How to Configure NVGRE on Windows Server 2016

How to Configure Windows Server 2016 NVGRE

Network Virtualization using Generic Routing Encapsulation (NVGRE) is a network virtualization encapsulation protocol developed by Microsoft and included in Windows Server 2016 as part of Hyper-V Network Virtualization (HNV). NVGRE encapsulates Ethernet frames within GRE packets, enabling virtual networks to operate independently of the underlying physical network topology. Like VXLAN, NVGRE allows tenants to use overlapping IP address spaces without conflict, which is essential for cloud and multi-tenant datacenter environments.

NVGRE uses a 24-bit Virtual Subnet Identifier (VSID) field within the GRE key to differentiate between tenant virtual networks. Windows Server 2016 uses NVGRE as a supported encapsulation type in its SDN stack alongside VXLAN. The choice between NVGRE and VXLAN often depends on hardware support — NVGRE has broader hardware offload support from older network adapter generations, while VXLAN has become the more widely adopted standard in newer deployments.

Prerequisites

To configure NVGRE on Windows Server 2016 you need: multiple Hyper-V hosts running Windows Server 2016, network adapters that support NVGRE task offloading (for performance), the Hyper-V role and Network Virtualization feature installed, and Network Controller deployed for centralized SDN policy management. Physical network switches must allow GRE (IP protocol 47) traffic between Hyper-V hosts.

Step 1: Install Network Virtualization Feature

Install the Network Virtualization feature on each Hyper-V host that will run NVGRE-encapsulated workloads:

Install-WindowsFeature NetworkVirtualization

Install the Hyper-V role and management tools if not already present:

Install-WindowsFeature Hyper-V, RSAT-Hyper-V-Tools -IncludeManagementTools

Step 2: Enable NVGRE on the Hyper-V Switch

Create a Hyper-V external virtual switch on each host:

New-VMSwitch -Name "HNV-vSwitch" -NetAdapterName "Ethernet" -AllowManagementOS $true

Verify NVGRE task offload support on the network adapter:

Get-NetAdapterHardwareInfo -Name "Ethernet" | Select-Object *NVGRE*

Enable NVGRE offload if supported:

Set-NetAdapterEncapsulatedPacketTaskOffload -Name "Ethernet" -NvgreEncapsulatedPacketTaskOffloadEnabled $true

Step 3: Configure Provider Addresses

Each Hyper-V host participating in NVGRE encapsulation requires a Provider Address (PA) — the physical IP address used in the outer GRE packet header. Assign provider addresses on the host:

New-NetIPAddress -InterfaceAlias "vEthernet (HNV-vSwitch)" -IPAddress 10.0.10.1 -PrefixLength 24 -DefaultGateway 10.0.10.254

Register this PA with the HNV policy store:

New-NetVirtualizationProviderAddress -InterfaceAlias "vEthernet (HNV-vSwitch)" -ProviderAddress 10.0.10.1 -PrefixLength 24

Step 4: Define Customer Addresses and Lookup Records

In HNV, each VM has both a Customer Address (CA) — the IP address visible to the VM — and a Provider Address — the physical host IP used for encapsulation. Create a lookup record mapping a VM’s CA to the host PA:

New-NetVirtualizationLookupRecord -CustomerAddress 192.168.1.10 -ProviderAddress 10.0.10.1 -VirtualSubnetID 5001 -MACAddress "00-15-5D-00-01-01" -Rule TranslationMethodEncap

The VirtualSubnetID (VSID) is the NVGRE equivalent of the VXLAN VNI — a 24-bit identifier for the virtual network. Each tenant network gets a unique VSID.

Step 5: Configure VM Customer Routes

Define the customer routes for the virtual network. This tells HNV which Customer Address prefixes belong to each virtual subnet:

New-NetVirtualizationCustomerRoute -RoutingDomainID "{11111111-2222-3333-4444-555555555555}" -VirtualSubnetID 5001 -CustomerAddressPrefix "192.168.1.0/24" -NextHop 0.0.0.0 -Metric 255

Step 6: Associate VM Network Adapter with VSID

Attach a VM’s network adapter to the NVGRE virtual subnet by setting the virtual subnet ID on the Hyper-V virtual network adapter:

Set-VMNetworkAdapterIsolation -VMName "TenantVM1" -IsolationMode NativeVirtualSubnet -DefaultIsolationID 5001 -AllowUntaggedTraffic $true

Step 7: Verify NVGRE Encapsulation

Check the current HNV lookup records to verify configuration:

Get-NetVirtualizationLookupRecord

List provider addresses to confirm registration:

Get-NetVirtualizationProviderAddress

Test connectivity between VMs on different hosts that share the same VSID. Traffic between the VMs will be NVGRE-encapsulated at the host level and de-encapsulated at the destination host before delivery to the VM.

Test-NetConnection -ComputerName 192.168.1.20 -InformationLevel Detailed

Troubleshooting NVGRE

If connectivity between VMs fails, verify that GRE protocol 47 is not blocked on physical network devices. Check that all Hyper-V hosts have correct lookup records for all VMs. Confirm VSID values match on both the sender and recipient lookup records. Use the following to view statistics:

Get-NetVirtualizationStatistics

NVGRE in Windows Server 2016 provides a proven network virtualization encapsulation method that underpins multi-tenant virtual networking in Microsoft SDN environments and Hyper-V-based cloud platforms.