- [Narrator] If Software-Defined Networks, or SDN,
have escaped your radar to this point,
Windows Server 2019 has given you at least
one good reason to take a serious look.
One of the security features of Windows Server 2019
is the ability to encrypt traffic
between virtual machines on a per-subnet basis.
Now, the features of NTFS and various server roles
have long provided ways to secure data
on the server at rest,
or data while it's sitting on that storage device.
The security of data as it crosses the network
has always been another animal altogether.
When you want to protect your network data
over long distances,
you might consider using a virtual private network
or across a large data center,
you might set up IPSec from one segment to another
but this approach leaves out securing transmissions
within a network segment.
If you have unused network jacks or any other way
for people to access the fabric of your network,
traffic within a subnet can be vulnerable.
Windows Server 2019 now has an option to use certificates
on Hyper-V hosts to enable the encryption
within these local network segments.
It starts by installing matching certificates
on all of the Hyper-V hosts.
These certificates act as credentials,
and allow the VM-host machines to recognize each other.
With those certificates in place, the VM-host machines
create virtual networks or virtual switches
that connect together even over a physical fabric,
and are managed by a network controller.
With that in place, any virtual machine connected
to the encrypted virtual network will automatically
have traffic encrypted at the datagram level.
Quick OSI review for those that don't have to think
about this very often.
Right above the hardware, and before the IP
or network layer, is where network packets
are prepared for delivery.
This is normally where the NIC drivers take over
and create datagrams specific to your type of network.
The SDN-encrypted networks take these packets
and encrypt them right before dumping them onto the cable.
When you look at where the configuration happens,
you may have noticed one area
that we were able to leave untouched.
There was no configuration done
to the servers installed as virtual machines.
That's the beauty of doing this at the datagram level.
The virtual servers don't require any configuration.
You don't have to worry about adding
new configuration details to your deployment images
or to your Desired State Configuration scripts.
It's set up entirely at the Hyper-V host level.
All you have to do with the VMs is remember
to connect them to the right virtual network
or the right virtual switch on the host.
Microsoft has put together a great step-by-step lab
in the Microsoft Docs website that walks
through the process from getting the certificates
to setting up the virtual network.
It's done entirely in PowerShell but,
as I've mentioned before, it's high time that we all
embrace PowerShell as the preferred tool to get things done.