecting any traffic that enters or exits the network.

As it is shown in the illustration, we will install the TMG on a Guest VM on Hyper-V and will disconnect the parent OS from the internet.

We need to create two virtual NICs on the Guest VM. One of the virtual NICs is connected to the physical server’s NIC linked to the LAN and the other virtual NIC is connected to the physical server’s NIC linked to the Internet.

Notes: The connection between the virtual NIC and the physical NIC is established through a Virtual Switch on each side. So keep in mind that in this scenario we will need to have two virtual switches.

2- TMG as a Three-Legged Firewall

A three-legged firewall is a type of firewall that is connected to three different network segments namely LAN, DMZ (Perimeter Network) and the Internet.

As precisely depicted in the illustration, everything looks and is configured the same as when we had an edge TMG firewall with the only difference that we need to have a new and third Virtual NIC on the Guest VM running TMG which is connected to the DMZ section of the network.

There goes to scenario here:

  • The DMZ is on the same Hyper-V Server. In this case we are going to have a specific virtual switch for our DMZ section. This switch is connected to the TMG on one side and to the virtual NICs of the Guest VMs from the other side. This way we can have a link between the TMG and the Guest VMs which are placed in DMZ.
  • The DMZ is not on the same Hyper-V server and is on another server or servers. The picture below can describe things a little bit better. In this scenario we still have the DMZ virtual switch but this virtual switch is not straight connected to the other DMZ Guest VMs; instead it is connected to them through the physical NIC of the server.

Notes: I don’t explain more on this scenario to avoid confusion; because I believe the picture is clearly showing what I am trying to say.

3- TMG as a Back-to-Back Firewall

In this scenario we have two TMGs both installed on two different Guest VMs. One of them is playing the role ofa frontier firewall connected to the Internet through a Virtual Switch; and the other TMG is playing the role of aback-end firewall connected to the LAN through another Virtual Switch.

Both of these Guest VMs running TMG, from the other side, are connected to a DMZ Virtual Switch. This virtual switch is also connected to the other VMs in the DMZ.

Notes: Again like the previous scenario, the DMZ section could be either on the same Hyper-V Server or on another server or servers. It totally depends on your design.

Here I just talked about the design and not the configuration on the TMG and VMs. Basically there are a number of things that need to be configured correctly if you want to get these scenarios up and running. In the next and most probably the last post of this series, I will talk about the configuration with all the details.

Some months ago I also had a deep dive session in Microsoft Virtualization and Security Summit 2010 and it was on deploying TMG on a virtualized environment. Below you can see my presentation slides shared for your use.

You want to learn more about this topic? Check out my new book below and have access to great and practical tutorials and step-by-step guides all in one book:

To get more information about the book click on the book below:


Wish you all the best