A New Dawn of Software Defined Networking (SDN) in Windows Server 2025

Today is an exciting day as we unveil a wide range of new features and improvements to software-defined networking (SDN) in Windows Server 2025.. We are deeply grateful for the fantastic feedback and requests that have helped us evolve our team.

We hope you’re as excited as we are, and we’d love to hear how you use these new features.. We’ve categorized our updates into three main areas: manageability, security, and scalability.

Ease of Management

“Native” SDN infrastructure: The long-awaited feature is finally here! Traditionally, network controllers, a critical part of SDN infrastructure, have been hosted in virtual machines (VMs), requiring multiple VMs for high availability. This setting is computing Otherwise, the resources available to the application pose serious problems for small applications.-scale single node Failover Cluster. In Windows Server 2025, we moved the Network Controller from a VM to hosting it directly as a Failover Cluster service on Windows Server 2025 hosts. This change not only saves resources, but also simplifies deployment and management by eliminating the need to deploy, manage, and update VMs. Yes, you no longer need to patch or install agents. Different teams on this VM. You can deploy and manage a “native” SDN infrastructure using PowerShell cmdlets or Windows Admin Center. Native SDN offers the following benefits: Deliver advanced VM network security in less than 10 minutes.

Figure: Differences between a VM’s network controller and the “native” network controller

Simplified SDN Load Balancer (coming soon): Previously, setting up an SDN load balancer service required establishing Border Gateway Protocol (BGP) peering between the load balancer virtual machine and a top-of-rack network switch to implement external network connectivity. This process was cumbersome and incurred additional operating costs, consuming both resources and energy. This is especially rich For SMB and small edge deployments Advanced networking knowledge and know-how may be limited. Future updates are BGP Optionally simplifies both deployment and management processes.

security

Network security is a top concern for today’s organizations as breaches, threats, and cybersecurity risks increase. SDN Network Security Groups (NSGs) provide Windows Server customers with Azure-consistent network security, protecting against external and lateral threats. Windows Server 2025 introduces new NSG features to further secure your workloads.

teaAg-based segmentation: Instead of relying on cumbersome and unreliable methods to specify IP ranges for NSG control, administrators can now use custom service tags to associate NSGs and VMs for access control. You no longer need to remember and re-enter the IP ranges of your production and management systems. You now have simple, easy-to-understand labels. This allows you to tag workload VMs with labels of your choice and apply security policies based on these tags. You can deploy and manage network security tags using PowerShell cmdlets or Windows Admin Center. You can learn more about tag-based segmentation. here.

Figure: Network security tag in Windows Admin Center

Default network policy: Brings Azure parity to existing network security groups (NSGs) in Windows Server 2025. Default network policies now help reduce side attacks for workloads deployed through Windows Admin Center and provide options such as “Open some ports” and “Use existing network.” NSG’ or ‘No Protection’.

• no protection: All ports on the VM are exposed to the network, posing a security risk.
• Open some ports.: The default policy denies all inbound access, allowing the VM to selectively open well-known inbound ports while allowing full outbound access.
• Use existing NSG: Utilizes an already created NSG.

These options ensure that newly created VMs and applications are always protected by NSG. You can learn more about default network policies. here.

Figure: Default network policy in Windows Admin Center during VM creation

scalability

SDN Multisite: Many users deploy applications in multiple locations and need the flexibility to move parts of those applications without having to reconfigure the applications or the network. Windows Server typically only partially supported this scenario and required additional components for deployment and management. SDN Multisite solves this problem by providing native Layer 2 and Layer 3 connectivity between applications across two locations without any additional components. It also provides unified network policy management for your workloads, eliminating the need to update policies when workload VMs move from one location to another. You can deploy and manage SDN Multisite using PowerShell cmdlets or Windows Admin Center. You can learn more about SDN Multisite. here.

Figure: Basic connectivity to workload VMs across Cali.fornia and Norway WS 2025 cluster with SDN multi-site

High-Performance SDN Gateway: SDN Layer 3 gateways are essential to SDN infrastructure and act as routers to provide connectivity between workloads in the SDN network and external networks. Many of you have requested performance improvements to these gateways. With Windows Server 2025, we have significantly improved the performance of our SDN Layer 3 gateways, achieving higher throughput (~15-30% improvement) and reduced CPU cycles (~25-40% improvement). These improvements are enabled by default, so you will automatically experience better performance when you configure your SDN gateway layer 3 connection through PowerShell cmdlets or Windows Admin Center.

learning

Exciting news! We’ve launched new learning content tailored to empower our customers and support engineers with in-depth knowledge and practice of SDN. All self-paced content is comprised of lectures and exercises aimed at providing actionable knowledge that promotes customer success. You can access the learning content here. Technical Reference for Software Defined Networking (SDN)| microsoft run.

We are excited to share all of these innovations with you.. Try these features by upgrading to Windows Server 2025. We look forward to your feedback. If you have suggestions, comments, or concerns, please contact us at: sdn_feedback@microsoft.com.